AI assistants in a small firm: where Claude or ChatGPT fit into an existing workflow, and where they should not

In most small firms, AI assistants arrived before any decision about them. A few people use ChatGPT or Claude on personal accounts to tidy emails, someone pastes a client document in to get a summary, and nobody is sure what is allowed. The question is no longer whether the firm uses AI; it is whether it uses it on purpose.

The short answer: AI assistants fit best where a person already drafts, summarizes or reformats text and then checks the result. They fit badly where a mistake goes straight to a client, a court, a patient or the ledger without review, or where the task needs a firm's judgment rather than a fluent sentence. Before any of that, put people on business accounts and write down three rules: what data may go in, who reviews what comes out, and where the result is saved.

Start with the account, not the use case

Personal and business plans are treated differently by both major vendors, and the difference matters for client data.

• OpenAI says that by default it does not use data from ChatGPT Business, ChatGPT Enterprise or its API platform, including inputs and outputs, to train its models, according to its business data privacy page as of October 2026.
• Anthropic says that by default it will not use inputs or outputs from its commercial products, such as Claude for Work and the Anthropic API, for training, except where a user sends feedback (for example a thumbs up or down) or otherwise opts in, according to its privacy center article on model training as of October 2026.

Consumer plans have their own separate policies and settings, which can change. The practical rule for a firm is simple: client work happens only on accounts the firm pays for and administers, so that you control who has access, can remove a leaver, and know which terms apply. Not being used for training is also not the same as not being stored, so read the retention terms of the plan you choose, and check with your lawyer or compliance lead what your professional rules and client contracts say about sharing client information with a third-party service.

Where AI assistants fit well

These tasks share a pattern: a person starts them, the assistant produces a draft, and the same person checks it before it goes anywhere.

Drafting from your own material

• First drafts of client emails, cover letters and follow-ups from bullet points.
• Turning meeting notes into a clean summary with action items.
• Rewriting a dense paragraph into plain English for a client.
• Drafting internal procedures and checklists from a rough description.

Summarizing and comparing

• Summarizing a long document so a reviewer knows where to look first.
• Comparing two versions of a policy or proposal and listing the differences.
• Pulling the key dates, parties and amounts from a document into a table, which a person then checks against the source.

Reformatting and tidying data

• Cleaning a messy export (inconsistent names, dates, capitalization) before it is imported somewhere.
• Turning a free-text list into a structured spreadsheet.
• Writing the formula or the filter you could not remember.

Inside an existing automation

An assistant can also sit as one step in a Zapier, Make or Power Automate flow: classifying an incoming email, drafting a reply for a person to approve, or extracting fields from a form attachment. Here the rule is stricter. The AI step should produce a draft or a suggestion that lands in front of a person, not an action that fires automatically. Our article on which business processes to automate first helps decide where such a step is worth adding.

Where they should not be used, or only with care

The common thread: an AI assistant is a fast first-draft writer and a patient summarizer, not a professional who carries responsibility for the result. Where responsibility sits with your firm, a person must stand between the assistant and the outcome.

Three rules to write down

A one-page policy is enough for most firms of 10 to 50 people. It should answer:

1. What may go in. For example: internal notes and public information, yes; client documents only on the firm's business account; health data, identity documents and anything under a stricter client agreement, no, unless your compliance lead has approved it.
2. Who checks what comes out. Every output used outside the firm is reviewed by the person who sends it, and they are responsible for it as if they wrote it.
3. Where the result lives. The final version goes into your document system, CRM or practice management tool, not left in a chat history. The chat is a workspace, not a record.

Add the name of the person who answers questions about the policy and when it will be reviewed, because plans and terms change.

Connect it to your systems last

Once people use an assistant well on its own, the next request is usually to connect it to the CRM, the document store or the inbox. That is where most of the value is, and also most of the risk, because the assistant can then read, and sometimes change, real client records. Do it after the rules above are working, start with read-only access, and keep a person approving any change. Our guide to connecting an AI assistant to your CRM safely walks through the steps.

Make it a skill, not a secret

The firms that get value from AI assistants treat them like any other tool: a short training session, a shared list of prompts that work for your common tasks, and a place to report outputs that went wrong. People who use an assistant quietly on a personal account do not share what works, and they hide mistakes. Bringing it into the open improves both quality and safety. Our training and support page describes how we run those sessions.

How Flow Mesh helps

Every engagement starts with a first call and a stack audit, scoped in writing, that gives each tool you pay for a verdict (keep, configure, consolidate or replace), including any AI assistants already in use. Where an AI step belongs in a workflow, we quote the build in writing after the audit and set it up inside your own accounts. See the stack audit for what it covers.

Key takeaways

• Put client work on business accounts the firm administers; read each vendor's training and retention terms for the plan you choose.
• AI assistants fit tasks where a person drafts, summarizes or reformats and then checks the result.
• Keep final advice, automatic client messages, citations, ledger entries and people decisions with a responsible person.
• Write a one-page policy: what may go in, who reviews what comes out, where results are saved.
• Connect assistants to your systems last, read-only first, with a person approving changes.