Using AI in Your Business: What to Hand Over, and What to Keep Well Away From It

Every week a client asks us some version of the same question: “Should I be using AI for this?” It's a good question, because the honest answer is: for some things, absolutely — you'd be mad not to. For others, not yet, and possibly not for a while.

We're a tech-led practice. We're certified in Xero and QuickBooks, we use software with AI built in every day, and we genuinely like this stuff. So this isn't a “be afraid of the robots” post. It's a practical guide to where AI earns its keep in a small business right now, where it quietly creates risk, and how to tell the difference.

Where AI is genuinely brilliant

Think of AI as a very fast, very well-read assistant who has never met your customers and has no idea what's in your bank account. Used that way, it's a gift.

• Marketing — social posts, email newsletters, website copy, blog outlines, ad variations, product descriptions. Give it your tone of voice and a rough brief and it will hand you ten versions in a minute. You still choose, edit and add the human bits.
• Contracts and terms — a first draft of a service agreement, supplier terms or a quote template, written in plain English. Then have a professional check it. A first draft that takes thirty seconds instead of three hours is a real saving.
• Policies and handbooks — staff handbooks, expenses policies, health and safety documents, GDPR privacy notices. AI is excellent at structure and completeness; you supply the specifics.
• Time-saving admin — summarising long emails, turning meeting notes into actions, drafting replies, explaining a confusing letter, building a spreadsheet formula, planning a rota. The small stuff that eats your week.
• Learning — “explain Making Tax Digital to me like I run a café” is a perfectly good use of AI. Just treat the answer as a starting point for a conversation with your accountant, not the final word.

The common thread: none of this involves personal data, money or passwords. The information going in is either public or yours to share, and a wrong answer costs you an edit rather than a fine.

Where we'd pull you back from the edge

Here's the part that's harder to hear, because the tools make it so easy. The newest AI assistants — including the “work” and “agent” versions that can connect to your other apps — will happily plug into your email, your accounting software, your payroll, your bank feed and your HR system, then act on your behalf. It feels like magic. It is also, right now, where the risk lives.

• Year-end accounts, bookkeeping and payroll — these are built on personal and financial data: your staff's names, addresses, pay, National Insurance numbers, bank details; your customers' and suppliers' information; your own banking. Pasting that into a general-purpose AI, or giving an AI agent the keys to those systems, is sharing it with a third party you have no contract with and very little control over.
• Connecting apps that hold sensitive data — if you link an AI tool to Xero, QuickBooks, your payroll, your CRM or your bank, you are handing it credentials for every record in there. Many of these tools store prompts, learn from inputs, or route data through servers outside the UK. You often cannot say for certain where your staff's data has gone.
• Data protection law — under UK GDPR you are the data controller for your staff and customer data. You need a lawful basis to share it, a contract with anyone processing it for you, and to know where it goes. “I gave an AI app all my logins” fails that test in several places at once — and a breach is reportable to the ICO within 72 hours.
• Accuracy — AI is confident, not correct. It will produce a VAT figure, a CIS deduction or a payroll calculation that looks completely plausible and is wrong. In marketing that's a typo. In payroll it's an underpaid employee and an HMRC penalty.

“But all my software has AI in it now”

It does, and that's a different thing. When Xero or QuickBooks suggest how to code a transaction, or your payroll software flags an unusual pay run, that's AI running inside a regulated, contracted, UK-compliant platform you already trust with that data. It stays where it was. We use those features daily and they're genuinely useful.

The line isn't “AI yes or no”. It's: does this tool already have a lawful, secure reason to hold this data — or am I about to hand it something it should never see?

A simple way to decide

• Is there personal data in it (names, pay, NI numbers, bank details, health, addresses)? Keep it out of general AI tools.
• Would I be comfortable if this prompt were read by a stranger? If not, don't send it.
• Am I being asked to connect an app? Ask what data the AI can see, where it's processed, whether it trains on your data, and whether you'd have a contract with the provider. If you can't answer, don't connect it.
• Is the output a decision about money or tax? Treat it as a draft for a human — ideally one who's regulated — to check.
• Would a mistake be an edit or a fine? Edits are fine. Fines aren't.

How we handle this at Rosevale

We're regulated by AAT and bound by data protection law, and we take both seriously. We only use trusted, contracted applications for client work — Xero, QuickBooks and a small set of vetted tools that hold data in the right place with the right safeguards. We use the AI built into those platforms where it helps, and we double-check it. We don't paste client data into general AI assistants, and we don't connect agent tools to systems holding your information. If that ever changes, it will be because the security and the law have caught up, and we'll tell you.

In practice that means you get the best of both: a practice that moves quickly and uses modern tools, and a firewall between your sensitive data and the parts of the internet that haven't earned it yet.

Keep up with the curve — just pick your lane

Use AI freely for the words, the ideas, the drafts and the admin. It will save you hours a week and make you better at the parts of the business you never had time for. Keep it well away from the numbers, the people data and the passwords for now — and let a regulated human, with regulated software, look after those.

If you'd like a second opinion on a tool you're thinking of connecting, or you'd rather hand the bookkeeping, payroll and year-end over to someone who already has the safeguards in place, that's exactly what we're here for. Book a free discovery call — in person at the Science Park or by video call — and we'll talk it through.