Two conversations share the name "AI safety" and they have almost nothing to do with each other. One is a research field concerned with the long-term behaviour of very capable systems. The other is the set of ordinary ways an AI tool can damage a business next Tuesday. Owners are handed the first conversation when they need the second.
This piece is about the second. No predictions, no philosophy, just the failure modes that reach a fifteen-person company and what a sensible response looks like.
A model produces fluent text whether or not the underlying claim is true. It does not signal uncertainty the way a person does, because it is not tracking certainty in the first place. The practical consequence: any fact you did not supply and cannot verify should be treated as a hypothesis. This applies to legal points, tax treatment, product specifications, safety information, and anything about your own business the model appears to know.
Information leaves your control when someone pastes it into a tool whose retention terms nobody read. There is no alert and no log. The exposure is usually mundane material with real people's details in it: an email thread, a client spreadsheet, a meeting transcript.
A tool that drafts is safe. The same tool set to send is a different product with a different risk profile. Automated replies to reviews, automated responses to complaints, and automated outreach all fail in public and at scale, which is a bad combination.
This is the one most owners underestimate. Voice cloning and convincing written impersonation are cheap now. The realistic scenario is not sophisticated: an urgent message that sounds like you, telling a bookkeeper to move money or change payment details. It works because it is plausible and rushed.
The single most useful framing we give clients is a three-tier split, applied task by task.
Anything touching money, contracts, employment decisions, health information, or a customer's public perception of you stays in the first tier. Not permanently, necessarily, but until you have watched it work for months.
"Human in the loop" is easy to claim and easy to hollow out. A person clicking approve on forty items in ninety seconds is not oversight. Real accountability has three properties: a named individual, enough time to actually read, and a consequence structure where that person is answerable for what went out.
If your approval step has become a formality, either restore the time or reduce the volume. The middle position, nominal review at high speed, gives you the risk of automation and the cost of a person.
It also helps to keep a record. When something goes wrong, you want to know which tool produced it, when, and who approved it. A shared document listing your AI-assisted workflows and their owners is unglamorous and sufficient.
This deserves its own attention because the fix is procedural rather than technical, and it works.
Agree a rule with anyone who can move money or change account details: no payment instruction is acted on because of a phone call, voicemail, text, or email, regardless of whose voice it is. Verification happens through a second channel the requester did not choose, using a number already on file. Say plainly that urgency is itself a warning sign, since the pressure to skip the check is the entire mechanism.
Tell clients the same, particularly if you handle deposits or send invoices. A single line in your terms about how payment details will and will not change costs nothing and prevents the expensive version of this.
You do not need a framework. You need a page that answers five questions: which tools are approved, what data must never be entered, which tasks may run without review, who is accountable for AI-assisted output, and how payment and identity changes are verified.
Review it twice a year, or whenever you add a tool that can act rather than draft. That distinction, drafting versus acting, is the one that determines nearly everything else.
Being honest about limitations is not a weakness in this area. The businesses that get into trouble are rarely the ones that were too cautious. They are the ones that assumed a confident answer was a checked answer.
For drafting, summarising, and organising internal work, yes, with ordinary care about what data goes in. Risk rises sharply when a tool is allowed to act without review or handle regulated information. The technology is not the variable that matters most. The permissions you grant it are.
Two compete. Publishing or relying on a confident claim nobody verified, and being impersonated in a payment request. The first damages credibility slowly, the second costs money quickly. Both are addressed by procedure rather than software: check facts against a named source, and verify payment changes through a second channel.
Yes, and it should be one page. Small teams are more exposed, not less, because tool choices are made individually and nobody is monitoring. Cover approved tools, prohibited data, which tasks need review, and payment verification. That is enough for most businesses under fifty people.
Less than the headlines suggest, if your work involves showing up somewhere, judging a situation, or being trusted locally. The realistic pressure is on the informational part of your service, the questions customers used to call you to ask. Move your value toward the parts a model cannot perform.
Want this handled for you?
Get a free audit of your website, Google reviews, and local SEO — we’ll show you exactly where you’re losing customers. Delivered in 24 hours, no sales call.
Get my free audit → or book a 15-min callWe help local businesses in Stamford, Greenwich, Norwalk, and Fairfield County implement AI marketing that generates real results.
Get Your Free AI Marketing Audit →