The risks of AI for a small service business, and the controls that keep them small

AI tools can save a small service business real office time. They also create risks that didn't exist when the worst thing an office could do was mistype an invoice. None of these risks is a reason to avoid AI entirely. Each one is a reason to set a few rules before you rely on it. This guide goes through the risks we see most often in service businesses, with a control for each.

What are the main risks, at a glance?

Why do AI tools give confident wrong answers?

Language models predict plausible text. When they don't have the answer, they often produce something that sounds right anyway. NIST's 2024 generative AI risk profile lists this as its own risk category, confabulation: the production of confidently stated but erroneous or false content by which users may be misled or deceived.

In a service business this shows up as an invented warranty term in a customer email, a building code citation that doesn't exist, a material on a quote you never use, or a chatbot telling a customer you serve a town you don't. The damage comes from the confidence. Nobody double-checks a sentence that sounds certain.

Control: anything a customer will see gets read by a person who knows the business. Numbers, dates, promises and rules get checked against your own records or the authority that sets them. Prices come from your price book, never from a chat window. Our guide to AI for estimating and quotes shows where that line sits.

What happens to customer data you paste into AI tools?

It depends on the vendor, the plan and your settings, which is the point. Some examples from the vendors' own pages, read in October 2026:

• Google's Gemini Apps Privacy Hub says human reviewers read a subset of chats and warns against entering anything confidential you wouldn't want a reviewer to see or Google to use to improve its services.
• Anthropic's privacy center says that on its consumer Claude plans, chats are used to improve its models if you choose to allow it, or if conversations are flagged for safety review.
• OpenAI's help center describes an "Improve the model for everyone" setting which keeps new chats out of model training when switched off.

Settings and terms change. What doesn't change is that a customer's name, address, phone number, gate code, payment details or health information doesn't need to be in a chat for you to get a useful draft.

Control: a short written rule for staff listing what never goes into AI tools, company accounts instead of personal ones, and a check of each vendor's data terms before use. Store customer records somewhere the business controls, such as a CRM you own, rather than scattered across chat histories.

Who is responsible for what your AI says?

Your business. A chatbot on your website or an AI receptionist on your phone line speaks in your name, and customers will hold you to it. Regulators take the same view. When the FTC announced an AI enforcement sweep in 2024, it said there is no AI exemption from the laws on the books.

Control: a written list of topics the assistant can and can't discuss (prices, appointment dates, warranties, refunds); an easy way to reach a person; a disclosure that it's automated; and a weekly read of conversation transcripts. Our guide to AI for customer service sorts conversations into ones AI can handle and ones it should hand off, and our AI receptionist service is built around exactly those limits.

Why are AI-written reviews and edited photos a legal risk?

The FTC's rule on consumer reviews and testimonials, announced in August 2024, prohibits reviews that misrepresent that they're by someone who doesn't exist, and the FTC's announcement pointed to fake reviews produced by AI as one example. It also covers buying reviews and certain undisclosed insider reviews. In December 2025 the FTC sent warning letters to businesses about the rule and noted that civil penalties can reach $53,088 per violation.

Edited job photos are a quieter version of the same problem. An "after" photo that AI cleaned up beyond what the crew did is a misleading claim about your work.

Control: use AI to draft replies to real reviews, never to write reviews. Keep unedited originals of every job photo you publish. Our guide to AI photo and video tools covers which edits are fair.

What are the rules on AI voices calling customers?

The FCC's declaratory ruling of February 2024, FCC 24-17, holds that the TCPA's limits on "artificial or prerecorded voice" calls encompass current AI technologies that generate human voices. So before placing one, a business needs the recipient's consent, except for emergencies and specific exemptions, and under the FCC's rules at 47 CFR 64.1200, marketing calls of this kind to cell phones need prior express written consent. Voice cloning is named in the ruling as falling within the TCPA's limits.

Control: no AI-voice outbound calls (reminders, follow-ups, win-back campaigns) without documented consent and a lawyer's review. Answering inbound calls is a different situation, though call recording rules still apply. Texts have their own rules; see our TCPA guide. Nothing here is legal advice, and state rules vary.

How do you avoid buying AI that overpromises?

Small businesses are a target market for AI products, and some of the pitches have drawn federal attention. Three recent FTC matters, each resolved by settlement or order rather than a court finding:

• In August 2025 the FTC sued Air AI, which sold conversational AI tools, alleging false earnings claims and refund guarantees that left consumers, many of whom are small business owners, with losses of up to $250,000. The case settled in March 2026.
• In May 2026 the FTC announced that Cox Media Group and two marketing firms would pay $930,000 to settle allegations that they falsely claimed an "Active Listening" AI-powered ad service could target ads using conversations captured from consumers' smart devices.
• The FTC approved a final order against Workado in August 2025 over claims the agency said misrepresented the accuracy of its AI content detector.

Control: ask any AI vendor how its claims were measured, on what kind of business, and over what period. Ask for a trial on your own calls or data. Read the cancellation and refund terms before paying. Be wary of anything sold as a way to earn money rather than a tool to do a job. Our questions for AI receptionist providers apply to most AI vendors.

What about ownership and lock-in?

Two quieter risks. First, copyright: a January 2025 Copyright Office report found that, with today's generally available tools, a user's prompts don't make them the author of the output, so purely generated text or images may not be protectable. Your own writing and photos are a stronger asset.

Second, lock-in. An AI phone or messaging tool can end up holding your call recordings, transcripts, customer list and sometimes your phone number. Before signing, confirm in writing that you own the number and can port it, and that you can export your data in a usable format.

What should a one-page AI policy say?

1. Which AI tools are approved, on which company accounts.
2. What never goes in: customer personal data, payment details, access codes, employee records, anything confidential.
3. What always gets human review: anything a customer, the public or a regulator will see.
4. What AI never decides: prices, safety calls, legal terms, hiring and firing.
5. No AI-written reviews, no altered job photos, no AI-voice outbound calls without consent.
6. Who to ask when unsure, and when the policy was last updated.

Once the policy is in place, the AI tools for contractors list shows the tools worth trying once the policy is in place.

Frequently asked questions