AI assistant rollout checklist for a small UK firm: plan, contract, policy, first month

Bringing an AI assistant into a small firm is five jobs in a row: choosing the plan, putting the vendor contract and the data paperwork in place, writing the house rules, switching the accounts on, and checking how the first month went. The owner or office manager usually does it, often in a fortnight. This list puts the steps in the order they come up, with the rule or reason behind each. Prices and terms were read on 1 October 2026 and change often, so read the vendor's live page before you pay. Use the list once for each tool the firm adds.

Free tool

AI assistant rollout checklist

Tick each step as it is done. The ticks are kept in this browser only, so you can come back to the list; nothing is sent anywhere.

Choosing the plan

Answer five questions on headcount, customer data, office suite and billing to narrow the plans Count the seats: ChatGPT Business and Claude Team both need at least two If the office runs on Microsoft 365, price the Copilot bundle against the add-on Choose annual or monthly billing and work out the year's cost before VAT Check whether the price shown includes VAT before comparing two plans Ask the heaviest users how they will use it: no vendor publishes a full day's allowance

The vendor contract and the data paperwork

Buy the business plan in the firm's name, so that no one uses a personal account for work Accept or sign the vendor's data processing agreement and file a copy with the date Ask the vendor in writing where the data is held and which UK transfer mechanism applies Write down the lawful basis for each job that will put personal data into the tool Screen each use for a data protection impact assessment and keep the note, even when the answer is no Add the AI supplier, or the kind of supplier it is, to the privacy notice

Writing the house rules

Write a one-page policy that names the approved tool and the account staff must use List what never goes in: bank and card details, passwords, health information, anything about a child Name who checks output: every figure, date, name and statement of law against its source Keep a named person on any decision to hire, dismiss, refuse or charge someone more Decide which actions always need a person's approval: sending, paying, deleting Go through the policy at a staff meeting and have each person sign the same copy

Switching it on

Switch off the thumbs-up and thumbs-down buttons, or tell staff never to press them on customer chats Set up sign-in through the firm's own accounts and note how to remove a leaver's seat Set a monthly spending limit before turning on extra usage credits Enter the firm's VAT number in the vendor's billing settings, if it is VAT registered

The first month and its review

Before buying seats for everyone, run two weeks with the heaviest users and note each limit they hit Read the first invoice: UK VAT shown, or no VAT from a supplier outside the UK Take a sample of sent work and run it through the five-step check Answer the ten-question self-check at the end of the month and fix each gap If personal data went where it should not, decide the same day whether the ICO must be told Set the next review: six months on, or sooner if a tool or its terms change

Copy what is left Print the list Clear the ticks

A working list, not a certificate and not advice: the rule behind each step, with its source, is set out below.

Email me this result

We send the figures above to your inbox as they stand now, with a link back to this page.

Email addressSend it

Also send me the weekly admin fix (one practical guide a week; unsubscribe any time)

We use your address to send this result and keep a copy of what we sent. Privacy notice.

Works in your browser. Nothing you type leaves this device unless you ask us to email you the result.

Choosing the plan

Answer five questions on headcount, customer data, office suite and billing to narrow the plans. Where the assistant should work decides most of the choice: in our questionnaire 12 of the 20 routes end on a plan tied to an office suite, and only routes that choose a separate app meet the two-seat minimum. Source: Our plan-fit questionnaire, from vendor pricing pages read 2 October 2026. The working is in Which AI assistant plan fits a small UK firm? Five questions, seven outcomes, prices in pounds.

Count the seats: ChatGPT Business and Claude Team both need at least two. A one-person firm cannot buy either business plan. Claude Team stops at 150 seats, ChatGPT Business at 200 employees, and Copilot Business and Google's Business plans at 300 users, on the vendors' pages read 1 October 2026. Source: OpenAI, Anthropic, Microsoft and Google pricing pages, read 1 October 2026. The working is in ChatGPT vs Claude vs Microsoft 365 Copilot vs Gemini for a small UK firm.

If the office runs on Microsoft 365, price the Copilot bundle against the add-on. On 1 October 2026 Business Standard with Copilot was £18.10 a user a month paid yearly before VAT, £1,086 a year for five. Business Standard plus the add-on at its offer price came to £1,476 for five in the first year. Source: Microsoft UK, Microsoft 365 Copilot plans and Business Standard pages, read 1 October 2026. The working is in Microsoft 365 Copilot for a small business.

Choose annual or monthly billing and work out the year's cost before VAT. Five ChatGPT Business seats cost £900 a year on annual billing (5 × £15 × 12) and £1,080 on monthly billing (5 × £18 × 12), on OpenAI's UK page read 1 October 2026. Annual billing is cheaper on all four business plans. Source: ChatGPT pricing page and its UK price data, read 1 October 2026. The working is in How much does ChatGPT cost for a small business in the UK? Plus, Pro, Business and Enterprise prices, VAT and a yearly figure for 1, 5 and 10 people.

