Nobody asks me this question first. They ask about price, and time, and whether it will actually work. But it is the question they should ask, and the good ones get to it eventually: if you are running my business through AI, where is my data going?
I spent a good chunk of this summer on exactly that, with a solicitor, an insurer and the ICO’s guidance open in front of me, and I would rather tell you plainly what I do than have you wonder.
Every person on my team has their own AI account. Not a shared login, their own, paid for, with their own access that can be switched off the day they stop working with me. That sounds obvious and it is not what most small businesses do, which is share one login around and hope. Sharing a login means you cannot see who did what, and you cannot remove one person without locking out everyone.
Client data stays in the tools the client already uses. Your accounts live in your Xero. Your customers live in your CRM. Your files live in your Dropbox or your Drive. I work inside those, with access you have granted and can take back. I do not copy your customer list into a spreadsheet on my laptop and I do not paste it into a chatbot.
The AI tools I use are business accounts, on terms that say the provider does not train on what goes in. That is the single most important line in any AI contract and most people have never read it. If a tool cannot give you that line in writing, nothing that matters goes into it.
Some things never go into an AI tool at all. Passwords and login details, ever. Card numbers, bank details, anything that could move money. Anything sensitive about a person, health, family circumstances, the kind of detail a client shares in passing because they trust me, stays in my head and out of any system.
The paperwork exists. I hold professional indemnity insurance with cover that matches the liability cap in my contracts. My terms of business have been through a solicitor this year. Where part of my team is based outside the UK, the transfer of any personal data is covered by the proper agreement, not by hoping nobody asks. And there is a list of every tool that touches client data, so a client can see it rather than take my word for it.
And nothing goes out in your name until you have seen it. That rule is mostly about quality, but it is also about safety. Nothing an AI tool drafts reaches a customer, a prospect or the public without a person, and specifically you, reading it first.
Why go to this trouble for a small consultancy? Because I owe it to every business trusting me with theirs, and because the alternative is cutting corners, and the whole point of what I do is that things get done properly. If someone offers to run your business on AI and cannot answer these questions in plain English, that is the answer.
If you are working out whether to let anyone near your data with AI, these are the questions to ask them. I am happy to be asked them myself.