Most small businesses do not have an AI strategy. They have a director who tried ChatGPT on a Sunday, a salesperson who now pastes client emails into it, and a quiet fear that everyone else is already ahead.

That arrangement works. Until it does not.

The first leaked customer list, the first invented invoice detail a junior sends anyway. Then AI for small business UK stops being a novelty and starts being a governance problem with a chat window.

This is a practical look at AI agents for small business. What is worth using this week, what is marketing, and why your managed IT still has a job.

The FOMO is the product

Search for AI and you get a fog of promises: autonomous employees, digital workforces, agents that run the firm while you sleep. None of that is what a Cambridge eight-person practice actually needs.

You are trying to buy three outcomes:

1. Routine writing and research take less time.
2. Client and staff data do not leave the building by accident.
3. A confident-sounding draft does not become a confident-sounding mistake.

Everything else is packaging. A 12-person accounts practice does not need an “agentic stack”. It needs a clear rule for ChatGPT for business, and a person who still signs the email.

If a tool cannot be explained in those three lines, it is probably selling you theatre.

Tools vs agents, in plain English

A tool waits for you. You type a prompt, you get a draft, you decide.

An agent is given a goal and some access. It can plan steps, call other software, and take actions. The NCSC describes agentic AI as systems that can access data, make decisions, use tools, and act without continuous human intervention.

ChatGPT for business, used as a writing assistant, is a tool. A bot that reads the shared inbox, drafts replies, updates the CRM and books a slot is an agent, even if the vendor calls it an assistant.

Tools are easier to contain. Agents are more useful, and more hazardous, because they can touch live systems. The NCSC’s advice is not “never”. It is start small, keep agents on low-risk tasks, and apply ordinary cyber controls from day one.

If you cannot say what the thing can access, you do not have an agent. You have an intern with the master key.

Five uses that earn their keep this week

These five are boring. That is why they work.

1. Email you would have written anyway

A first draft of a proposal, a polite chase, a clearer version of a tired paragraph. Keep client names and attachments out of consumer chat windows unless you have a business tenant and a rule.

You still send it. The model does not.

2. Research that used to eat a morning

Competitor pages, a summary of a long PDF, a first pass at “what does this regulation actually say”. Treat every citation as a lead, not a fact. Models invent sources with a straight face.

Useful for Cambridge small business IT questions too: “what does Cyber Essentials ask for” is a starting point. It is not the certificate.

3. Support drafts, not support decisions

A helpdesk reply, a how-to for a repeated Microsoft 365 question, a calmer version of a 6pm email. The human who knows the client still hits send.

If the bot is answering customers on its own, you have moved from drafting to liability.

4. Ops checklists that people actually follow

Onboarding, offboarding, preparing a laptop. Tools are decent at turning a messy process into a short list. They are poor at knowing whether the list is complete.

Write the process once. Let the model format it. Keep the owner named.

5. Marketing that sounds like you

Blog outlines, subject lines, a first pass at a case-study structure. Speed on the first draft, not a brand that writes itself.

If the output could belong to any firm on the science park, it is not finished.

None of this needs a “digital employee”. It needs a person with a prompt, a review habit, and a place the data is allowed to go.

The three risks that actually show up

The hype talks about superintelligence.

Data leaves because someone was in a hurry

Client emails, payroll CSVs, a screenshot of the admin portal, pasted into a free tool because the paid tenant felt like a faff. That is a data leak with a friendly interface.

The ICO is clear that UK GDPR still applies when you use AI. If the tool processes personal data, you are accountable. You cannot hand the duty to the vendor, the intern, or the model. Their guidance on accountability puts this on senior management, not “the person who likes ChatGPT”.

If you would not attach the file to an email to a stranger, do not paste it into a consumer chatbot.

Shadow IT grows in the gaps

One person pays for a writing tool on a card. Another connects a meeting bot to the calendar. A third turns on an “agent” inside a CRM trial. Nobody writes it down.

That is MSP AI territory, even if nobody asked the MSP. Vendor sprawl used to mean five antivirus products. It now means five chat windows with your customer list inside.

Confident rubbish is still rubbish

Models state guesses as facts. They invent case law, product features and “your policy says”. A junior who trusts the tone will send it.

The fix is not a better prompt. It is a rule: the person who publishes owns the words.

The NCSC puts the same point in security language. A system may take an action. Humans stay accountable for deploying it, the access it was given, and the consequences.

Where your MSP still matters

AI does not replace the unglamorous jobs. It makes them more important, because a leaky identity or an untested backup is now one enthusiastic integration away from a worse week.

Security. The NCSC’s note on frontier and agentic AI is blunt: good cyber security fundamentals remain the best protection, AI-assisted or not. Multi-factor authentication, least privilege, and a short list of tools that are actually switched on still beat a new dashboard.

Identity. If an agent can read mail or write to the CRM, it is another account. It needs a named owner, a narrow permission set, and a way to switch it off. The NCSC says to give agents the minimum access they need, for the shortest time.

Backups. An agent that can edit files can also edit them badly. Cloud sync is still not a backup. You want a copy the live tools cannot reach, and a restore you have proved.

Vendor sprawl. Someone has to say no. A Cambridge MSP that already looks after Microsoft 365, cyber and cloud is in a better position to keep the list short than a director buying subscriptions after a webinar.

For the estate those tools sit on, see our guide to small business IT support.

How CAMBITION thinks about AI

We are not replacing the helpdesk with a chatbot, and we are not selling you an autonomous workforce.

CAMBITION has been a Cambridge MSP since 2012. We look after Microsoft 365, cyber and cloud for SMEs, and we use specialist assistant bots ourselves for marketing, the website and CRM. Those bots draft, summarise and fetch. A person still decides what goes out, what gets published, and what gets written into a client record.

That is the whole stance. Assistants that help the business. Not systems that replace accountability.

If we cannot understand, monitor or contain what a tool is doing, we do not connect it to live client work. That is the NCSC’s test.

What to do next

You do not need a strategy away-day. You need a week of boring decisions.

1. Write down every AI tool already in use, including the free ones. If you cannot name them, you already have shadow IT.
2. Decide what must never be pasted in: client files, passwords, health or HR data, anything you would not put on a postcard.
3. Pick one low-risk job from the list above. Drafts only. No sending, no booking, no deleting.
4. Give any agent the least access you can, and a person who can switch it off.
5. If the use involves personal data, read the ICO’s AI guidance before you roll it out further. You remain the controller.

If you want a second pair of eyes on the estate those tools sit on, CAMBITION will do a straightforward conversation. We look at identity, backups, Microsoft 365 and the quiet subscriptions, then say what is actually at risk.

Call 01223 656 156 or use the contact form. Ask about SME support if a full managed-IT brief is more than you need.

AI should get out of the way of the business. That is the useful version.

Frequently asked questions

What is the difference between an AI tool and an AI agent?

A tool waits for a prompt and returns a draft. An agent is given a goal and some access, then can plan steps and take actions. ChatGPT used to rewrite an email is a tool. A bot that reads the inbox, updates the CRM and books a meeting is an agent.

Is ChatGPT safe for a UK small business?

It can be, if you treat it as a drafting aid, keep personal data out of consumer chat windows, and have a person check every output before it is sent. UK GDPR still applies. The ICO holds the business accountable, not the model.

Do small businesses still need an MSP if they use AI?

Yes. Agents make identity, backups, security and vendor sprawl more important, not less. AI does not patch laptops, remove leavers, or test restores.

What should we not paste into ChatGPT?

Client files, passwords, payroll or HR data, health information, admin-portal screenshots, and anything you would not attach to an email to a stranger.