An AI agent wiped a production database. A Gemini chat got someone mental health resources... after their initial request slipped past the model's guardrails. A virtual receptionist took four "are you a human?" questions before admitting it was a bot.
Each of those was someone else's bad day on the internet. Each one was preventable with a 2-page policy and a few rules.
This is what we keep coming back to on the show: not how to scare people away from AI, but how to use it without making yourself the next cautionary tale.
TL;DR
- 77% of businesses don't have an AI policy. They will... right after something goes wrong.
- AI handles tasks. It doesn't handle judgment. Treat every customer-facing or money-moving output as needing a human checkpoint.
- Be transparent that an agent is an agent. Hiding it isn't clever. It's the failure mode customers remember.
- Don't paste customer data into anonymous personal accounts. That's how SMBs accidentally end up in the news.
- You don't need a 30-page legal policy. You need a 2-page policy your team can actually follow. Roll it out before something forces you to.
Never skip the human review step
Of all the AI mistakes we've covered on Infacto Daily, the single biggest one isn't model error. It's owners skipping the review.
You ask AI to write a client email. It writes it. You don't read it. It sends. The price is wrong. The tone is wrong. The customer's name is wrong. You spend an hour fixing what would've taken 30 seconds to catch.
The 80% rule still holds: AI does 80% of the work, the human does the 20% that makes it land. Skipping the 20% doesn't double your throughput. It makes the 80% worthless.
What needs human review every single time:
- Anything that sends to a customer
- Anything that quotes a price
- Anything that touches a contract
- Anything that goes on a public channel (social, email, ads)
- Anything that moves money
- Anything that affects legal or compliance
What doesn't:
- Internal summaries
- Categorizing transactions
- Drafting research notes for yourself
- Formatting reports
- Pulling data from one place to another
For more on this rule and where most owners trip, read 7 AI Mistakes Small Businesses Make.
AI handles tasks... it doesn't handle judgment
This is the line that separates safe AI use from dangerous AI use.
A task has a defined input, a defined output, and a way to tell if the result is right. "Categorize these 100 transactions." "Draft a follow-up email to this lead." "Summarize this 5,000-word document." Tasks are where AI shines.
Judgment has ambiguity. "Should we take on this client?" "How should we price this product?" "Is this campaign going to land or be tone-deaf right now?" Judgment is where AI fails, especially in 2026.
The mistake is treating judgment like a task. The signs you've crossed the line:
- You're asking AI for the decision, not the data
- You stop reading the output critically
- You skip the "second opinion" step you'd take with a human advisor
- You feel relieved when AI agrees with you
For an extreme version of what goes wrong here, read about the AI agent that wiped a production database. The agent didn't malfunction. It did exactly what it was asked. The owner had given it judgment-level trust for a task-level capability.
Be transparent that an agent is an agent
The Hilton hotel virtual receptionist story is the best 60-second case study on this:
Someone called. The bot answered. They asked "are you a human?" The bot dodged. They asked again. Dodge. Again. Dodge. On the fourth try, the bot finally admitted it was a virtual assistant.
That single phone call did more damage to the brand than the receptionist agent saved in salary for the entire year.
Customers do not mind AI. They mind being lied to. The fix is simple:
- Disclose in the first message that this is an automated assistant
- Tell them how to reach a human
- Honor it the moment they ask
Apple's Siri now defers explicitly to humans in sensitive cases. Gemini hands off to mental health support resources. The big platforms got the memo. The same rule applies to you.
There's a related failure mode: hiding that you used AI to write something. The Mariners broadcaster ChatGPT backlash is a great inverse case. She was photographed using ChatGPT to brainstorm post-game questions. Some people tried to shame her. The internet sided with her. Why? Because she didn't hide it. The expertise was still hers. AI was the brainstorm partner, not the substitute.
Transparency wins. Hiding loses. Every time.
Don't send customer data into anonymous chat tools
This is the most common AI mistake at small businesses, and the hardest one to notice from the outside.
Your social media person uses their personal ChatGPT account. They paste a customer's contact info, a contract, a billing question. Now your customer's data is sitting in someone's personal OpenAI history... with no audit trail, no DPA, and no way for you to delete it.
Multiply that by 5 employees with their own personal accounts. You have a data leak waiting to happen.
The fix:
- One business account. Buy a Team or Enterprise plan from ChatGPT/Claude/Gemini. Use it across the company.
- Approved tools only. Define which AI tools employees are allowed to use. Block the rest with a written policy (and ideally browser-level controls).
- Define the "do not paste" list. Customer PII, financial records, signed contracts, internal strategy. Make it concrete with examples.
- One central knowledge base. Use a custom GPT or a Claude Project with your business info so people don't paste it ad-hoc.
For why this matters more in 2026, read about Coruna DarkSword spyware on iPhones and Anthropic Mythos vulnerability scanner. The attack surface for AI-era businesses is bigger than people realize.
Have an AI policy before you have a problem
77% of businesses don't have an AI policy. The ones that do, almost always wrote it after something went wrong: a leaked document, a wrong customer quote, a viral mistake on social media.
The good news: you don't need a 30-page policy from a law firm. You need a 2-page policy your team can actually use.
The 4 rules that prevent 95% of problems:
- Approved tools only. A short whitelist. Everything else is forbidden by default.
- Never paste these data types. Customer PII, contracts, financial records, internal strategy. List specific examples.
- Always disclose AI to customers. Email signatures, chatbots, phone agents, social posts where it matters.
- Always human-review these outputs. Pricing, contracts, public posts, customer-facing emails, money movement.
That's it. 4 rules. Print them on a card. Pin them in Slack.
The Bernie Sanders + Claude echo chamber story is a great example of why this matters even for political and PR-sensitive moments. Read more here.
How to roll this out this week
This isn't a 6-month project. This is a Tuesday afternoon meeting.
- Pick the 4 rules above and adapt them to your business
- Draft a 2-page policy
- Hold a 30-minute team meeting to walk through it
- Print the "is it safe to paste?" flowchart and put it where people work
- Pin the policy in Slack
- Quarterly review (5 questions, 30 minutes)
If you want a template you can fill in, we built one. It's the Small Business AI Policy Template, and it includes the rules, the flowchart, the meeting script, and the quarterly review. Grab it below.
Get the Small Business AI Policy Template
A 2-page fill-in-the-blanks policy your team can actually use. Includes the 4 rules, an "is it safe to paste?" flowchart, a 30-minute team rollout script, and a quarterly review checklist.
Download the Small Business AI Policy Template