UK small businesses: before a member of staff uses AI for a piece of work, make the decision about that task. A general “AI is allowed” rule leaves important questions unanswered. What will go into the tool? What could go wrong? Who will check the result before somebody relies on it?
Use the following short task record as a practical starting point. It is a working aid, not a substitute for a data protection assessment, specialist advice or the rules that apply to your sector.
1. Name the task and its boundary
Write one sentence describing the intended output: for example, “draft three alternative headings for a public product page”. Then state what the tool is not being asked to do: approve claims, decide a customer's eligibility or send the final copy. A clear boundary gives the reviewer something concrete to check.
Keep the first trial small enough to review properly. Agree what a useful result looks like and what would cause you to stop. “Sounds professional” is a style preference; “every product feature matches our approved specification” is a check you can actually perform.
2. Check the input before it leaves your business
List the information the task needs and the tool you intend to use. Identify customer, employee, confidential or commercially sensitive material before anyone pastes it into a prompt. Check your organisation's approved tools and handling rules. If the proposed input is outside those rules, stop and resolve the question with the responsible person.
The ICO's AI guidance on security and data minimisation explains that organisations should use only the personal data necessary for their purpose and review security risks in the AI context. A public-information or fictional-data trial can be a useful way to test a workflow before considering real business records.
3. Name a reviewer and a source of truth
Choose the person who will review the output and the material they will compare it with. For a product description, that might be your approved specification. For a customer email, it might be your current policy and the verified details of the case. Set aside enough time for that check before promising a finished result.
Ask the reviewer to mark unsupported facts, missing context and anything that needs escalation. Do not make the model's confident wording your evidence. If the team cannot verify an important claim, remove it or obtain an authoritative answer before using the output.
4. Keep a short decision record
One row in a shared tracker is enough to begin. Record the task, owner, tool, permitted input, intended audience, reviewer, verification source and date. Add the outcome: approved for this limited use, approved with conditions, or paused pending a named check. Include a link to the reviewed final version where appropriate.
For example: “Public product headings; marketing owner; approved tool; public specifications only; editor checks each heading against specification v3; no automatic publishing; review again if the input or tool changes.” This is a practical workflow example, not a statement that the task is legally compliant.
5. Recheck when the task changes
A tool that helped brainstorm public headings has not automatically been approved to analyse personnel records. Reopen the task record when the input, audience, purpose or tool changes. Keep a route for staff to ask questions and report mistakes, and make the owner responsible for updating the record.
For structured workplace exercises, worked examples and reusable template structures, explore Practical AI Governance and Compliance — Premium PDF + Companion Resources. The premium PDF and companion resources are a separate digital purchase. Also available on Amazon in Kindle and paperback editions; check the edition and included materials before ordering.
Know what changed. Know what to do. Keep the proof. — PDFBlueprints
📘 PDFBlueprints — plain-English UK compliance guides for landlords, sole traders & small employers. Checklists, trackers & templates. Instant PDF. General information, not legal advice.
Official guidance checked 29 October 2026. The task record above is a practical recommendation. Requirements depend on your circumstances; check current guidance and obtain advice where needed.