Elena runs her insurance brokerage from a spare room. It's nine at night and she's using an AI assistant to draft three car insurance quotes before bed. She types in a driver's date of birth, a line about a fender bender a client mentioned on the phone, and an ID number to check a claims history. Then she stops. Is she even allowed to do that?
She isn't alone in asking. A recent Zapier survey found that 76% of small business owners are already automating some part of their work, from simple rule-based tools to AI that acts with very little human input. Most of them, the same survey found, have no written rule about what that means for the client details flowing through it. Adoption ran ahead of anyone writing anything down.
The rule you're already under
Here's the part that gets lost in the AI conversation: there's no separate law for "typing things into a chatbot." If you're in the EU, GDPR already tells you what to do with a client's date of birth, ID number, or health detail, and it has since 2018, whether you keep it in a spreadsheet, a paper file, or an AI tool. Typing a client's information into an AI assistant is processing personal data, in exactly the legal sense as pasting it into Excel. The question was never "is AI allowed." It's "am I doing what I already had to do, with a new tool."
What Spain's regulator actually said about agents
In February 2026, the AEPD, Spain's data protection authority, published guidance specifically about "agentic" AI: AI that acts on its own, sending a message, updating a record, drafting a document, instead of only answering a question. Buried in the technical language is a genuinely useful test, close to what people are calling the "rule of two." Three things make an AI agent risky: it touches sensitive data, it acts on its own without a person checking first, and it processes information in ways you can't fully see or reconstruct afterward. One of those, on its own, is normal. Two at once is the combination the regulator is warning about.
The document itself is Spanish, and this piece uses it because it's precise and recent. The underlying discipline isn't a Spanish quirk, though. It's a plain reading of what data protection law already asks of anyone processing personal data, in the EU or anywhere with a similar law, the moment a tool starts acting on its own instead of just answering.
Apply it to Elena. Her quote-drafting tool touches sensitive data, yes: the ID number, the fender-bender detail. But she still reads and sends every quote herself. One box ticked, not two. She's fine. If she switched on auto-send so quotes went out without her glancing at them first, that's box two, and now she's in the configuration the guidance is actually worried about.
You already have most of the paperwork
Here's the reassuring part. If you handle client data in the EU, you've been required since 2018 to keep a register of processing activities, a document naming what personal data you handle and why. Most small businesses that were set up properly already have one, even if it's a page nobody's opened in a year. The real gap isn't a missing framework. It's one missing line: does that register name the AI tools now touching that data? If not, that's the actual update to make, not a new document from scratch.
It's also worth knowing who's accountable. An AI vendor with a proper data processing agreement is acting as your processor, doing the work on your instructions. You're still the controller. That responsibility doesn't transfer to the tool just because the tool is the one typing.
The one page you actually need
You don't need a governance department for this. You need five lines, written tonight.
- Which tools are actually approved. Not "AI" in general, the specific apps you or anyone working with you may use for client work.
- What never goes in. Full ID numbers, health details, anything told to you in confidence, unless there's a real reason and you've thought about whether it's necessary.
- Who's responsible if something goes wrong. For a one-person business, that's you. Write it anyway; a rule with no name attached tends to get ignored.
- Where a person checks before anything goes out. For most small businesses, right now, the honest answer is everything.
- A line in your existing GDPR paperwork naming the tool. If you don't know where that document is, that's this week's real task, not the five-line policy.
Honest limits
This isn't legal advice, and a one-page policy doesn't cover everything. Health data, information about minors, and anything biometric carry extra rules that deserve a real conversation with an advisor, not a blog post. AEPD's "meaningful human oversight," for a genuinely autonomous agent with memory that reaches into several of your systems, is a bigger project than five lines: access limits, activity logs, keeping one client's data separate from another's reach. That's real work, worth doing properly when you get there, not something to fake with a checklist. The guidance itself is only months old; nobody's been through a small-business inspection under it yet, so treat this as getting ahead of the question while it's still simple, not as a box permanently checked.
We've written before about what actually happens to the client details you type into an AI tool, worth reading alongside this one if you haven't already: that piece covers where the data goes, this one covers who answers for it.
Tonight's actual task: write the five lines. Then find your register of processing activities, and add one naming the tool you use most. Fifteen minutes, and you'll know exactly where you stand instead of guessing at nine at night.