# Is your firm's use of AI assistants in order? Ten yes-or-no questions for a small UK firm > Ten yes-or-no questions on the plan, the vendor contract, the privacy notice, the written policy, checked output and personal accounts, each with its rule. - Page to cite: https://aeolookup.com/ai-for-small-firms/ai-assistant-use-small-uk-firm-self-check/ - Publisher: AEO Lookup (https://aeolookup.com/) - Section: AI for small firms, Putting it to work - Published 2 October 2026 - Key fact: We wrote ten questions from the rules set out in 7 of our guides; for 4 of the ten the answer that is in order is "no", so the check cannot be passed by ticking yes. The first asks: Is every AI account used for work on a business plan that the firm itself pays for? The ICO says there must be a written contract every time a firm uses a processor. OpenAI lists a data processing addendum for ChatGPT Business, Enterprise and the API, and Anthropic builds one into its commercial terms; neither lists one for a personal plan. - Sources: ICO, When is a contract needed and why is it important?; OpenAI and Anthropic data pages; OpenAI and Anthropic policy pages on model training; The four vendors' own data pages, as set out in our comparison; ICO, What privacy information should we provide?; ICO guidance; UK GDPR Articles 22A to 22D; R (Ayinde) v London Borough of Haringey [2025] EWHC 1383 (Admin); UK GDPR Articles 22A and 22C; ICO draft guidance (31 March 2026); ICO, When do we need to do a DPIA?, and Guidance on AI and data protection; Anthropic, Use Claude Cowork safely; OpenAI help pages; Microsoft Copilot Terms of Use; each rule is set out with its source in the guide the question links to. The test record is in tests/readiness/tools-check.txt. This check is for the owner or office manager of a small UK firm whose staff already use ChatGPT, Claude, Copilot or Gemini at work. The ten questions cover the plan the accounts are on, the contract with the vendor, the privacy notice, the written policy, who checks what the tool writes, personal accounts and the records the firm keeps. Each one rests on a rule or a vendor term set out in our guides, read at its source on 1 October 2026. It takes about three minutes, and nothing you choose leaves the page. There are ten questions and they take about five minutes. Answer from memory. "Not sure" counts as a gap, because a rule nobody in the office can recall is a rule nobody is checking. **Free tool on the page:** Is your firm's use of AI assistants in order? Ten yes-or-no questions for a small UK firm. It runs in the browser at https://aeolookup.com/ai-for-small-firms/ai-assistant-use-small-uk-firm-self-check/#tool and asks for no sign-up. ## What each question checks **1. Is every AI account used for work on a business plan that the firm itself pays for?** The answer that is in order is "yes". The ICO says there must be a written contract every time a firm uses a processor. OpenAI lists a data processing addendum for ChatGPT Business, Enterprise and the API, and Anthropic builds one into its commercial terms; neither lists one for a personal plan. Source: ICO, When is a contract needed and why is it important?; OpenAI and Anthropic data pages. The working is in [Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first](https://aeolookup.com/ai-for-small-firms/is-it-legal-to-put-customer-data-into-chatgpt-claude-copilot-uk-gdpr/). **2. Does anyone paste customer details into their own free or personal ChatGPT, Claude or Gemini account?** The answer that is in order is "no". A personal account sits outside any contract the firm holds. OpenAI says content on its plans for individuals may be used for training unless the user opts out, and Anthropic says chats on Free, Pro and Max are used if the user allows it. Source: OpenAI and Anthropic policy pages on model training. The working is in [Can this go into ChatGPT, Claude or Copilot? Five questions on customer data for a UK firm](https://aeolookup.com/ai-for-small-firms/can-customer-data-go-into-ai-assistant-five-questions-uk/). **3. Has the firm accepted or signed the vendor's data processing agreement, and filed a copy with the date?** The answer that is in order is "yes". A business plan makes the agreement available; the firm still has to accept or sign it. OpenAI's is requested through a form, Anthropic's is part of its Commercial Terms, and Microsoft and Google cover Copilot and Gemini in their own data processing terms. Source: The four vendors' own data pages, as set out in our comparison. The working is in [ChatGPT vs Claude vs Microsoft 365 Copilot vs Gemini for a small UK firm](https://aeolookup.com/ai-for-small-firms/chatgpt-vs-claude-vs-copilot-vs-gemini-small-uk-firm-business-plans-compared/). **4. Does the firm's privacy notice name its AI supplier, or the category it falls in, as a recipient of customer data?** The answer that is in order is "yes". The ICO's guidance on the right to be informed says a privacy notice must give the recipients of personal data, and that this includes anyone that processes the data on the firm's behalf. An AI supplier that receives customer details is one. Source: ICO, What privacy information should we provide?. The working is in [Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions](https://aeolookup.com/ai-for-small-firms/do-you-have-to-tell-customers-you-used-ai-uk-rules/). **5. Is there a written AI policy, signed and dated, that lists the approved tools and what never goes into them?