Check whether the price shown includes VAT before comparing two plans. Claude's UK page says its prices include 20% VAT, so £18 a seat is £15 before it. Microsoft's says its prices do not include VAT, Google's says tax is not included, and OpenAI's page does not say. Source: Anthropic, Microsoft, Google and OpenAI UK pricing pages, read 1 October 2026. The working is in How much does Claude cost for a small business in the UK? Pro, Max, Team and Enterprise prices, VAT and a yearly figure for 1, 5 and 10 people.

Ask the heaviest users how they will use it: no vendor publishes a full day's allowance. On 1 October 2026 no vendor gave a figure for a working day. ChatGPT and Claude work in five-hour windows and Claude adds a weekly limit; on both, a premium seat costs five times a standard one for five times the usage. Source: OpenAI and Anthropic help pages on usage limits, read 1 October 2026. The working is in How much can you use an AI assistant before you hit a limit? Usage limits on paid ChatGPT, Claude, Copilot and Gemini plans.

The vendor contract and the data paperwork

Buy the business plan in the firm's name, so that no one uses a personal account for work. The ICO says every time a controller uses a processor there must be a written contract. Neither OpenAI's nor Anthropic's page lists a data processing agreement for a personal plan, so customer data in a staff member's own account sits outside one. Source: ICO, When is a contract needed and why is it important?, read 1 October 2026. The working is in Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first.

Accept or sign the vendor's data processing agreement and file a copy with the date. OpenAI offers an addendum for ChatGPT Business through a form; Anthropic builds one into its Commercial Terms; Microsoft's Product Terms and Data Protection Addendum cover Copilot; Google's Cloud Data Processing Addendum treats prompts as customer data. Source: OpenAI, Anthropic, Microsoft and Google data pages, read 1 October 2026. The working is in ChatGPT vs Claude vs Microsoft 365 Copilot vs Gemini for a small UK firm.

Ask the vendor in writing where the data is held and which UK transfer mechanism applies. Personal data sent to an organisation outside the UK is a restricted transfer and needs adequacy regulations, appropriate safeguards or an exception. None of the four vendors' pages said a UK firm's data stays in the UK. Source: ICO, A brief guide to international transfers (15 January 2026); vendor data pages, read 1 October 2026. The working is in Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first.

Write down the lawful basis for each job that will put personal data into the tool. The ICO lists seven lawful bases and says a firm must apply at least one whenever it handles personal information. A reply to a customer normally rests on the basis the firm already has for dealing with them. Source: ICO, A guide to lawful basis (updated 2 April 2026). The working is in Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first.

Screen each use for a data protection impact assessment and keep the note, even when the answer is no. The ICO counts AI as innovative technology, which needs a DPIA when combined with another risk criterion such as sensitive data, vulnerable people or scoring. A firm that decides one is not needed must still document why. Source: ICO, When do we need to do a DPIA?, and Guidance on AI and data protection. The working is in Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first.

Add the AI supplier, or the kind of supplier it is, to the privacy notice. The ICO says a privacy notice must name the recipients of the data, which includes anyone processing it on the firm's behalf. No UK rule we read requires a label on each email drafted with AI. Source: ICO, What privacy information should we provide? The working is in Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions.

Writing the house rules

Write a one-page policy that names the approved tool and the account staff must use. No ICO page we read requires a document called an AI policy, but ten lines can record what the law does require: a supplier contract, a person in significant decisions, no fake reviews and breach reports within 72 hours. Source: ICO guidance pages and UK GDPR, read 1 October 2026. The working is in AI policy for a small UK firm.

List what never goes in: bank and card details, passwords, health information, anything about a child. Health data is special category data and needs a lawful basis and an additional condition; sensitive data combined with AI is one pairing that requires a DPIA. Data minimisation limits everything else to what the task needs. Source: ICO, Guidance on AI and data protection, and Data minimisation. The working is in AI policy for a small UK firm.

Name who checks output: every figure, date, name and statement of law against its source. In Ayinde (2025) the High Court said the critical safeguard is to check any output against an authoritative source. In Harber v HMRC (2023) all nine tribunal decisions a taxpayer relied on had been invented by an AI tool. Source: Harber v HMRC [2023] UKFTT 1007 (TC); R (Ayinde) v Haringey [2025] EWHC 1383 (Admin). The working is in What happens when AI gets it wrong.

Keep a named person on any decision to hire, dismiss, refuse or charge someone more. Since 5 February 2026, Articles 22A to 22D of UK GDPR attach safeguards to a significant decision taken with no meaningful human involvement. The ICO's draft guidance says involvement must be active, not a token gesture. Source: UK GDPR Articles 22A to 22D; ICO draft guidance on automated decision-making (31 March 2026). The working is in Do you have to tell the customer AI was used? Five questions to find the UK rule for your case.

Decide which actions always need a person's approval: sending, paying, deleting. Anthropic's help page advises approving by hand anything hard to undo, such as sending messages or making purchases, and OpenAI says its agent mode asks for confirmation before high-impact actions. A mistake by a tool that acts is an action. Source: Anthropic and OpenAI help pages on agents, read 1 October 2026. The working is in What is an AI agent, in plain English, and how is it different from a chatbot? Four vendors' own definitions and what a small office should let one do.

