Straight answers
Short, plain-English answers to the AI questions small businesses ask us most, from an IT and security team that sets these tools up every week.
Not if they use personal accounts. That's the main reason to give staff an approved business account. Business AI tools come with admin controls, and Microsoft 365 Copilot activity can be audited with Microsoft Purview, depending on your licences.
Is ChatGPT safe for business? →Microsoft 365 Copilot can use your emails to answer your own requests, like summarising a thread. It only works with what you already have access to, and Microsoft states your business data isn't used to train its models. It doesn't let colleagues see your mailbox.
Copilot readiness checklist →Yes. Copilot respects permissions, but if a file was shared with everyone in your organisation, you technically have access to it, and Copilot can bring it up. That's why fixing oversharing in SharePoint, OneDrive and Teams comes before switching Copilot on.
AI Readiness Check →OpenAI says deleted chats are removed from your account straight away and permanently deleted from its systems within about 30 days, unless it has to keep them for legal or security reasons. Don't rely on deleting as a safety net: avoid entering confidential data in the first place.
Treat an upload exactly like typing the contents in. On an approved business plan with your company's rules, it's usually fine for non-sensitive work. Don't upload client files, personal data or financial records to a free or personal account.
Free AI policy template →Only if someone connects it. Paid ChatGPT plans offer connectors to services like SharePoint and Google Drive, which admins can allow or block. Once connected, it can read whatever that person can access, so only connect what's needed.
Yes. A private AI runs open-weight models on your own server, and can work with no internet connection at all. Staff get a ChatGPT-style chat screen and your documents never go to a public AI provider.
Private AI →Rather we sorted it for you? We'll reply within a few hours.
Get in touchNot automatically. Problems start when personal data goes into tools without a lawful basis, a data processing agreement or a mention in your privacy notice. Use a business plan, share only what's needed and remove names where you can. The ICO publishes guidance on AI and data protection.
ChatGPT and UK GDPR →There's no general UK law requiring it for every use, but your contracts, professional rules or client expectations may. If AI processes clients' personal data, your privacy notice should cover it. When in doubt, being open builds trust.
Your business is. Using AI doesn't transfer responsibility for advice, figures or documents you send. That's why every AI policy should require a person to check AI output before it goes to a client or is relied on.
Google says it rewards helpful, original content however it's produced, but mass-produced pages made mainly to manipulate rankings break its spam policies. Use AI to help draft, then add your own expertise, examples and checks.
Give them an approved business tool, a clear policy and training. Bans on their own tend to push AI use onto phones where you can't see it. With the right Microsoft licences, Defender for Cloud Apps can also discover and block unapproved AI apps.
Free AI policy template →Rather we sorted it for you? We'll reply within a few hours.
Get in touchYes. An AI phone receptionist can answer calls, handle common questions, take messages and book appointments, day or night, then pass anything complex to a person. It works best for routine calls rather than sensitive conversations.
Custom AI agents →Yes. An automation can check your accounting software for overdue invoices and send polite, personalised reminders on a schedule, escalating to a person when needed. Xero and QuickBooks both have integrations that make this possible.
AI automation →It can sort incoming email, draft replies and send routine responses, such as confirming receipt or answering common questions. For anything going to a client, we usually set it to draft for a person to approve rather than send on its own.
AI automation →Modern AI can read many handwritten and scanned forms and pull the details into a spreadsheet or system. Accuracy depends on the handwriting and scan quality, so important fields should be checked by a person.
Document intelligence →Yes, in a few ways: a custom GPT on a paid ChatGPT plan, an assistant built on your own documents, or a fully private AI on your own server. The right choice depends on how sensitive the information is.
Custom AI agents →It can build a long-term memory. A private AI can keep a wiki of linked pages about your clients, projects and procedures, updated as new documents arrive, so its knowledge grows over time instead of being forgotten after each chat.
Private AI with long-term memory →Yes. With the right licence, Copilot can transcribe and recap Teams meetings, including actions and decisions. Third-party note-takers also exist, but check where they store recordings and always let participants know a meeting is being transcribed.
Microsoft Teams →It can take on the repetitive parts, such as out-of-hours calls, common questions and bookings, which frees your receptionist for the conversations that need a person. Most small businesses use it alongside staff rather than instead of them.
AI won't replace you →Rather we sorted it for you? We'll reply within a few hours.
Get in touchIt depends on how much of your day is in Outlook, Teams and Office. Start with free Copilot Chat on work accounts, then pilot paid Copilot with a few people who handle lots of email and meetings, and measure the time saved before rolling it out.
ChatGPT vs Copilot →Not ChatGPT itself, which only runs on OpenAI's systems. But open-weight models, including OpenAI's gpt-oss models, can run on a powerful PC, Mac or server. For a business, they need securing and managing like any other system.
Running AI on your own server →Automation follows fixed rules: when this happens, do that. AI adds judgement, such as reading an email, understanding what it's asking and drafting a reply. The most useful systems combine both: automation moves the data, AI handles the parts that need understanding.
AI automation guide →An AI agent is AI that can take actions, not just answer questions. It can use tools, such as checking a calendar, updating a CRM or filling in a web form, working through steps toward a goal, ideally with a person approving important actions.
Custom AI agents →Rather we sorted it for you? We'll reply within a few hours.
Get in touchUsually because it can't find clear, consistent information about you. Common causes are a website that blocks AI crawlers, missing structured data, incomplete Bing and Google business listings, or few reviews and mentions elsewhere.
AI search visibility →Ask it the questions your customers would, such as "best plumber in Ealing", in a fresh or temporary chat with search switched on. Try different wording, and repeat in Copilot, Perplexity, Gemini and Google's AI Overviews, as each can give different answers.
Get an AI visibility check →Use the feedback option on the AI Overview, then fix the source: update your Google Business Profile, correct details on your website and directories, and make sure the right information is stated clearly and consistently everywhere.
AI search visibility →Rather we sorted it for you? We'll reply within a few hours.
Get in touchYes. Criminals can clone a voice from a short recording and call staff pretending to be a director asking for an urgent payment. Agree a rule that payment or bank detail changes are always confirmed by calling back on a known number.
Spot scam calls and texts →Yes. AI helps criminals write convincing, well-written emails in any style, so spelling mistakes are no longer a reliable clue. Focus on the request instead: urgency, payments, logins and attachments. Back it up with email security and multi-factor authentication.
How to spot a phishing email →The risks are real but manageable: stolen AI accounts full of business conversations, staff leaking data into AI tools, and prompt injection, where hidden instructions in documents or web pages steer AI tools. Use business accounts, MFA, limited connections and human approval for actions.
Cybersecurity →Rather we sorted it for you? We'll reply within a few hours.
Get in touchTell us what's going on and we'll reply within a few hours. Got a question we haven't answered? Ask that too.
Ask a question