AI and regulatory compliance: what SMEs must frame before automating
AI in SMEs: personal data, confidentiality, traceability, GDPR and governance. What to check before using ChatGPT or business AI tools.
AI can save an SME time: summarising meeting notes, drafting replies, analysing support tickets, classifying documents. It also introduces a simple risk: sending sensitive information into a tool nobody has properly framed.
The goal is not to block AI. The goal is to decide what can be automated, which data can be processed, who validates the use cases, and how decisions remain traceable.
Why AI compliance matters for SMEs
A small company often handles sensitive data: customer files, contracts, HR records, medical documents, financial information, credentials and commercial discussions. The difference is that SMEs rarely have a full-time CIO or DPO to govern new tools.
Risk appears in everyday use:
- an employee pastes a customer contract into ChatGPT to summarise it;
- a team exports a customer spreadsheet to an AI analysis tool;
- support staff generate replies without checking displayed data;
- a manager asks a tool to classify CVs without documenting the criteria.
Each case raises more than a technical question. It touches GDPR, contractual confidentiality, access security and the company’s ability to explain how data is used.
Questions to ask before using an AI tool
Start with a simple checklist.
What data enters the tool? Public information carries a different risk from HR data, customer records or healthcare documents.
Where is data processed? Does the vendor state where processing happens? Is there a data processing agreement? Are prompts used to train the model?
Who can access the results? An AI tool connected to Microsoft 365, Google Workspace or a CRM must respect existing permissions.
Who validates the output? AI can produce a confident but false answer. Important business decisions need human validation.
What trace remains? For sensitive use cases, keep a record of who used the tool, for which scope, and under what validation process.
GDPR: concrete points to check
GDPR principles apply directly to AI use.
Data minimisation. Only send what is necessary. A support ticket does not always need the customer’s full name, phone number and commercial history.
Purpose limitation. Define the use: writing assistance, classification, summarisation, analysis. Data collected for customer support should not be freely reused to train a tool.
Security. Require MFA, ban shared accounts and monitor data exports.
Processors. If the tool processes personal data on your behalf, the vendor may be a processor. Its contractual commitments must be checked.
Rights of individuals. If AI supports decisions about people, the company must be able to explain, correct and respond to access or deletion requests.
Create a short internal AI policy
An AI policy does not need to be long. It needs to be clear.
Five practical rules are enough to start:
- Never enter passwords, secrets, API keys or banking data into an AI tool.
- Do not send named customer data without approval.
- Use only company-approved tools.
- Review every output before sending it externally.
- Report doubts to the internal lead or IT provider.
Add concrete examples: rewriting a generic email is acceptable; pasting a confidential contract is not.
Technical safeguards
Compliance also depends on configuration.
Named accounts. Every user must have an individual account. Shared accounts destroy traceability.
Mandatory MFA. An AI assistant connected to company data becomes a sensitive access point.
Permissions review. Before connecting AI to SharePoint, Google Drive or a CRM, clean up access rights.
Logging. For critical tools, keep usage logs: logins, exports, document access and configuration changes.
Regular review. AI tools evolve quickly. Review authorised tools every quarter.
An SME IT audit helps map tools, exposed data and access risks.
Frequently asked questions
Can an SME use ChatGPT with customer data?
Yes, but not without rules. Check the vendor terms, avoid named data when possible, document the use case and prefer a professional offer with confidentiality controls.
Does every SME need a DPO to use AI?
Not always. It depends on the activity and the data processed. But every SME should appoint an internal owner for AI usage.
Can AI make decisions about customers or employees?
That is a sensitive use case. Decisions with significant effects on people must remain explainable, controlled and contestable.
How do we audit AI tools already used by teams?
List accounts, browser extensions, SaaS tools and connectors. Then classify them by data exposure: public, internal, confidential, personal or sensitive.
What is the first practical rule to implement?
No customer, HR, medical, banking or contractual data should be entered into an unapproved AI tool. Then list approved tools and train teams with examples.
For further reading: see our IT audit checklist, secure remote work guide and SME cybersecurity page.
