A year or two ago, "should we use AI?" was a real question for small businesses. Now it's mostly answered: your competitors are using it, your customers expect faster replies, and your team is probably already pasting things into a chatbot whether you have a policy or not.
The better question is how to use it without creating new problems. This guide walks through the risks that actually matter for a small business, what each one looks like on a normal Tuesday, and the safeguard that handles it. At the end there's a one-page AI policy you can copy for your own team, including your virtual assistants.
First, a quick reality check
AI tools like Claude, ChatGPT and Gemini are very good at drafting, summarising, rewriting, researching and organising. They are not good at knowing when they're wrong. They don't understand your business the way a person does unless you give them the context. And they process whatever you type into them under the terms of the plan you're using.
Almost every AI mistake in a small business comes back to one of those three facts. Keep them in mind and the rest of this guide will feel like common sense.
Risk: sharing data you shouldn't
What it looks like: a team member pastes a client's full contract, a spreadsheet of customer emails, or a payroll file into a free AI tool to "quickly summarise it."
Why it matters: depending on the tool and the plan, what you type may be stored, reviewed or used to improve the service. Even when it isn't, your clients may not have agreed to their information going into third-party tools.
The safeguard:
Use business plans for business work. For example, Anthropic says it doesn't train its models on chats from Claude's commercial plans (Team, Enterprise and the API) by default. Consumer plans have their own settings, so check them for whichever tool you use.
Set a simple rule for what never goes into any AI tool: passwords, ID and bank details, card numbers, health information and anything a client has marked confidential.
Remove names and identifying details when the task doesn't need them. "Summarise this complaint" works just as well with the customer's name replaced by "the customer."
Risk: confident mistakes ("hallucinations")
What it looks like: an AI-written blog post cites a statistic that doesn't exist. A summary of a contract misses the one clause that matters. A reply to a customer promises a refund policy you don't have.
Why it matters: AI tools write fluently even when they're guessing. The more polished the writing, the easier it is to miss the error.
The safeguard:
Treat every AI output as a first draft. A person reviews anything that reaches a client, a customer or the public.
Ask for sources, then click them. If a number or claim can't be traced to a real source, it doesn't go out.
Give the tool your real information (price list, policies, past emails) instead of letting it fill gaps. Context reduces guessing.
Risk: deepfake and impersonation scams
What it looks like: your bookkeeper gets a voice message that sounds exactly like you, asking for an urgent supplier payment to a new account. A "client" on a video call asks your VA to send over login details.
Why it matters: the same tools that make realistic avatars and voices for marketing can be used by scammers to imitate real people. Small teams are targets precisely because they move fast and trust each other.
The safeguard:
Any request involving money, passwords or bank details gets verified through a second channel you already trust, such as a call to a known number.
Agree on one rule with your team and VAs: urgency is a reason to slow down, not speed up.
Never change payment details based on an email, message or call alone.
Risk: copyright and ownership
What it looks like: a marketing graphic generated in seconds looks suspiciously like a famous brand's artwork. A product description closely mirrors a competitor's page.
Why it matters: you're responsible for what you publish, however it was made. Rules on AI-generated content are still evolving and vary by country.
The safeguard: use AI for original work based on your own brief, never to copy someone else's design, writing or characters. Keep a human creative eye on anything that represents your brand, and use stock or your own photos where likeness and rights matter.
Risk: using real people's faces and voices
What it looks like: someone creates an AI avatar of a team member or client for a promo video without asking.
Why it matters: a person's likeness is personal. Reputable video tools build consent in. HeyGen, for example, asks the real person to record an on-camera consent statement before it will create a "digital twin" of them.
The safeguard: get clear, written permission before creating any avatar or voice clone of a real person, agree where it will be used, and remove it when they ask.
Risk: over-automation
What it looks like: an AI chatbot answers every customer message, including the angry one from your biggest client, with a cheerful template.
Why it matters: AI saves time on routine work, but relationships, complaints and judgment calls still need a human.
The safeguard: decide which conversations AI can draft and which a person must handle. A good default: AI drafts, a person sends.
Risk: "shadow AI"
What it looks like: everyone on the team uses a different AI tool on a personal account, and nobody knows what's been shared where.
The safeguard: pick one or two approved tools, put them on business accounts you control, and write down how they should be used. It's not about policing your team. It's about making the safe way the easy way.
A one-page AI policy you can copy
Paste this into a shared document, adjust it to your business, and share it with your team and your VAs.
Our AI policy. 1) We use [approved tools] on business accounts only. 2) We never enter passwords, ID or bank numbers, card details, health information, or anything a client marked confidential. 3) We remove names and personal details when a task doesn't need them. 4) AI drafts, people decide: a team member reviews everything before it reaches a client, customer or the public. 5) We check facts, numbers and sources before publishing. 6) We don't use AI to copy other people's work or to create images, avatars or voices of real people without their written permission. 7) Any request involving money, passwords or bank details is verified on a second channel. 8) If something looks wrong, we stop and ask.
The upside is worth it
None of this means AI is too risky for a small business. The opposite is true: with a few guardrails, AI is one of the best tools a small team has ever had. A VA who uses it well can draft faster, research deeper and keep more of your operations moving every day.
If you're curious what that looks like in practice, read our walkthrough of a week of real Claude workflows a VA runs, or our guide to which AI tool to use for which job.
At Virtual Raket, our Raketors use AI tools with clear guardrails like the ones above, and you can see every task, hour and end-of-day report in RaketBase. Want help putting AI to work safely in your business? Book a discovery call and start with a free 3-day trial.
