A founder at a fifteen-person services firm discovered his AI risk problem by accident. One of his team had been using the free tier of a generative AI tool to draft client reports for three months. The outputs were good. The problem was that client financial data, including identifiable individuals, had been processed by a US-based model on terms the firm had never read. He found out when a client asked whether their data had been used to train any third-party models. He had no documented answer.
He’d designed his AI workflow for speed and output quality. Risk hadn’t been part of the brief.
What does risk-first AI design actually mean?
Risk-first AI design means assessing the potential harms of a tool before deploying it, not after something goes wrong. For a small firm, this means three questions upfront: what data will the AI see, what decisions will it shape, and who is responsible if something fails. The ICO and Government Digital Service both treat this as an expected starting point now. You can document the basics in an afternoon.
The Government Digital Service published its AI Playbook for the UK Government in December 2024, setting out ten principles for safe AI deployment. Principle two requires teams to understand and manage AI risks from the start of a project, with documented review processes and clear escalation routes. While you’re not a government department, the standard reflects what UK regulators expect from private-sector firms using AI in client-facing or decision-influencing workflows.
For a small services firm, the practical starting point is a three-tier classification applied before adopting any tool. Mark every AI use case as high-risk (affecting client decisions, employment, credit, or vulnerable individuals), medium-risk (internal drafting tools where a human signs off before output reaches a client), or low-risk (experimentation on non-personal or public data with no external impact). Nothing gets deployed until it has a tier assigned and a brief risk note to accompany it.
Why does this matter for your business right now?
UK regulators are already treating AI under existing legal frameworks, and pressure is growing. The ICO requires a formal data protection impact assessment before using AI in ways likely to result in high risk to individuals, including automated decision-making and large-scale processing of personal data. The EU AI Act adds a parallel requirement for a documented risk management system throughout an AI system’s lifecycle, applying wherever you serve EU clients.
Research published by IBM in 2023 found that 51% of surveyed organisations had implemented AI governance policies, but 69% reported difficulty actually managing AI risks, particularly around data security and compliance. That gap between having a policy and acting on it is where small firms are most exposed. A written policy nobody follows is not a defence if the ICO or a client comes asking.
The UK Government’s 2024 to 2025 AI Regulation Update confirmed that UK regulators, including the ICO, FCA, and CMA, are expected to embed AI risk principles into their sector guidance without waiting for new primary legislation. If your firm uses AI in a regulated sector, such as financial services or professional advice, the risk register you need is already implied by existing rules. Outside regulated sectors, ICO data protection requirements still apply wherever you process personal data through an AI tool.
Where will AI risk actually show up in your business?
Three categories of AI risk come up repeatedly for small services firms using AI in client work: data leakage through consumer-tier tools, inaccurate outputs treated as reliable, and bias in AI-driven decisions. Each has a real enforcement or litigation history behind it in the UK and further afield, and each can be designed against from the outset with proportionate controls.
Data leakage is the most immediate concern for firms whose staff use free or consumer-tier AI accounts. In 2023, Samsung restricted employee use of generative AI tools after staff pasted proprietary source code and meeting notes into ChatGPT, where it became part of OpenAI’s training data. The NCSC’s guidance on using public generative AI safely is explicit: prompts sent to a public AI service should be treated as data going to a third party, not as a private conversation with a tool.
Inaccurate outputs create a different category of exposure. In a 2023 federal court case in New York, a lawyer submitted a legal brief citing cases fabricated by ChatGPT. The cases did not exist. The lawyers were sanctioned and fined. The same exposure applies to any professional services firm where AI outputs are used without a verification step. Hallucinations are a structural feature of how language models work, not a temporary bug awaiting a fix.
Bias and discrimination round out the picture. The ICO fined Clearview AI £7.5 million in 2022 for unlawful facial recognition processing, partly on grounds of unfair and intrusive handling of personal data at scale. The FCA has since signalled it will scrutinise AI-driven decisions in financial services wherever they affect creditworthiness, insurance pricing, or vulnerable customers. Any firm using AI to score or profile clients needs to ask whether the training data underpinning that model is fair.
When do you actually need a formal risk assessment?
A formal risk assessment is required whenever your AI use case is high-risk: it affects client decisions, involves personal data about identifiable individuals, or relies on outputs where a significant error causes real harm. The ICO requires a data protection impact assessment in these situations, and provides an AI risk toolkit that covers purpose, data, model, and deployment risks. For a typical small-firm use case, working through it takes two to three hours.
For medium-risk use cases, a shorter check suffices. Document the purpose, confirm what data the AI will see, verify there are no special-category personal data flows, and record who will review outputs before they reach a client. That might be a two-page note rather than a full assessment. What matters is that it exists and is signed off by a named person.
Low-risk use cases, such as using AI to summarise public information or draft marketing copy on non-client data, need only a brief note confirming they are genuinely low-risk. The value of writing anything down is that it forces the question. Firms that document nothing tend to find that low-risk has quietly crept into medium-risk over time as the tooling changes and staff find new ways to use it.
What does a practical risk-from-day-one approach look like?
The sequence that works for a firm of five to fifty staff has five steps, and none requires specialist legal knowledge or a dedicated compliance hire. Classify your use cases by risk tier before buying any tool, run the proportionate assessment before deploying it, confirm you are using enterprise accounts, keep humans in the loop for significant outputs, and review the setup every twelve months.
On enterprise accounts: providers including Microsoft and OpenAI offer terms that commit them contractually not to use your content for model training, which consumer tiers typically do not. Moving a team from consumer to enterprise accounts is a one-afternoon change that immediately closes a material data protection gap. The EU AI Act requires meaningful human oversight for high-risk AI systems, specifically the ability to understand, override, and intervene. The Government Digital Service’s playbook says the same: a human must validate high-risk AI decisions, and there must be a plan to act if the AI produces a harmful output. A named reviewer and a documented sign-off step are the minimum.
Every twelve months, re-run the risk assessment for each tool in active use. Check whether vendor terms have changed, whether use cases have crept into higher-risk territory, and whether the controls you put in place are still being followed. The NCSC’s guidelines for secure AI system development recommend monitoring AI components with the same rigour you’d apply to any software. Annual reviews are not bureaucracy. They are the difference between a compliance record that helps you and a paper trail that doesn’t.
