Always keep a human in the loop – a person should check every output before it’s used or sent, and stay responsible for it. Mistakes and near misses should be reported, so everyone learns from them.
Keep a short, up-to-date list of approved tools. Review their performance, just as you’d review a member of staff. Have one set of rules everyone works to.
It’s essential to have a set of guardrails in place to enable the responsible use of AI in your business. If you don’t, you’re liable to run one of two major risks: a security or data breach, or employees feeling afraid to use AI and therefore missing out on the considerable benefits.
Any professional services firm can use the following AI guardrails for small businesses in the UK. Doing so will help you to confidently reap the rewards, knowing you have the right protections in place.
01 What goes in
Confidential information, personal data and commercially sensitive material must only ever be entered into an AI tool where the company has approved both the tool and its specific use. Before approval, the company should understand what data the provider collects, where it’s processed and stored, who can access it, whether it may be retained or used to improve the service, how it can be deleted, and what contractual and technical safeguards apply.
You must never use other versions of AI tools that are readily available online, especially if you’re entering data or information that you wouldn’t want to see repeated in public.
02 What comes out
A human employee must carefully check every output before it’s used or sent to a client. This needs to be the person who would have been responsible for the work, had it been done without the use of AI. They – and not the AI – will always remain responsible for the output.
It’s likely that mistakes will happen, especially when the AI system is new. This is to be expected. All AI-related mistakes and suspected incidents must be reported promptly through the company’s agreed process. You should report concerns and near misses without fear of unfair blame, while deliberate misuse, concealment or repeated disregard of the rules will be subject to the company’s normal disciplinary process.
Reporting of incidents and near misses enables us to monitor and improve outputs. Always think: was there anything worrying or surprising? Or anything useful we can learn from?
03 People and tools
We’ll keep a short list of the tools we’ve approved for AI usage and ensure it’s regularly updated.
We’ll monitor and review the performance of our AI tools, in a similar way to how we would for a human employee, in order to ensure compliance and enable improvement over time.
We’ll also carry out regular verification that the employees responsible for AI
outputs are carefully checking the work produced by the tools.
Everyone in the firm must work to these rules. The alternative is that we will not be able to use AI.