Most AI compliance advice online is written for banks, hospitals and public companies. If you run a 20-technician HVAC company or a three-branch roofing business, almost none of it applies to you, and the parts that do are buried.
This guide keeps what matters for a small service business: what customer data you are putting into AI tools, the call and text rules that attach to AI phone and messaging systems, what to ask vendors about data, and a one-page governance checklist. It is general information, not legal advice. Confirm anything that affects your business with counsel.
What changes when you add AI
Using AI does not create a separate legal universe. The laws you already live under still apply. What changes is the number of places customer data goes and the number of things that can talk to customers without a person typing.
Four things tend to matter in a trades company:
- Customer data moves into new tools. Names, addresses, phone numbers, service history, photos of the inside of a home and sometimes payment details.
- Phones and texts get automated. A voice agent answering calls or a system texting missed callers triggers rules about consent, recording and disclosure.
- Employees start using AI on their own. A CSR pastes a customer's complaint into a free chatbot to draft a reply. Nobody decided that was acceptable. It just happened.
- You rely on vendors you cannot inspect. You cannot audit a model. You can read a contract.
Customer data: take stock, scale down, lock it
The FTC's guide "Protecting Personal Information: A Guide for Business" is written for small businesses and still the clearest starting point. It lays out five principles: take stock of what personal information you have, scale down to what you need, lock it, pitch what you no longer need, and plan ahead for a security incident.
Applied to AI:
- Take stock. List every AI tool anyone in the company uses, including free ones, and what customer information goes into each.
- Scale down. An AI that drafts a follow-up text does not need the full customer record. Send the minimum.
- Lock it. Use business accounts with access controls, not personal logins. Remove access when someone leaves.
- Pitch it. Decide how long call recordings, transcripts and chat logs are kept, and delete on schedule.
- Plan ahead. Know who you call and what you do if a vendor reports a breach.
Calls and texts: the rules attach to the channel
Two bodies of law show up when AI answers phones or sends messages. Both are covered in more depth in dedicated guides, so this section is a pointer.
Texting and AI voice calls
The Telephone Consumer Protection Act (TCPA) and the FCC's rules at 47 CFR 64.1200 restrict calls that use an artificial or prerecorded voice, and certain calls and texts, without the right consent. In a declaratory ruling dated February 8, 2024, the FCC confirmed that AI-generated voices count as "artificial" voices under the TCPA, so the same consent requirements apply. The FCC did not create a carve-out for AI that imitates a live agent.
What that means for your specific setup depends on whether the contact is a reply to someone who called you, a marketing message, or an outbound call. Our guide to texting rules for contractors goes through the structure, the carrier registration step and where the open questions are.
Recording and disclosure
Federal law (18 U.S.C. 2511(2)(d)) allows a person who is a party to a call to record it, or to record when one party has given prior consent. Many states are stricter. The Reporters Committee for Freedom of the Press lists 13 that require all-party consent for phone calls, including California, Florida, Illinois, Massachusetts, Pennsylvania and Washington. If your AI system records calls, or your calls cross state lines, assume the stricter rule and tell callers. A short disclosure at the start of the call is a common practice. Ask counsel what wording your states need.
Vendor data terms: read these five things
You cannot inspect how a vendor's model works, but you can ask what their contract and documentation say. Ask for these in writing:
- Is our data used to train your models? Some providers state that business and API data is not used for training by default. For example, OpenAI's API documentation says data sent to the API is not used to train or improve its models unless you opt in, and that abuse-monitoring logs are retained for up to 30 days by default, with zero data retention available only with approval. That is one provider's terms. Check each vendor you use, because they differ and change.
- How long do you keep recordings, transcripts and logs, and can we delete them?
- Who are your subprocessors? Many "AI receptionist" products are built on a stack of other vendors. You want to know who touches the audio and text.
- Who owns the recordings and the phone number? If you leave, can you take your number and your data?
- What is your breach notification process?
If a vendor cannot answer these in a few days, that is information.
When the big regimes apply
Enterprise guides spend pages on HIPAA, SOX, GDPR and PCI DSS. For most service businesses the short version is:
- PCI DSS applies to anyone who accepts card payments. It is a payment security standard from the PCI Security Standards Council that covers merchants and anyone who stores, processes or transmits cardholder data. For AI, the practical rule is to keep card numbers out of prompts, call recordings and transcripts. If a voice agent will take payments, ask the vendor how it handles card data before you test it.
- HIPAA applies to covered entities such as healthcare providers and plans, and to their business associates. A plumbing company is generally not one. If you serve a healthcare facility, your client may have contract requirements about patient information. Ask.
- SOX applies to public companies. If you are private, it does not apply to you directly. It may matter if you are a vendor to a public company or are acquired by one.
- GDPR applies if you handle personal data of people in the EU. A local trades company usually does not.
- State privacy laws are the one to watch. Several states have comprehensive consumer privacy laws with thresholds based on size or data volume. Whether yours applies depends on your states and revenue. Ask counsel once.
A one-page governance checklist
This is the minimum for a company your size. Put it on one page and give it an owner.
- [ ] Owner named. One person is accountable for AI use. In a small company it is usually the owner or the ops lead.
- [ ] Tool list. Every AI tool in use, who uses it, what data goes in, and which plan or account.
- [ ] Usage policy. One page: approved tools, data that must never be pasted into an AI tool (card numbers, government IDs, passwords), and a rule that a person reviews anything sent to a customer unless you have approved an automation.
- [ ] Vendor review. The five questions above, answered in writing for each customer-facing vendor.
- [ ] Call and text setup. Consent and registration confirmed for texting. Recording disclosure and state rules checked for call recording.
- [ ] Human handoff. For every AI that talks to customers, a defined way to reach a person, and a rule for what escalates.
- [ ] Logs and review. Someone reads a sample of conversations each week and records problems.
- [ ] Incident plan. Who to call, what to shut off and how to notify customers if something goes wrong.
- [ ] Annual review. Once a year, rerun the tool list and vendor questions. Tools change.
If you want a framework behind the checklist, NIST publishes the AI Risk Management Framework, a voluntary framework organized around four functions: govern, map, measure and manage. It is written for organizations of all sizes and is more than a shop needs, but its structure is a good reference if a larger customer ever asks how you govern AI.
Where to go from here
If you are still deciding what to build, start with where to start with AI as a contractor. If you are evaluating phone AI, our guide to AI receptionists for contractors lists what to test, including data handling.
Di-Hy builds AI systems for trades operators, including the data and consent handling described here, as part of the Booked-Jobs Recovery System. We are not a law firm and do not give legal advice. If you want to talk through your setup, book a strategy call. Pricing is scoped on the call.
Frequently asked questions
Do I need an AI policy if I only use ChatGPT for emails?
A one-page policy is still worth it. The risk is not the tool, it is what gets pasted into it. A written rule on what data never goes into an AI tool covers most of the exposure.
Do I have to tell callers that an AI is answering?
Rules vary by state and by call type, and they are changing. The FCC treats AI-generated voices as artificial voices under the TCPA, which brings consent requirements for certain calls. Ask counsel for the disclosure wording your states need.
Is a free AI tool safe for customer information?
Data terms differ between free and business plans. Read the terms for the plan you use, and confirm in writing whether your data is used for training before any customer data goes in.
Does HIPAA apply to my contracting business?
Generally not, unless you are a covered entity or a business associate of one. If you work in healthcare facilities, ask the client what their contract requires.