Small businesses and sole traders

This page assembles existing material for one situation: a business small enough that the person choosing the tool is also the person using it and the person answerable for the data in it.

Nothing new is argued. What changes is which parts matter and in what order.

The one decision that carries the most

Which account you are on, before anything else.

Consumer plans carry a training toggle and long retention. Commercial terms prohibit training on your inputs. That is a different contract rather than a setting, and it is the distinction a client, an insurer or a supervisory authority will ask about.

What data may go into a model · The training toggle and retention for Claude, ChatGPT or Gemini · Which plan, honestly, for Claude, ChatGPT or Gemini

If you handle client material under any confidentiality obligation, being on a personal account is the finding, and it is fixable in an afternoon.

The obligation that applies regardless of size

The EU AI Act's Article 4 literacy duty has applied since 2 February 2025 and does not have a small-business exemption. It covers staff and contractors operating AI on your behalf, and the standard is proportionate effort.

For a sole trader that is a genuinely small piece of work: write down what you use, what may go into it, and what you check before relying on output. That document is the evidence.

The literacy obligation, practically · The EU AI Act in fifteen minutes

The tier question matters more than the size question. Drafting and summarising is minimal risk. Using AI to screen job applicants is not, and a one-person business doing that is in the same tier as a large one.

Where the rest of the business track over-applies

Several pages here are written for organisations with roles you do not have. Take the reasoning and drop the machinery.

Rollout assumes a pilot group and a rollout owner. The transferable part is the order: provide the compliant option before restricting anything, because the reverse produces the behaviour it prohibits. Rolling out AI without a policy vacuum

The acceptable-use policy is a template for a team. For one person it is a page for yourself, and it is still worth having, because it is what you show someone who asks. An acceptable-use policy you can actually edit

Vendor questions are written for a procurement process. You will not run one. Read it to know what your own answer is when a client sends you a questionnaire. Vendor questions

Admin controls and seat planning mostly do not apply below a team plan. Admin controls · Seats and quota planning

Disclosure, which comes up sooner than you expect

Clients ask. A norm has not settled, and the practical position is to decide before someone asks rather than during.

Disclosure: when to say a machine was involved covers the reasoning. The sector-specific note: for a sole trader the work is the personal brand, so the cost of being found out later is higher than for an employee inside a company.

The everyday pages that matter most here

Verifying output you are not qualified to check — you have no colleague to sanity-check the thing outside your expertise.

When to not use it at all — including the case where you would be unable to defend the answer if challenged.

What never goes in a prompt · Connectors: what you hand over

Running a non-profit hits most of the same economics, plus trustee duty and beneficiary data.

What goes wrong

Assuming size exempts you. The AI Act's literacy duty does not scale with headcount, and neither does a confidentiality clause in a client contract.

Personal account, client data. The most common single problem, and the cheapest to fix.

No written position. Not because a document prevents anything, but because when a client asks what you do with their material, "I have not thought about it" is the wrong answer to give a client.

Reading the business track as written and concluding none of it applies. Most of it does; the roles it assumes do not.

How to check it worked

Answer three questions in writing: which account handles client material, what you would not put into it, and what you check before sending output onward. If you can answer all three today, you are ahead of most organisations many times your size. If you cannot, the first one is where to start, because it is a contract question and the other two are habits.