What does an AI safety audit actually check?

Why small businesses need one

Most small businesses already use AI, usually without anyone deciding how. Someone drafts emails with ChatGPT, someone else summarizes documents with a free tool, and AI features quietly switch on inside software you already pay for. None of that is bad on its own. The risk is that nobody knows what information is going where, or what reaches clients unchecked.

An audit gives you that picture, and a short list of what to change, so you can keep the time savings without the surprises.

The six areas it checks

1. 01

   Which AI tools are in use

   Not just ChatGPT. Staff often use several chat tools, browser extensions, and AI features that are now built into email, document, and accounting software. The audit lists them, and whether each one runs on a business account or someone's personal one.

2. 02

   What information goes into them

   Client and customer details, financial records, health information, contracts, and anything covered by a confidentiality agreement. The question isn't whether AI is used, but what's being pasted in.

3. 03

   Account and data settings

   Whether conversations are kept or used to train models, who has access to shared accounts, and whether logins are shared between people. Many risks come down to one setting nobody has looked at.

4. 04

   Where AI output reaches customers

   AI can give confident, wrong answers. The audit finds the places where AI-written emails, numbers, or advice go to clients without a person reading them first.

5. 05

   Manipulated prompts

   When an AI tool reads outside content, like incoming emails, web pages, or uploaded documents, hidden instructions in that content can push it to do the wrong thing. This matters most for tools that act on their own, such as automations.

6. 06

   Rules and training

   Whether there's a written rule for AI use, and whether the team actually knows it. Most small businesses don't have one yet, and a single page goes a long way.

What you get at the end

• A plain-English report of what's in use and what's at risk
• Fixes ranked by how much they matter, starting with the quick ones
• A one-page AI rule your team can follow
• Answers to your team's questions, without the jargon

What it isn't

• Not a legal or compliance certification. If your industry has specific rules, the audit points out where AI touches them, but it doesn't replace a lawyer or compliance professional.
• Not a hacking test. It looks at how people use AI tools day to day, not at breaking into your systems.
• Not a pitch to buy software. Often the fixes are settings, habits, and a one-page rule.

A five-question self-check

You can start today. If you can't answer one of these with confidence, that's where an audit would begin:

1. 1Can you list every AI tool your team used this month?
2. 2Are those tools on business accounts, or personal ones?
3. 3Would you be comfortable if a client saw what was pasted into them?
4. 4Does anything AI writes go to a client without a person reading it?
5. 5Is there a written rule about what never goes into an AI tool?

The bottom line

An AI safety audit doesn't slow AI down in your business. It makes it something you can rely on: the right accounts, clear rules about what goes in, and a person checking what goes out. If you're wondering about the data side specifically, read Is it safe to put client data into ChatGPT?