Prompts, Outputs and Ownership: Managing AI Content in a Small Business

Artificial intelligence tools have moved from novelty to routine in many small businesses. A director may use one to draft a client proposal, a marketing manager may generate website copy, and an operations team may ask for a first version of a staff memo. The time saved is obvious. The legal consequences are less so.

The central point is simple: using an AI tool does not transfer legal responsibility to the tool or its provider. The business remains accountable for what it publishes, what it sends to clients and what it puts into the prompt. This article sets out the main issues under the law of England and Wales and offers a practical framework for managing them.

Ownership is not automatic

Copyright protects original literary, dramatic, musical and artistic works, among other things. In the ordinary case, a work must have a human author and be recorded in some form. UK law also contains a provision for computer-generated works: where a work is generated by computer in circumstances where there is no human author, the author is treated as the person by whom the arrangements necessary for the creation of the work are undertaken. That provision has existed for decades, but its application to modern generative AI is not free from doubt.

A small business should therefore avoid assuming that it owns everything an AI tool produces. The position may depend on the tool’s terms, the degree of human input, the nature of the output and whether the output reproduces protected material. A prompt alone may not make the business the author in the conventional sense. Even where a supplier’s terms say that the customer owns the output, those terms may be limited, revocable or subject to the supplier retaining a broad licence.

There is a related commercial risk. If the output is not protected by copyright, or if ownership is uncertain, the business may find it difficult to stop a competitor from using similar material. That matters for brand assets, distinctive marketing copy and anything intended to be licensed to clients.

Read the supplier terms before the first prompt

Supplier terms vary considerably. Some consumer-facing tools claim rights over inputs and outputs, or use customer content to improve their models. Business tiers may offer stronger confidentiality, no-training commitments and clearer ownership language. The difference is not merely technical; it can determine whether client information has been disclosed and whether the business can rely on the output.

The following clauses deserve particular attention:

• Ownership and licence. Does the supplier assign output ownership to the customer, or grant only a limited licence? Are there restrictions on commercial use?
• Training and improvement. Will the business’s inputs, outputs or both be used to train or improve the model? Can this be switched off?
• Confidentiality. Does the supplier treat prompts and outputs as confidential? Are there exceptions for monitoring or abuse prevention?
• Data processing. If personal data is involved, is there a data processing agreement that meets UK GDPR requirements?
• Retention and deletion. How long are inputs and outputs kept? Can the business delete them, and are backups affected?
• Indemnities. Does the supplier indemnify the customer against third-party intellectual property claims? If so, what is excluded?
• Liability caps. What is the maximum the supplier will pay if something goes wrong? Is the cap adequate for the business’s exposure?
• Subprocessors and transfers. Where is data processed, and are international transfer safeguards in place?

A short written record of the terms accepted, and the date they were accepted, is useful. Terms change. A screenshot or saved copy can prevent later disagreement.

Client data should not be pasted into every prompt

Confidential information is a broad concept. It can include client lists, pricing, business plans, draft contracts, personal data and information received under a non-disclosure agreement. Many client contracts prohibit disclosure to third parties without consent. Uploading that material to an AI tool may amount to disclosure, even if the supplier says it will not use the data for training.

Where personal data is involved, the UK GDPR and the Data Protection Act 2018 apply. The business needs a lawful basis, transparency and appropriate security. Special category data, such as health information, requires additional care. If the AI supplier acts as a processor, the business needs a written contract containing the required processor terms. International transfers need a lawful mechanism.

A practical rule is to ask three questions before typing: Is this information confidential? Does it contain personal data? Would I be content for this material to be read by a third-party supplier? If the answer to any is uncertain, the safer course is to anonymise, summarise or use a tool approved for that category of data.

The business remains responsible for the output

AI tools can produce inaccurate statements, invented case references, misleading comparisons and material that infringes someone else’s rights. The fact that a machine generated the content is not a defence. A business that publishes a claim about its services must be able to substantiate it. Consumer protection law, advertising rules and sector-specific regulation continue to apply.

If the output is sent to a client as professional advice or as part of a contractual deliverable, the business may be liable for errors. Client contracts often contain warranties about the quality of work and the ownership of deliverables. Those warranties should be reviewed before AI-generated material is supplied. Insurance arrangements should also be checked; some policies may not respond as expected where AI tools have been used without appropriate controls.

Human review is therefore not a formality. It should be proportionate to the risk. Marketing copy may need a check for accuracy and third-party rights. A proposal may need a check for confidentiality and commercial accuracy. A document intended to have legal effect should be reviewed by someone with the relevant expertise.

A short internal AI policy is worth the effort

A policy does not need to be lengthy. Its purpose is to set clear expectations and create evidence that the business has considered the risks. A one-page policy can cover:

1. Approved tools. Which AI services may be used, and for what purposes.
2. Prohibited inputs. Client data, personal data, trade secrets and privileged material should be identified.
3. Review requirements. Who checks output before publication or delivery, and what they must look for.
4. Ownership checks. When the business needs to confirm ownership or licensing before using output as a brand asset.
5. Record keeping. What should be retained about prompts, outputs, supplier terms and reviews.
6. Disclosure. When clients or customers should be told that AI has been used.
7. Incident reporting. What to do if confidential material is uploaded or inaccurate content is published.
8. Review date. AI tools and terms change quickly; the policy should be revisited at least annually.

Conclusion

AI can be a useful assistant, but it is not a substitute for legal judgement. Small businesses should treat ownership, confidentiality and liability as commercial issues to be managed, not technical details to be left to the supplier. Reading the terms, limiting what goes into the prompt and reviewing what comes out are straightforward steps. A short policy turns those steps into a consistent habit.

This article is general guidance and not legal advice on a specific situation. Businesses using AI for client work, personal data or high-value content should take advice on their contracts and internal controls.