Small businesses face the same AI-powered threats as large companies — convincing phishing, voice-clone fraud, automated attacks — with far fewer resources. They are also adopting AI tools quickly, often without a security review. This checklist covers both sides in plain language.
Part 1 — Using AI tools safely
☐ Decide which tools are approved. Make a short list of AI tools your business uses, with business or enterprise plans where possible. Free consumer versions may use your data differently.
☐ Set data rules. Write one page that says what can and cannot be entered into AI tools. For example: no customer personal data, passwords, financial account details or confidential contracts in unapproved tools.
☐ Check settings. Turn off training on your data where the option exists, enable multi-factor authentication, and restrict sharing of chats and files.
☐ Review integrations. AI tools connected to email, drives or calendars can access a lot. Grant only the permissions needed and remove unused connections.
☐ Be careful with AI agents. Agents that browse the web or act on your behalf can be manipulated by hidden instructions in web pages or documents (prompt injection). Require confirmation before they send emails, make payments or change data.
☐ Verify AI outputs. Code, legal text and financial calculations produced by AI must be checked before use.
Part 2 — Defending against AI-powered attacks
☐ Train for modern phishing. Teach staff that spelling mistakes are no longer a reliable sign. Focus on context: unexpected requests, urgency, unusual payment details, links to login pages.
☐ Set a verification rule for money. Any request to change bank details or make an urgent payment must be confirmed by calling a known number — never the number in the message. Voice and video can be faked.
☐ Use a code word. For sensitive requests between owners and key staff, agree on a phrase that a deepfake caller wouldn’t know.
☐ Use phishing-resistant login. Passkeys or hardware security keys protect accounts even if someone clicks a convincing phishing link.
☐ Patch quickly. Turn on automatic updates for operating systems, browsers and key software.
☐ Back up. Keep regular backups of important data, with at least one copy offline or immutable, and test restoring them.
Part 3 — Prepare for incidents
☐ Know who to call. Note your IT provider, bank fraud line and national cyber incident reporting service.
☐ Have a simple plan. Who decides what to do if an account is compromised or money is sent to a fraudster? Act fast — banks can sometimes stop transfers if contacted immediately.
☐ Keep records. Save suspicious messages and call details for investigators.
Why this matters now
The UK National Cyber Security Centre has assessed that AI lowers barriers for less skilled cybercriminals and increases the volume of attacks. Basic hygiene — strong authentication, verification procedures, updates and backups — remains the most effective protection, whatever technology attackers use.
A one-page AI rule sheet you can adapt
Our AI rules
- Use only these AI tools with company accounts: [list].
- Never paste customer personal data, passwords, bank details or confidential contracts into AI tools.
- Check every AI output before sending it to customers or using it in decisions.
- AI agents must ask before sending, paying, deleting or sharing anything.
- Any payment or bank detail change must be confirmed by phone on a known number.
- Report anything suspicious to [name] immediately — no blame.
What to watch next
- Security features built into business AI tools.
- Bank and payment protections against deepfake fraud.
- Simple security standards for AI agents.
- Government support programs for small business cybersecurity.
Key takeaways
- Approve specific AI tools and write simple rules for what data can be entered.
- Limit permissions for AI integrations and require confirmation for agent actions.
- Verify payment requests through known channels; voice and video can be faked.
- Use passkeys or hardware keys, automatic updates and tested backups.
- Prepare a simple incident plan with key contacts.
Frequently asked questions
Is it safe to use ChatGPT or similar tools for business?
It can be, with business plans, appropriate settings and clear rules on which data can be shared.
How can I tell if an email is AI-generated phishing?
You often can’t from the text alone. Focus on the request: unexpected, urgent, about money or credentials — then verify independently.
What is the most important single step?
Phishing-resistant multi-factor authentication, combined with a strict rule to verify payment changes by phone.