The Rules That Still Apply When You Are the Whole Company

The assumption that consumer protection and data rules are for large companies is common among small business owners and it is wrong in most of the ways that matter.

Advertising law applies from your first customer. Consumer protection law applies regardless of turnover. Data protection law applies to a sole trader with a customer list. Contract terms are enforceable against a one-person business exactly as against a corporation.

What does scale with size is enforcement attention and, in a few specific places, the obligation itself. Some regimes have genuine small-entity accommodations, and the EU AI Act's Digital Omnibus amendments added simplified technical documentation for small mid-caps and extended simplified quality management arrangements to SMEs. Those are real, and they are narrow.

The general position is that the rules apply and the resources to comply do not exist, which is a genuine difficulty rather than a reason to ignore them.

The practical response is proportionality rather than exemption. A one-person business is not expected to have a compliance function. It is expected to be honest about what it sells, careful with customer data, and clear when a customer is dealing with a machine.

Those three obligations cover the great majority of the exposure, they are achievable without advice, and the rest of this lesson takes them in turn.

And one framing worth holding. Each of these is also just how you would want to be treated as a customer, which is a more reliable guide than trying to remember a rule.

The first obligation is the oldest one: do not say things about your business that are not true. Generated marketing makes it easier to breach without meaning to.

On 25 September 2024 the United States Federal Trade Commission announced a set of enforcement actions it called Operation AI Comply, targeting deceptive claims about AI. One action was against DoNotPay, which had marketed an AI service as the world's first robot lawyer. The FTC alleged the company had not tested whether its chatbot's output matched the standard of a human lawyer and had not hired or retained attorneys. The matter settled for 193,000 dollars with a requirement to notify affected subscribers about the limitations of the law-related features.

Other actions in the sweep targeted schemes promising passive income from AI-powered online storefronts, which is notable because the people harmed were themselves would-be small business owners.

What this establishes is not a new rule. It is that ordinary deceptive advertising law already reaches AI claims, and no special regime was needed.

For a small business the practical translation is short. If you say your service is AI-powered, something meeting that description must exist. If you claim an outcome, you must have a basis for it. And the enthusiasm a model brings to writing your marketing copy is a hazard here, because generated copy reaches for superlatives and specific-sounding claims by default.

The check before publishing anything about your own business. Is every claim in this true of what I actually do, and could I show why.

One case from that same sweep deserves separating out, because it describes a temptation small businesses face directly.

The FTC also acted against Rytr, an AI writing assistant. Among its features was testimonial and review generation, where subscribers could produce unlimited detailed consumer reviews from very limited input. The FTC alleged the service generated reviews containing specific material details unrelated to the user's input, which would almost certainly be false for the subscribers who published them.

The significance for a small business is that the tool provider was the target, but the deception would have been committed by the users, who are exactly the sort of small operators such tools are sold to.

And the underlying rule has since been reinforced. The FTC's rule on the use of consumer reviews and testimonials, which took effect in October 2024, prohibits practices including fake or AI-generated reviews that misrepresent a real experience, buying positive reviews, and undisclosed insider reviews. Similar prohibitions on fake reviews exist in EU consumer law and in UK legislation.

So the position is unambiguous. Generating reviews of your own business is prohibited, whoever or whatever produced the words, and the fact that a tool offered the feature is not a defence.

What is fine. Asking real customers for reviews. Helping a genuine customer who wants to leave one but is not a confident writer, provided the substance and the experience are theirs. Using their real words with permission.

The line is whether a real person had the experience described. Everything else is fabrication with a plausible surface.

The second obligation is transparency about automation, and it is becoming a specific legal requirement rather than a courtesy.

Under Article 50 of the EU AI Act, providers must ensure that AI systems intended to interact directly with natural persons are designed so that those persons are informed they are interacting with an AI system, unless that is obvious from the circumstances to a reasonably well-informed person. That obligation applies from 2 August 2026. Article 50(2) requires that synthetic image, audio, video or text content be marked in a machine-readable format, with that requirement applying from 2 December 2026.

For a small business the practical scope is narrow but real. If you run a chat widget on your website, an automated responder, or an automated phone system, the customer should be told.

The cost of complying is one sentence. This is an automated reply, and I will respond personally within a few hours. That is not a regulatory burden, and it also happens to work better commercially, because a customer who knows they are dealing with an automated acknowledgement is not annoyed by its limitations, whereas one who thought it was you is.

