← Toolkit

AI-safety checklist for businesses

For founders and small teams in a hurry. This is general defensive guidance, not an audit and not a guarantee. Leave your email for a one-page PDF you can print and tick.

1. Payment and bank-detail changes are confirmed on a number you already have, not the one in the email or the call.
2. Two people (or one person plus a documented call-back) approve new payees and unusual transfers — including when “the founder said so.”
3. Every mailbox that can move money or see customer data uses multi-factor authentication.
4. Family and finance leads share a code word for unexpected voice or video requests.
5. Staff have a safe, obvious way to report a suspicious message without getting in trouble for it.
6. Lookalike domains and display-name spoofing are part of training — polished language is not treated as a safety signal.
7. Staff personal emails, mobile numbers, and organograms are not published unless they truly need to be.
8. Backups exist, they are tested, and at least one copy cannot be altered by a ransomed laptop.

Want the habit in more detail? Start with the family and team code-word guide or the protect your business page.