Which work should a small business never hand to AI?

Most of what I tell owners about AI is to hand more over. The grind, the follow-ups, the first drafts, the data entry. This post is the other half of that advice. There’s a short list of work where a confident wrong answer doesn’t cost you ten minutes. It costs you a fine, a lawsuit, or a client’s trust, and you can’t take it back.

Why can’t AI have the final say on important work?

Because it can be confidently wrong, and the law treats its output as yours. NIST’s generative AI profile names the problem confabulation: systems generating and confidently presenting false content. That’s manageable when a person reads the output before it counts. It becomes a liability when the output is final the moment it’s produced.

The list is short on purpose. Everything outside it is fair game for AI, and most of what fills a small team’s week sits outside it: follow-ups, scheduling, meeting notes, first drafts, data entry, research, sorting the inbox. What the five items share is that the output becomes binding the moment it leaves the building. A court reads the brief, a customer relies on the answer, a regulator reads the review, a candidate loses the job, a patient’s record leaves your control. Keep a person at that moment and AI can do the rest of the work around it.

Can AI write legal documents for a business?

It can draft them. It can’t be the last reader. In Mata v. Avianca in 2023, a federal judge fined two lawyers and their firm $5,000 for filing a brief citing cases ChatGPT had invented. The judge said using a reliable AI tool isn’t improper. Submitting unchecked output was the problem.

The FTC made a related point from the other direction. In February 2025 it finalized an order against DoNotPay, which had marketed itself as "the world’s first robot lawyer." According to the FTC’s complaint, the company did not test whether its AI lawyer performed at the level of a human lawyer, and the order required $193,000 in monetary relief. If the people selling the tool couldn’t back the claim, your business shouldn’t rely on it unread.

Is a business liable for what its AI chatbot tells customers?

A Canadian tribunal said yes in 2024. Air Canada’s website chatbot told a customer they could apply for a bereavement fare after booking, which the airline’s policy didn’t allow. Air Canada argued the chatbot was a separate legal entity. The tribunal rejected that and held the airline responsible for all information on its website.

That’s a Canadian small-claims decision, not U.S. law, and it’s still the clearest statement of the principle anyone has published. The practical line: anything automated that answers customers should answer from text you’ve approved, should say when it doesn’t know, and should hand off to a person on refunds, prices, exceptions and complaints. The gray area is where trust lives or dies.

Can AI write reviews or testimonials for my business?

No. The FTC’s final rule on consumer reviews, announced in August 2024, bans reviews and testimonials that misrepresent that they’re by someone who doesn’t exist, and it names AI-generated fake reviews specifically. It also lets the agency seek civil penalties against knowing violators. Use AI to ask real customers for reviews. Never to write them.

Should AI make hiring decisions?

Not on its own. New York City’s Local Law 144 requires employers using automated employment decision tools to have a bias audit within a year of use, publish information about it, and notify candidates. Enforcement began in July 2023. Even outside New York, a person should own every hire and every termination.

Hiring is where the pressure to automate is strongest, because a single job post can bring hundreds of applications. Use AI to organize them against criteria a person wrote. Have a person make the cut. Firing and discipline shouldn’t involve AI at all beyond drafting the paperwork a manager has already decided on.

Can a practice put patient information into AI tools?

Only with a signed business associate agreement. HHS guidance says a cloud service that creates, receives, maintains or transmits electronic health information for a covered entity is a business associate, even if it only stores encrypted data without the key. So the rule is no patient information in any AI tool until that agreement exists.

Where does the person go, then?

At the point where the work becomes binding. AI drafts the brief, a person verifies and signs it. AI drafts the customer reply, a person approves anything touching money or policy. AI sorts the applications, a person decides. That’s the whole design, and it’s the same for a chat tool your team uses and for an agent you install later. Nobody gets replaced. The person moves up to the decision.