--- title: "AI Tool Risk Check for Small Businesses | MCC Solutions" description: "Ten questions that score how much customer, employee and confidential data your team exposes to AI tools, with the fixes that matter most for your answers." url: "https://mcc-solutionsnj.com/bookkeeping/ai-tool-risk-check" --- Free check · Small business # AI tool risk check: how exposed is your business data? Your staff probably use AI chat assistants, AI features in everyday software or browser extensions. Answer ten quick questions about accounts, settings and what gets pasted in, and see where your data is most exposed. [![Intuit ProAdvisor Gold tier badge](/img/credentials/intuit-proadvisor-gold.png)](https://proadvisor.intuit.com/app/accountant/search?searchId=matthew-coleman77)Gold tier in Intuit's ProAdvisor program. [See my Intuit listing](https://proadvisor.intuit.com/app/accountant/search?searchId=matthew-coleman77) Keeping your own books? Tallyfinch does invoices, bank import and reports on your computer. [See Tallyfinch](/bookkeeping/mcc-books-downloadable-bookkeeping-software) **Quick answer.** The data your team pastes or connects is the main AI risk for a small business: customer details, ID and account numbers, health and personnel records, passwords and confidential documents. Answer the ten questions below to score your exposure from 0 (low) to 30 (high) and get the fixes that matter most for your answers. ## Score your team's AI data exposure Answer all ten questions to see your score. ## How the score works Each answer scores 0 to 3, for a total out of 30. **0 to 6** is low exposure, **7 to 15** moderate and **16 or more** high. If ID numbers, bank or card numbers, passwords or keys have gone into a tool, the result is at least moderate whatever the total, because those are the hardest leaks to undo. The score measures habits and controls, not whether any law applies to you. ## Three controls that cover most of the risk - **Business accounts only.** A company-owned team plan lets you set data and training options once, see who has access and remove people who leave. - **A short "never paste" list.** Customer identifiers, ID and account numbers, health details, passwords and keys, personnel records and confidential documents stay out unless a reviewed tool is cleared for them. - **Review before approval.** Before a tool, extension or note-taker touches business data, read its terms on training, retention, human review and admin controls, and write down what it's cleared for. ## What the FTC has said about AI claims If your marketing mentions AI, the Federal Trade Commission's existing rules on advertising still apply. Announcing its [Operation AI Comply](https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes) sweep on September 25, 2024, the FTC said that "there is no AI exemption from the laws on the books." In its [final order against Workado, LLC](https://www.ftc.gov/news-events/news/press-releases/2025/08/ftc-approves-final-order-against-workado-llc-which-misrepresented-accuracy-its-artificial) (August 28, 2025), it barred accuracy claims about the company's AI detector unless they are not misleading and backed by competent and reliable evidence when made. The FTC's [Consumer Reviews and Testimonials Rule](https://www.ftc.gov/business-guidance/resources/consumer-reviews-testimonials-rule-questions-answers), in effect since October 21, 2024, covers businesses that write or create fake reviews. Some states have passed their own AI laws, and several have changed recently. We haven't summarized them here; check your state legislature's or attorney general's site, or ask a lawyer. ## Sources - [FTC: FTC Announces Crackdown on Deceptive AI Claims and Schemes (September 25, 2024)](https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes) - [FTC: FTC Approves Final Order against Workado, LLC (August 28, 2025)](https://www.ftc.gov/news-events/news/press-releases/2025/08/ftc-approves-final-order-against-workado-llc-which-misrepresented-accuracy-its-artificial) - [FTC: The Consumer Reviews and Testimonials Rule: Questions and Answers](https://www.ftc.gov/business-guidance/resources/consumer-reviews-testimonials-rule-questions-answers) A self-assessment checked November 2026, not legal advice or a security audit. If you handle health, financial, legal or children's data, or work in a regulated industry, have a lawyer review your AI rules. Not affiliated with any AI provider. Your answers stay in your browser; nothing is sent or saved. ## Common questions **Is it safe for employees to use ChatGPT or other AI tools at work?** It depends on the account, the settings and what goes into it. The biggest risks for a small business are staff using personal accounts the company can't control, tools that keep or train on what's typed, and customer or employee data being pasted in. The ten questions above score those risks. **What should employees never put into an AI tool?** Customer identifiers, Social Security and other ID numbers, bank and card numbers, health information, passwords and keys, employee records and confidential documents, unless a specific tool has been reviewed and cleared for that data. **Do I have to tell customers I use AI?** That depends on your industry, your state and what you use AI for, and this page doesn't decide it. The FTC has said existing laws apply to AI claims, so don't overstate what AI does for customers, and don't use it to write reviews that pretend to come from customers. Ask a lawyer about disclosures for a regulated business. **What does the FTC say about AI in advertising?** Announcing its Operation AI Comply sweep in September 2024, the FTC said there is no AI exemption from the laws on the books. In its 2025 order against Workado, it required accuracy claims about an AI product to be backed by competent and reliable evidence. **Does a small business need a written AI policy?** This page doesn't decide whether a law requires one for your business; ask a lawyer if you're in a regulated industry. A short written policy is the simplest way to tell staff which tools are approved, what never to paste and who to tell about a mistake, and to show what you expected if something goes wrong. Related: [AI setup for small businesses](/bookkeeping/ai-setup-for-small-business) (done with you) · [AI Prompt Pack for Bookkeepers and Notaries](/toolkits/ai-prompt-pack-bookkeepers-notaries) (prompts for one person's own work) Put the rules in writing ## Small Business AI Use Policy Kit An editable employee AI use policy, a one-page "what never to paste" sheet, an AI tool approval checklist for training opt-out, retention and access, customer disclosure wording, and a training sign-off form. Word files to edit and PDFs to print. A template, not legal advice. [Get the kit ($19)](/toolkits/small-business-ai-use-policy-kit) Keep this calculator on your phone: [Add MCC Money to your phone](/tools/mcc-money-app). It's free, works offline and holds 62 calculators. Tallyfinch ### Books you keep on your own computer Tallyfinch does invoices, bills, bank import, reconciliation and the main reports, in a file you own. $99 once, then $5 a month for updates; the app keeps working if you stop the plan. It does not do payroll or sales tax filing. The free download records up to 60 entries. [See Tallyfinch](/bookkeeping/mcc-books-downloadable-bookkeeping-software) [Download it free](/tools/pro/trial/mccBooks) [Compare the three apps](/software) ## Want AI set up safely for your team? [AI setup for small business](/bookkeeping/ai-setup-for-small-business)[Call (908) 444-6373](tel:+19084446373)