AI guardrails are what let you use AI with confidence rather than crossed fingers. Here is a proportionate approach to AI governance for UK SMEs, from a one-page staff policy to controls on customer-facing assistants.
The fastest way to lose confidence in AI is for it to say something wrong to a customer. A made-up discount, an incorrect delivery promise, or advice you would never give. One screenshot can undo months of goodwill.
Step 4 of our six-step guide to AI implementation is putting guardrails in place. Done well, they are not red tape. They are what let your team use AI with confidence instead of crossed fingers.
Guardrails and governance: what is the difference?
AI governance is how the business decides where AI is used, who is responsible and what the rules are. AI guardrails are the practical controls that enforce those rules, both in staff behaviour and in the tools themselves.
For a large enterprise, governance can mean committees and frameworks. For an SME, it should fit on a few pages and take an afternoon to set up.
Layer 1: A practical AI policy for staff
Every business using AI should have a short written policy. Ours for clients usually covers:
- Approved tools. Which AI tools staff may use for work, on which accounts.
- Data rules. What must never go into AI tools, such as special category personal data, and what may go in on business accounts. See our AI and GDPR guide for the detail.
- Human review. Which outputs must be checked by a person before use: anything client-facing, anything with figures, anything legal or financial.
- Disclosure. When and how you tell clients that AI was used.
- Ownership. Who owns the policy and who staff ask when unsure.
- Reporting problems. How to flag a wrong or worrying output.
One page is enough for most businesses. What matters is that people have read it and know who to ask.
Layer 2: Guardrails on customer-facing AI
Where AI talks directly to customers, for example a website assistant, the controls need to be built into the system itself.
Limit the topics. The assistant should answer questions about your services and politely decline everything else.
Answer from your content only. Ground answers in your knowledge base and instruct the AI to say it does not know rather than guess.
Protect commitments. Prices, discounts, delivery dates and refunds should come from approved sources only, or be handed to a person.
Hand over cleanly. Complaints, complex requests and anything sensitive should route to a human with the conversation attached.
Filter sensitive information. Stop the assistant asking for, or repeating, personal data it does not need.
Keep a record. Log conversations so you can review them and improve the answers.
Test it before customers do
Before launch, spend an hour trying to break it. Ask awkward questions, ask about competitors, ask for discounts, try to make it say something rude, ask it about topics you do not cover. Every failure you find in testing is one a customer will not.
Repeat a shorter version of this test whenever you change the knowledge base or the tool.
Proportionate governance for SMEs
Three simple habits cover most of what governance needs to do:
- Keep a register of where AI is used in the business, what data it touches and who owns it. A spreadsheet is fine.
- Review quarterly. Check the register, the policy, a sample of outputs and the costs.
- Scale controls to risk. An internal drafting tool needs light controls. A customer-facing assistant or an automated workflow that sends emails needs more.
This is also the evidence you will want if a client, insurer or regulator ever asks how you manage AI.
How we can help
We write AI policies, build guardrails into customer-facing assistants and set up lightweight governance as part of our AI transformation work. It is usually included in our AI Ops Audit recommendations.
Next in the series: AI and GDPR: keeping client data safe when your team uses AI.