Thirty checks across six areas, from knowing which AI tools your team uses to handling an AI output that goes wrong. It's designed for small companies without a compliance team, and comes with a free sheet to track your progress.

Here's a question I'd love every founder to answer honestly: how many AI tools is your team using right now?

I don't mean only the ones you pay for. I mean all of them. The browser extension someone installed on a whim. The free transcription app a salesperson runs on calls. The chatbot a contractor feeds client files into. The API key left in a repo after a weekend experiment.

Most people guess too low, and the distance between what you think you use and what you really use is where AI risk quietly builds up.

Large companies have AI governance teams to deal with this. You most likely don't. So I created a simple AI accountability checklist for founders and small teams: 30 checks in six areas, plus a free sheet for tracking them. There's no legal jargon, only the things that actually protect you.

Why this matters now, even for tiny teams

Not long ago, "AI accountability" sounded like a concern for banks and hospitals. Then three things shifted in 2026.

Rules started to apply. The transparency obligations in Article 50 of the EU AI Act took effect on August 2, 2026. If you run a chatbot for EU users, they must be told they're talking to AI unless that's obvious. AI-generated content has to be marked, and deepfakes need labels. Fines can reach €15 million or 3% of global turnover, with lower caps for SMEs. The high-risk rules were pushed back to December 2027 and August 2028, but as Jones Walker put it, that's a reprieve, not a repeal.

Abuse became more sophisticated. Anthropic's September 2026 threat report describes criminals who stole AI API keys from dozens of companies and used them as cover. If your key is abused, your account takes the blame.

Clients began to ask. Security questionnaires now include AI questions such as "Do you put our data into AI tools? Which ones? Is it used for training?" You'll want a calm, clear answer ready.

AI accountability isn't about slowing down. It's about being able to answer "what happened?" when someone asks.

How to use this checklist

You don't need to finish all 30 in a day. Take one area per week and give every item an owner, even if that owner is you. Mark each item as Not started, In progress, Done, or Not applicable.

The free tracking sheet includes every item below, with columns for owner, status, due date, and notes, along with a summary tab showing your progress in each area.

Area 1: know what you use

List every AI tool in use, whether paid or free, including browser extensions and meeting recorders.
Note who uses each one and what they use it for.
Record the plan type for each: free, individual paid, or team/enterprise.
List every AI API key, along with where it lives and who created it.
Assign an owner for the AI inventory who updates it every month.

Area 2: protect the data

Write a one-page data rule covering what can and can't go into AI tools.
Ban client data on free tiers that may use content for training.
Check training settings on every paid tool and switch training off wherever possible.
Check where data is stored for tools that handle personal data, especially for EU users.
Remove secrets from prompts and repos: passwords, keys, and customer records.

Area 3: keep a human in the loop

Decide which outputs always need human review before reaching a customer: contracts, pricing, and medical, legal, or financial claims.
Name a reviewer for each of those output types.
Keep a record of who approved what, even if it's only a Slack thread.
Spot-check automated outputs every week, such as support replies or generated product descriptions.
Set up an escalation path so anyone can quickly flag a bad AI output.

Area 4: be transparent

Tell users when they're talking to AI, in chatbots and support.
Label AI-generated images, audio, and video wherever rules or common sense call for it.
Update your privacy policy to mention AI processing and the vendors involved.
Prepare a short AI statement for client security questionnaires.
Make it easy to reach a human from any AI interaction.

If a customer would feel tricked to learn later that it was AI, tell them now.

Area 5: secure your AI stack

Use one key per project or client so a single leak doesn't expose everything.
Rotate keys every 60 to 90 days and whenever someone leaves.
Set spending limits and alerts on every AI provider account.
Never ship keys inside apps. Route calls through your backend instead.
Review vendor terms once a year: policies on data use, retention, and training change.

Area 6: plan for when it goes wrong

Write a one-page incident plan: who to call if an AI tool leaks data or produces something harmful.
Know how to revoke access quickly for every AI tool and key.
Keep logs of important AI-driven actions, especially from agents that can act on their own.
Decide who speaks to customers if an AI mistake affects them.
Review this checklist every quarter, and after any incident.

A sample AI statement you can adapt

Item 19 is the one clients will ask for, so here's a short template. Adjust it to match your reality, and never claim something you don't actually do.

We use AI tools to help with drafting, research, and data processing. Client data is only processed in paid business tools where our content is not used for model training. We don't enter passwords, payment details, or special category personal data into AI tools. All client-facing outputs that involve contracts, pricing, or technical recommendations are reviewed by a named person before delivery. We keep a list of the AI vendors we use, and we'll share it on request.

A handful of sentences like these cover most AI sections in security questionnaires. They also push you to confirm that each sentence is true, which is half the value.

How to use the free sheet

The sheet is intentionally simple. Here's how I'd set it up in the first 15 minutes:

Make a copy and add your company name to the title.
Fill in the Owner column for all 30 items. If you work solo, that's you. Resist the urge to leave any blank.
Mark anything that genuinely doesn't apply as Not applicable. If you don't run a chatbot, item 16 might be N/A for now.
Give the five "this week" items a due date seven days out.
Add a quarterly reminder to your calendar to review the whole list.

The summary tab counts done and in-progress items for each area, so you can see at a glance where you're exposed.

The five to do this week

If 30 feels like a lot, begin with these five. Together they cover most of the real risk for a small team.

List every AI tool your team uses (item 1).
Ban client data on free tiers (item 7).
Set spending limits on every AI account (item 23).
Tell users when they're talking to AI (item 16).
Know how to revoke access fast (item 27).
That's about two hours of work, and it puts you ahead of most companies your size.

What a first pass usually turns up

I run a small freelance operation with one team member and a few side products, so I think about this at small-team scale. When a team of this size works through a list like this for the first time, the surprises are rarely dramatic. They tend to be mundane:

An old API key from a test project that nobody remembers creating
A free-tier tool quietly processing files that came from clients
No written rule about what data goes where, just "everyone knows"
Usually, none of these cause trouble. Yet. That's exactly why it pays to do this before something happens.

Common objections

"We're too small for this." Small teams are actually more exposed. A single leaked key or one bad AI email to a major client can do far more damage when you only have ten clients.

"It'll slow us down." Most of these checks take just minutes. The real slowdown comes from not having answers when a client or regulator asks.

"We don't sell in the EU." Perhaps not today. But transparency and data rules are spreading, and clients everywhere are asking the same questions.

I'm not a lawyer, and this isn't legal advice. Treat it as a practical starting point. If you operate in a regulated industry or handle sensitive data at scale, bring in proper legal help as well.

Have the answer before someone asks

An AI accountability checklist won't make your company slower or more corporate. It makes you the founder who can calmly and quickly answer, "what AI do you use, what data does it see, and who checks it?"

That answer builds client trust, prevents nasty surprises, and keeps you on the right side of new rules.

Grab the free sheet, complete the five this week, and then work through the rest one area at a time.

Enjoyed this read? Be sure to follow me for more stories that make people feel things. You can also connect with me on LinkedIn or Telegram @kawsarlog for more updates on my work.

I do freelance scraping projects, so if you need some data collected feel free to contact me on LinkedIn or email at hi@kawsarlog.com