A lot of small businesses are already using AI, whether they have an AI strategy or not. Someone asks ChatGPT to tidy an email. Someone pastes a client note into a summariser. A team member uploads a spreadsheet to a free “AI assistant” they found online.
None of that is necessarily wrong. Public AI tools can be genuinely useful. But there is a question many businesses skip: where is your data going? For SMEs and professional firms in Cheltenham and across Gloucestershire, that affects client confidentiality, supplier agreements, HR data, commercial information, regulatory duties and reputation. The aim is not to frighten people away from AI. It is to use it sensibly. Trust is part of the service: if clients give you information, they expect you to look after it.
Public AI tools are useful, but not all data belongs there
Public AI tools are services you access over the internet, such as ChatGPT, Claude, Gemini and many specialist apps. They are excellent for low-risk work: rewriting generic marketing copy, brainstorming blog titles, summarising public research, drafting checklists, explaining unfamiliar concepts or tidying a non-sensitive email. The risk comes when people paste in client names, contracts, quotes, internal financials, employee issues, medical or legal details, passwords or customer exports. The problem is not simply that AI is unsafe. Many businesses do not know which tools are in use, what data goes in, what settings apply, or who approved the process.
What private or local AI means
Private AI is not one product. It is a way of designing AI use so the business controls data, access and risk. In practice it might mean running a model on a company machine or private server, using an enterprise account with stronger data controls, connecting AI only to approved documents and systems, limiting which staff can use which tools, logging what the AI is asked to do, and adding human review before anything reaches clients or the public. Local models can be slower or less polished than the biggest public tools, but they suit privacy-sensitive or repeatable internal work. For most SMEs, the answer is a sensible mix, not all public or all private.
A traffic-light way to decide what goes where
- Green, safe for public tools: public information, generic outlines, first-draft templates, non-sensitive explanations.
- Amber, check first: internal documents, pricing, proposals, supplier details, meeting notes. Anonymise these or use an approved tool.
- Red, keep private: client files, legal documents, HR issues, financial records, passwords, health or care information, confidential proposals and anything under a confidentiality agreement.
Before any tool is used for business data, ask: what information will staff put into it, does it include personal or confidential data, where is it processed and stored, can the provider use it to train its models, who inside the business has access, is there an audit trail, and is there a safer way to do the same job? You do not need a 40-page AI policy to start, but you do need boundaries that ordinary staff can understand.
What this looks like in a real project
In my Cheltenham Times AI agent experiment, one rule from the start was to keep the setup as private and secure as possible, rather than sending every small task through a mix of online tools with no thought about data, accounts or access. The agent helped research, organise, draft, categorise and monitor sources, but it also needed rules about what counted as Cheltenham, which sources were reliable, and where a human had to check the result. The same thinking applies inside any business: the value is not “use AI everywhere” but designing workflows where AI does useful work within sensible boundaries.
A sensible first step
Start by listing the ways AI is already being used, and mark each one green, amber or red. You will quickly see where the risks are, where the quick wins are, and where a more private workflow would pay for itself. Then pick one useful workflow, such as summarising enquiry emails and drafting follow-up tasks, and ask what data it needs, which parts are sensitive, whether anything can be anonymised, which setup it should run on, where human approval sits and what outcome you will measure.
If you run a business in Cheltenham or Gloucestershire and want to understand what AI could safely do in your organisation, I can help you choose the right public and private mix and build workflows with proper guardrails. Book a short AI consultancy call or get in touch and ask: what could AI do safely in our business?