Go through the policy at a staff meeting and have each person sign the same copy. A policy nobody has read protects no one. Keep it to one page, pin it where the work is done, and reissue it with a new date whenever a tool is added or dropped. Source: Our one-page AI policy guide. The working is in AI policy for a small UK firm.

Switching it on

Switch off the thumbs-up and thumbs-down buttons, or tell staff never to press them on customer chats. OpenAI and Anthropic both say content sent as feedback may be used for training, even on a business plan. Anthropic says the owner of a Team plan can switch the buttons off for everyone. Source: OpenAI and Anthropic privacy pages, read 1 October 2026. The working is in ChatGPT vs Claude vs Microsoft 365 Copilot vs Gemini for a small UK firm.

Set up sign-in through the firm's own accounts and note how to remove a leaver's seat. ChatGPT Business lists single sign-on, multi-factor authentication and central billing; Claude Team lists single sign-on, central billing and domain verification. A small firm needs one bill, sign-in it controls and a way to close a leaver's seat. Source: ChatGPT and Claude pricing pages, read 1 October 2026. The working is in ChatGPT vs Claude vs Microsoft 365 Copilot vs Gemini for a small UK firm.

Set a monthly spending limit before turning on extra usage credits. ChatGPT Business can carry on past a limit on bought credits if spending controls allow. Claude Team credits are bought in advance at Anthropic's API rates, and the owner can set a monthly limit for the firm and for each person. Source: OpenAI and Anthropic help pages on usage and credits, read 1 October 2026. The working is in How much can you use an AI assistant before you hit a limit? Usage limits on paid ChatGPT, Claude, Copilot and Gemini plans.

Enter the firm's VAT number in the vendor's billing settings, if it is VAT registered. Anthropic's help pages say a Team plan has a field for a VAT number; OpenAI's says a number can be added in billing settings and that tax may be charged if it proves invalid. Source: Anthropic and OpenAI billing help pages, read 1 October 2026. The working is in Can you claim ChatGPT, Claude or Copilot as a business expense? The rules for a sole trader, a limited company and VAT.

The first month and its review

Before buying seats for everyone, run two weeks with the heaviest users and note each limit they hit. Limits reset on a five-hour window: if a window began at 9:00 and ran out at 11:00, it is back at 14:00. A trial shows whether one standard seat a person is enough or a larger seat is needed. Source: OpenAI and Anthropic help pages on usage limits, read 1 October 2026. The working is in How much can you use an AI assistant before you hit a limit? Usage limits on paid ChatGPT, Claude, Copilot and Gemini plans.

Read the first invoice: UK VAT shown, or no VAT from a supplier outside the UK. A VAT-registered firm reclaims UK VAT on a valid VAT invoice, and applies the reverse charge where an overseas supplier charges none (VAT Notice 741A, section 5). The subscription is a claimable software cost if used for the business. Source: HMRC VAT Notice 741A; GOV.UK, Expenses if you're self-employed. The working is in Can you claim ChatGPT, Claude or Copilot as a business expense? The rules for a sole trader, a limited company and VAT.

Take a sample of sent work and run it through the five-step check. Mark every checkable claim, open each source yourself, redo every sum, read it as the recipient, and have one named person approve it with a note of who and when. Do not ask the tool to confirm its own answer. Source: R (Ayinde) v Haringey [2025] EWHC 1383 (Admin); our five-step check. The working is in What happens when AI gets it wrong.

Answer the ten-question self-check at the end of the month and fix each gap. For 4 of the ten questions the answer that is in order is no, so the check cannot be passed by ticking yes. Each answer gives the rule and its source, and not sure counts as a gap. Source: Our readiness check, written from the rules in seven of our guides. The working is in Is your firm's use of AI assistants in order? Ten yes-or-no questions for a small UK firm.

If personal data went where it should not, decide the same day whether the ICO must be told. The ICO says a notifiable breach must be reported not later than 72 hours after becoming aware of it. A customer's data protection complaint must be acknowledged within 30 days. Source: ICO, Personal data breaches: a guide; How to deal with data protection complaints. The working is in AI policy for a small UK firm.

Set the next review: six months on, or sooner if a tool or its terms change. The ICO calls a DPIA a live document, much of its AI guidance is under review after the Data (Use and Access) Act 2025, and the vendor pages read for our guides had been updated between January and September 2026. Source: ICO DPIA guidance; vendor pages dated 8 January to 24 September 2026. The working is in AI policy for a small UK firm.

How to use the list

Keep the ticked list with the papers behind it: the dated data processing agreement, the vendor's answer on where data is held, the DPIA screening note, the signed policy and the first invoice. If a step did not apply, such as a DPIA for a use with no personal data, tick it and note why. Start a fresh list when the firm adds a second tool or the vendor changes its terms, and put the six-month review in the diary now.

A ticked list is a record that the steps were done, not proof that each was done properly. The list covers the points our guides and the official pages named above set out; it is not every duty a firm has. This page is general information, not legal advice.

Overlyft is an AI agency that sets up AI office assistants for small firms in ten trades: the work is priced after a fixed-price audit, the firm pays Anthropic directly for its own Claude plan, and a person approves anything that goes to a customer.