Q: What immediate steps should small businesses take to protect sensitive data when using AI tools? A: Never paste Social Security numbers, bank details, health data, or customer lists into public chatbots; use placeholders and turn off chat history or model training when possible. Sanitize or redact files before uploading, keep a clean share copy separate from the source, and log what data goes into each tool for monthly review. Q: How can small businesses secure accounts and devices used with AI? A: Enable multi-factor authentication or passkeys for email, cloud apps, and AI tools, use single sign-on with least-privilege access, and remove unused accounts promptly. Keep separate admin accounts, encrypt laptops and phones, install endpoint protection, and enable device auto-lock to reduce exposure. Q: What training should employees receive to defend against AI-powered scams and deepfakes? A: Run short, monthly phishing drills and teach staff to slow down, verify requests, and flag external emails for domain or bank-info changes. Use a voice or video safe word for money or password requests and require callbacks to known numbers before paying invoices or sharing codes. Q: How should small firms manage vendors and “shadow AI” tools safely? A: Maintain an approved list of AI apps and block unvetted “shadow AI” tools while reviewing vendor privacy terms for data retention, training opt-out, storage location, and breach notification. Ask vendors for security proofs such as SOC 2 or ISO 27001, use data processing agreements when they handle PII, and sandbox external content and links to reduce prompt injection and malware risk. Q: What should an AI use policy for a small business include? A: State what data is acceptable to share, which tools are allowed, and where outputs can be stored, and require human review before sharing AI-generated content with customers. Ban uploading secrets like API keys, passwords, or private code and list who to contact if data is exposed or an account is taken over. Q: What patching and backup practices are recommended to protect against AI-related threats? A: Turn on automatic updates for operating systems, browsers, plugins, and AI desktop apps, and patch third-party software monthly while fast-tracking critical fixes. Follow a 3-2-1 backup strategy (three copies, two media, one offsite), add an immutable backup, and test restores quarterly to verify recovery. Q: How should small businesses prepare an incident response plan for AI-related breaches? A: Create playbooks for data leaks through AI, account takeovers, and vendor breaches with clear steps to isolate affected accounts or devices, revoke tokens, reset passwords, and review logs. Notify affected customers when required and record actions and lessons learned to improve response. Q: What low-cost actions can a small business implement in the first 30 days to improve AI security? A: Use these AI safety tips for small businesses by enabling MFA or passkeys on email, finance apps, cloud storage, and AI tools, publishing a one-page AI policy and approved tools list, and training staff for about 20 minutes on safe prompts and phishing red flags. Also turn off chat history or model training where possible, review vendor settings, set automatic updates, run a full backup, and test a file restore.