Where it is genuinely important. Any automation that could be mistaken for you personally. Voice systems especially, since a synthesised voice can be persuasive in a way text is not.

And a related line worth holding independently of any rule. Do not use a synthesised version of your own voice or image to imply a personal engagement that did not happen, because the entire proposition of a small business is that there is a person there.

The third obligation is data protection, and small businesses carry more of it than they think.

If you hold customers' names, addresses, phone numbers, order histories, photographs of their homes, health information for a treatment, or anything similar, you are processing personal data. Under the GDPR that brings obligations regardless of company size: a lawful basis, transparency about what you do with it, security, and responding to requests from individuals about their own data.

The record-keeping obligation under Article 30 has a partial exemption for organisations under 250 employees, but the exemption is narrower than commonly assumed and does not apply where processing is not occasional or involves special category data. So most businesses that hold customer records regularly are outside it.

What this means for tooling, concretely.

Pasting customer information into a general consumer tool is a disclosure to a third party. It needs a lawful basis and an appropriate arrangement with the provider, and consumer terms often permit retention and use for service improvement.

The practical positions. Use business-tier tools where the terms address retention and training use, which is usually a modest upgrade from consumer tiers. Minimise: most questions you want to ask do not need the customer's name, address or photograph. And keep a short list of what never goes into an external tool at all, which for most small businesses means health information, financial details and anything about a customer's home security or vulnerability.

And if you are unsure whether something is personal data, it probably is.

A short decision path for a one-person business, covering the three obligations without requiring a compliance function.

Start with whatever you are about to send, post or switch on.

Does it make a claim about your business. If so, is every claim true of what you actually do, and could you show a basis for it. This is the advertising question, and it is where generated marketing copy fails, because it reaches for superlatives by default.

Does it involve a review or testimonial. If it did not come from a real customer describing their real experience, it does not go out. There is no version of this that is acceptable.

Will a customer interact with it without you. If so, it says it is automated, in one sentence.

Does it involve customer personal data leaving your systems. If so, business-tier terms, minimised data, and nothing from the never list.

And if it is irreversible, prices, contracts, anything public, it waits until tomorrow, which is the structural substitute for the colleague you do not have.

Five questions. Most things pass all of them in seconds, and the ones that stop are exactly the ones worth stopping.

The strategic question is what happens when every competitor has the same tools, and the answer is more encouraging for small businesses than for large ones.

What gets commoditised. Professional-looking marketing. Prompt, well-written replies. A tidy website. Competent standard documents. These used to distinguish a well-run small business from a poorly-run one, and they no longer do, because the floor has risen for everyone.

What that leaves. The things a customer chooses a small business for in the first place, none of which are affected.

Actually doing the work well, which for most small businesses is a physical or personal skill.

Being reachable and answerable. When something goes wrong with a large company, the customer navigates a system. With you, they reach you. That contrast becomes more valuable as automated customer service spreads, not less.

Knowing your customers as people, remembering their situation, and being trusted enough to be recommended.

And local knowledge and presence, which is not in any dataset.

The risk in this transition is not being outcompeted by better-resourced firms. It is automating away the thing you were chosen for, in pursuit of an efficiency that was never your bottleneck. A small business that becomes hard to reach in order to save time has traded its advantage for its constraint.

So the closing framing for the cursus. Use the tools to protect the time you spend doing the work and talking to customers. That is where a small business wins, and it always was.

Everything in this cursus, reduced to what one person can hold in their head.

What I automate. The arrival of work: enquiries acknowledged, scheduling handled, follow-ups scheduled rather than remembered. And the recording of work: receipts, categorisation, invoices, the records my accountant needs.

What I draft with help. Quotes, standard replies, posts, procedures. Always reviewed, because nobody else will.

What I never generate. Prices, which come from my costing. Any number a customer relies on. Reviews or testimonials, ever. And anything specific about a customer's situation that I have not verified.

What waits until tomorrow. Prices, contracts, anything public, anything going to more than one person.

What I check before it goes. Is every claim true of what I do. Did a real customer have this experience. Does the customer know this is automated. Is customer data staying where it should.

What I keep for myself. Doing the work. Talking to customers. Deciding what to charge. Noticing when something is changing.

And one line underneath all of it. Whatever goes out, I am the one saying it. There is nobody else, and that was true before any of these tools existed.

That is the whole policy. It fits on a page, it costs nothing to maintain, and it covers most of what could realistically go wrong in a business of one.