What records should a small business keep to prove it is using AI responsibly?

28 October 2026

Start with one register, not a folder of policies

Keep a short AI register, supplier checks, a record of data use, testing evidence, approval decisions, training records and an incident log. Together, these should show what the AI does, who is responsible, what information it touches and how you know it is safe enough for that job. A signed policy alone proves very little.

Your register can be an Excel sheet or Microsoft List. Give every use case a reference, an owner, an approved purpose, the tool and account type, permitted data, connected systems, human review requirements and a review date. Record whether it drafts, recommends or actually takes action. Those are materially different permissions.

For example, 'AI used in customer service' is too vague. 'Support assistant drafts replies from the approved returns policy; a trained colleague checks every reply; no refunds or customer emails are sent automatically' is useful. Add the person who approved that boundary and the date. Someone covering annual leave should be able to understand it without interviewing the original builder.

Link this register to your existing AI register guidance and normal operating procedures. Do not build a separate compliance island. The evidence belongs beside the work it describes, with access restricted where documents contain sensitive information.

Separate legal records from sensible operational evidence

There is no universal certificate that proves every small business is using AI responsibly. Legal duties depend on the information, activity and sector involved. An internal AI register is sensible governance, but it is not automatically a complete record of processing activities or a substitute for a required data protection impact assessment.

The ICO's documentation guidance gives a concrete UK example: an insurance company with 100 staff still needs to document its regular claims, sales and HR processing. Its fewer-than-250-staff exemption is limited, not a blanket exemption. The same guidance explains that occasional profiling may still require documentation because of risks to individuals.

Those examples matter for SMEs using AI on customer histories or employee files. Do not assume your headcount makes records optional. Identify the lawful basis, categories of information, recipients, retention and relevant safeguards. Assess whether a DPIA is required before high-risk processing starts, rather than trying to reconstruct the reasoning after a complaint.

The ICO currently flags this guidance as under review following the Data (Use and Access) Act. Check current guidance and commencement details for your particular activity before relying on an older checklist. Keep the date and source of the advice you used. That shows your reasoning; it does not guarantee compliance if the actual process is unlawful.

Keep the supplier decision and the data boundary

Save the material that explains why the supplier and account configuration were approved: relevant contractual terms, the data processing agreement where applicable, security information, retention settings, model-training settings and international transfer arrangements where needed. Record when you checked them and who made the decision. A link to today's marketing page cannot show what terms you relied on six months ago.

Be precise about the product. Personal ChatGPT, a managed business workspace and an API integration are not interchangeable just because they share a brand. Microsoft Copilot configurations also differ. Document the account, service and actual controls you checked rather than writing 'Microsoft is approved' or 'OpenAI does not train on our data'.

Describe allowed and prohibited inputs. A supplier-quote comparison using anonymised prices is different from uploading client contracts containing names and confidential negotiations. Record who can authorise new categories of information and which system permissions the workflow receives. Read-only CRM access is not the same as permission to edit records or send messages.

Include an exit plan: who owns the account, how to revoke connections, how to export necessary records and how to request deletion. Store credentials in a password manager, never in the register itself. Your evidence should point to the access-control process, not expose the secrets that control your business systems.

Show that the workflow was tested and approved

Before launch, keep a dated test pack showing representative inputs, expected behaviour, actual results, failures and the final decision. Record the workflow version, model identifier where available, key instructions and knowledge-base version. If a provider silently changes its service, you may not be able to reproduce every response exactly; documenting your configuration and observations still helps explain what happened.

For a customer-enquiry assistant, test an ordinary return, an ambiguous request, a missing order number and a customer asking for an exception. Include an instruction hidden inside an email telling the assistant to ignore its rules. The pass condition should cover escalation and forbidden actions, not just whether the prose sounds polite.

As an illustrative test plan, run 30 representative cases and require every case involving an unauthorised refund or disclosure to be blocked or escalated. Thirty is a suggested starting sample, not a legal standard or proof of reliability. Use a larger and more demanding evaluation when failures could seriously affect people.

Keep the sign-off: who reviewed the evidence, what limitations they accepted, what remained prohibited and when a new approval is needed. The UK Government's AI Playbook, published in February 2025, sets out 10 principles for government AI use. It is a useful named UK reference, not a mandatory SME certification scheme. Borrow proportionate discipline, not a public-sector paperwork burden.

