What customer consent records should a small business keep before using AI?

Keep the customer name or account, what was approved, the exact channel and date, the allowed use, the source record, the expiration or review date, and the human owner who verified it before AI-assisted work uses the information.

What should never be invented in an AI consent record?

Do not invent customer approval, testimonial permission, SMS consent, recording permission, data-sharing consent, warranty acceptance, policy acknowledgement, or the date/channel of consent. If source proof is missing, hold the workflow for owner review.

AI Customer Consent Record Checklist for Small Businesses

AI-CUSTOMER-CONSENT-RECORD-READY

1. Consent types to record before using AI

Consent type	Source proof to verify	AI risk if missing
SMS or text follow-up consent	Form checkbox, signed agreement, opt-in text, CRM consent field, or prior approved thread.	AI drafts messages to customers who did not agree to that channel.
Call recording or transcript use	Recorded disclosure, state-law review, phone-system setting, or manager-approved policy.	AI summarizes or shares call details that should stay private.
Review, testimonial, or case-study quote	Public review URL, signed permission, email approval, or customer-approved quote.	AI invents endorsement language, customer outcomes, ratings, or approval.
Photo, screenshot, or project example	Customer permission, anonymization check, image source, location/privacy review.	AI captions private photos as public proof or creates unsupported claims.
Policy acknowledgement or exception approval	Signed agreement, customer reply, owner approval, ticket note, or contract clause.	AI claims the customer accepted terms, fees, warranty limits, or exceptions without proof.

2. Copy/paste consent record card

Customer/account:
Consent or permission needed:
Allowed use: [SMS follow-up / transcript summary / public quote / photo use / policy acknowledgement / other]
Source proof: [URL / file / CRM field / email id / text thread / signed form / none]
Consent channel: [email / SMS / web form / phone / contract / public review / owner approval]
Consent date:
Consent expiration or review date:
Private details to remove:
Customer-visible wording approved: [yes/no/not needed]
Responsible owner/reviewer:
AI use allowed? [yes with limits / no / hold for review]
Notes:

3. Customer-safe wording snippets

Ask for testimonial or quote permission

Would it be okay if we used the following short quote in our internal examples or marketing? We can keep your name/company private if you prefer. Please reply yes, no, or with any edits you want.

Confirm SMS follow-up channel

Is it okay if we use this number for updates about this request? Reply YES to confirm, or tell us the best email/phone number to use instead.

Hold until consent source is found

Thanks — we need to verify the consent/source record before we use those details. We will check [source] and follow up by [date/time].

Private-details removal note

Before using this example, remove names, addresses, account numbers, prices, photos, and any details that could identify the customer unless approved consent is attached.

4. STOP AUTOMATION guardrails

STOP AUTOMATION if the workflow assumes consent, approval, or opt-in history that is not attached to the record.
Do not invent permission for testimonials, photos, SMS, call recordings, case studies, public quotes, policy exceptions, refunds, warranty acknowledgements, or data sharing.
Do not paste private customer details into AI tools until the tool, data boundary, and retention rules are approved.
Do not summarize a recorded call for external use unless the recording/source policy and customer expectations are verified.
When source proof is missing, use a hold message and assign a human owner.

5. Owner-review prompt

You are reviewing whether a small business can safely use customer information in an AI-assisted workflow. Use only the source facts below. Do not invent consent, opt-in history, customer permission, testimonial approval, recording permission, public-use approval, policy acknowledgement, dates, or legal conclusions.

Source facts:
[paste consent record, CRM note, email/text thread, form field, contract clause, or public review URL]

Planned AI use:
[paste what the team wants to do]

Review:
1. What consent or permission is proven by the source facts?
2. What is missing or ambiguous?
3. What private details should be removed before AI use?
4. What customer-safe wording should be used if permission is needed?
5. Should this be allowed, limited, or held for owner review?

Product fit

The Small Business AI Profit Kit expands this kind of guardrail into prompt libraries, workflow cards, owner review rules, rollout planning, and safer AI operating systems for non-technical teams.