** The answer that is in order is "yes". No ICO page requires a document by that name, but ten lines on one page record what the law does require: a written supplier contract, a person involved in significant decisions, no fake reviews, and a notifiable data breach reported within 72 hours. Source: ICO guidance; UK GDPR Articles 22A to 22D. The working is in [AI policy for a small UK firm](https://aeolookup.com/ai-for-small-firms/ai-policy-template-small-uk-firm-one-page/). **6. Does anything an AI tool drafted go to a customer before a person has checked its figures, dates and names against the source?** The answer that is in order is "no". In Ayinde, decided on 6 June 2025, 18 of 45 citations in one case did not exist, and the High Court said the critical safeguard is to check any output by reference to an authoritative source. The vendors' own terms say output can be wrong. Source: R (Ayinde) v London Borough of Haringey [2025] EWHC 1383 (Admin). The working is in [What happens when AI gets it wrong](https://aeolookup.com/ai-for-small-firms/what-happens-when-ai-gets-it-wrong-uk-court-cases-five-step-check/). **7. Do staff press thumbs-up or thumbs-down on chats that contain customer details?** The answer that is in order is "no". OpenAI and Anthropic both say a conversation rated with the feedback buttons may be used for training, even on a business plan. Anthropic says the owner of a Team plan can switch the buttons off for the whole firm. Source: OpenAI and Anthropic policy pages on model training. The working is in [AI policy for a small UK firm](https://aeolookup.com/ai-for-small-firms/ai-policy-template-small-uk-firm-one-page/). **8. Does any tool decide on its own whom the firm hires, refuses or charges more, with no person looking at each decision?** The answer that is in order is "no". Articles 22A to 22D of UK GDPR, fully in force since 5 February 2026, apply to a significant decision taken with no meaningful human involvement. The firm must tell the person, hear their representations, offer human intervention and let them contest it. Source: UK GDPR Articles 22A and 22C; ICO draft guidance (31 March 2026). The working is in [Do you have to tell customers you used AI? What UK rules say about emails, chatbots, adverts and automated decisions](https://aeolookup.com/ai-for-small-firms/do-you-have-to-tell-customers-you-used-ai-uk-rules/). **9. Has the firm written down, for each use of AI on personal data, whether a data protection impact assessment is needed?** The answer that is in order is "yes". The ICO lists AI as innovative technology, which needs an assessment when combined with another risk such as sensitive data or scoring. Where a firm decides a use is not high risk, the ICO says it still has to document how it reached that view. Source: ICO, When do we need to do a DPIA?, and Guidance on AI and data protection. The working is in [Is it legal to put customer data into ChatGPT, Claude or Copilot? What UK GDPR asks of a small firm first](https://aeolookup.com/ai-for-small-firms/is-it-legal-to-put-customer-data-into-chatgpt-claude-copilot-uk-gdpr/). **10. If staff use an AI agent that can act for them, is it set to ask before it sends a message, pays or deletes a file?** The answer that is in order is "yes". Anthropic's help page advises manual approval for anything hard to undo, such as sending messages or making purchases, and OpenAI says its agent asks for confirmation before high-impact actions. Anthropic and Microsoft say the user stays responsible for what it does. Source: Anthropic, Use Claude Cowork safely; OpenAI help pages; Microsoft Copilot Terms of Use. The working is in [What is an AI agent, in plain English, and how is it different from a chatbot? Four vendors' own definitions and what a small office should let one do](https://aeolookup.com/ai-for-small-firms/what-is-an-ai-agent-plain-english-difference-from-chatbot/). ## How to use the result The list under your score is a to-do list. Each line names the rule, where it comes from and the page that shows how to deal with it. Put a name and a date against each one. A gap that has an owner and a date is being handled; a gap that everyone knows about and nobody owns is how firms end up explaining themselves later. Do the check again each quarter, and again whenever a rule in this sector changes. Give it to a second person in the office without showing them your answers. Where the two of you disagree, the procedure is not written down clearly enough, and that is worth knowing whichever of you is right. A good score is not a certificate. The questions cover the points our guides cover, which are the ones that come up most often in a small firm; they are not every duty a firm has. This page is general information, not legal advice. Overlyft ![](https://aeolookup.com/img/d/ours-badge.png) is an AI agency that sets up AI office assistants for small firms in ten trades: the work is priced after a fixed-price audit, the firm pays Anthropic directly for its own Claude plan, and a person approves anything that goes to a customer. --- ![](https://aeolookup.com/img/d/owner-line.png) General information for UK small firms, not legal, tax or financial advice.