Record real oversight, changes and mistakes

Human oversight needs evidence of what people actually check. Keep a simple review record for significant outputs: reviewer, date, decision, corrections and reasons for an override. You do not need to archive every harmless brainstorming exchange. You do need enough information to investigate a wrong customer commitment or explain a consequential recommendation.

Record meaningful changes, including new integrations, broader permissions, different knowledge sources and changed prompts. An assistant approved to summarise tickets should not quietly become an automatic complaint responder. Set an owner and a trigger for retesting before expanded access goes live.

Maintain an incident and near-miss log. Capture what failed, the affected process, immediate containment, who assessed the impact, what was corrected and what prevents recurrence. Where personal data is involved, use your existing breach-assessment process and document decisions about notification. Not every AI error is a reportable data breach, and an internal log does not replace notification where required.

Training evidence should show more than attendance. Keep the rules issued, the examples practised and confirmation that staff know how to report mistakes. Give people a fast reporting route without demanding a perfectly written incident report. A culture that hides errors will produce immaculate paperwork and unreliable evidence.

What should this cost and how long should you keep it?

You can start with tools you already pay for: Excel, SharePoint or a controlled Google Drive folder. Additional software spend can be £0 if those subscriptions already exist. That is not the same as zero cost: someone must inventory the workflows, check suppliers and maintain records.

For planning only, suppose initial set-up takes six staff hours and your internal loaded cost is £30 per hour. That is £180 of staff time. A 30-minute monthly review adds £15 per month. These are illustrative arithmetic, not market prices, our service fees or a promise that every business can finish the work in six hours. Sensitive or complex uses need more time and may justify specialist advice.

There is no single retention period for all AI records. Set periods by purpose, legal obligations, contractual requirements and investigation needs. Keep current approvals available while the workflow operates, and define how long superseded decisions remain useful. Apply shorter retention to raw personal inputs unless there is a justified reason to keep them.

Restrict access, use version history and test that owners can find the evidence. A sensible monthly check asks whether tools, permissions, suppliers or risks have changed. Review sooner after an incident or major change. Buying governance software becomes worthwhile when manual record-keeping is genuinely failing, not merely because a vendor says every business needs a dashboard.

When this is NOT right for you

A heavy evidence programme is unnecessary if a sole trader uses AI only to brainstorm public, non-sensitive marketing ideas and checks the output personally. A short tool note, clear data rules and sensible supplier checks may be sufficient operationally. Do not spend a week recording fictional low-risk prompts while ignoring the real customer database.

The lightweight approach is not enough for high-impact employment decisions, sensitive health information, financial eligibility or other regulated activities. You may need specialist legal, security or sector advice, stronger testing and more formal governance. Keeping excellent records does not make a discriminatory or insecure use acceptable.

Choose the three live workflows with the greatest customer impact or data exposure. Give each an owner, map its information, record its approval and test its failure behaviour. Close actual gaps before polishing document templates. If nobody can explain who switches a workflow off when it goes wrong, that operational question comes before your next policy revision.

If you want help deciding what evidence is proportionate, start with a review of one real workflow. The aim is a process your team can explain and control, not a binder that looks reassuring while the software does something else.

Is This Right For You?

This approach suits SMEs using AI with customer information, connected systems or repeatable workflows. Keep it lighter for non-sensitive brainstorming, and seek specialist support for high-impact or regulated uses.

Frequently Asked Questions

Do we need to save every AI conversation?

No. Keep evidence proportionate to the purpose and risk. Blanket storage can increase privacy and security exposure. Preserve significant decisions and incidents, and define justified retention for raw inputs.

Is an AI policy enough?

No. A policy describes intended behaviour. You also need evidence of approved tools, data boundaries, testing, ownership and what happened when something went wrong.

Does having fewer than 250 staff exempt us from records?

Not automatically. The ICO describes a limited documentation exemption, with exceptions including non-occasional processing, risks to individuals and specified sensitive data. Check current guidance for your activity.

Do we need paid governance software?

Usually not to start. An access-controlled spreadsheet and document folder can work for a small number of workflows. Buy software when your actual complexity justifies it.

Who should own the records?

Give each workflow a business owner and name a person to maintain the central register. Involve whoever handles data protection, security and relevant sector obligations.

Can we store client data in the test pack?

Use synthetic or appropriately anonymised examples wherever practical. If real personal data is necessary, justify its use, restrict access and set retention. Redaction alone does not always anonymise information.

Does this prove our AI is legally compliant?

No. Records support accountability and investigation, but lawful processing, security, fairness and sector compliance depend on what you actually do. Get specialist advice for higher-risk uses.