Quick answer. The data your team pastes or connects is the main AI risk for a small business: customer details, ID and account numbers, health and personnel records, passwords and confidential documents. Answer the ten questions below to score your exposure from 0 (low) to 30 (high) and get the fixes that matter most for your answers.
Score your team's AI data exposure
Answer all ten questions to see your score.
How the score works
Each answer scores 0 to 3, for a total out of 30. 0 to 6 is low exposure, 7 to 15 moderate and 16 or more high. If ID numbers, bank or card numbers, passwords or keys have gone into a tool, the result is at least moderate whatever the total, because those are the hardest leaks to undo. The score measures habits and controls, not whether any law applies to you.
Three controls that cover most of the risk
- Business accounts only. A company-owned team plan lets you set data and training options once, see who has access and remove people who leave.
- A short "never paste" list. Customer identifiers, ID and account numbers, health details, passwords and keys, personnel records and confidential documents stay out unless a reviewed tool is cleared for them.
- Review before approval. Before a tool, extension or note-taker touches business data, read its terms on training, retention, human review and admin controls, and write down what it's cleared for.
What the FTC has said about AI claims
If your marketing mentions AI, the Federal Trade Commission's existing rules on advertising still apply. Announcing its Operation AI Comply sweep on September 25, 2024, the FTC said that "there is no AI exemption from the laws on the books." In its final order against Workado, LLC (August 28, 2025), it barred accuracy claims about the company's AI detector unless they are not misleading and backed by competent and reliable evidence when made. The FTC's Consumer Reviews and Testimonials Rule, in effect since October 21, 2024, covers businesses that write or create fake reviews.
Some states have passed their own AI laws, and several have changed recently. We haven't summarized them here; check your state legislature's or attorney general's site, or ask a lawyer.
Sources
- FTC: FTC Announces Crackdown on Deceptive AI Claims and Schemes (September 25, 2024)
- FTC: FTC Approves Final Order against Workado, LLC (August 28, 2025)
- FTC: The Consumer Reviews and Testimonials Rule: Questions and Answers
A self-assessment checked November 2026, not legal advice or a security audit. If you handle health, financial, legal or children's data, or work in a regulated industry, have a lawyer review your AI rules. Not affiliated with any AI provider. Your answers stay in your browser; nothing is sent or saved.
Common questions
Is it safe for employees to use ChatGPT or other AI tools at work?
It depends on the account, the settings and what goes into it. The biggest risks for a small business are staff using personal accounts the company can't control, tools that keep or train on what's typed, and customer or employee data being pasted in. The ten questions above score those risks.
What should employees never put into an AI tool?
Customer identifiers, Social Security and other ID numbers, bank and card numbers, health information, passwords and keys, employee records and confidential documents, unless a specific tool has been reviewed and cleared for that data.
Do I have to tell customers I use AI?
That depends on your industry, your state and what you use AI for, and this page doesn't decide it. The FTC has said existing laws apply to AI claims, so don't overstate what AI does for customers, and don't use it to write reviews that pretend to come from customers. Ask a lawyer about disclosures for a regulated business.
What does the FTC say about AI in advertising?
Announcing its Operation AI Comply sweep in September 2024, the FTC said there is no AI exemption from the laws on the books. In its 2025 order against Workado, it required accuracy claims about an AI product to be backed by competent and reliable evidence.
Does a small business need a written AI policy?
This page doesn't decide whether a law requires one for your business; ask a lawyer if you're in a regulated industry. A short written policy is the simplest way to tell staff which tools are approved, what never to paste and who to tell about a mistake, and to show what you expected if something goes wrong.
Related: AI setup for small businesses (done with you) · AI Prompt Pack for Bookkeepers and Notaries (prompts for one person's own work)