We don't have an IT department. Can we still use AI on our back office?

Small covers a lot of ground. The SBA's Office of Advocacy, in its 2026 answers to frequently asked questions, defines a small business for research purposes as an independent business with fewer than 500 employees; the size standards for government programs are a separate, industry-by-industry table. Near the top of that range, a company often has IT staff of its own. This page is for the rest: the owner-led company where the bookkeeper resets passwords, the office manager knows where the router lives, and an outside firm gets a call when something breaks.

The public guidance written for companies like these starts with the owner, not the technology. CISA's Cyber Essentials, a guide for leaders of small businesses and of small and local government agencies, makes Yourself the first of its six elements and gives the leader the task of driving cybersecurity strategy, investment and culture. The UK's National Cyber Security Centre, in its small organisations guide last reviewed in July 2026, tells readers they don't need to be a technical expert. A test on old documents asks the same of you: knowledge of the business and a little admin.

Three things, and you already have all of them:

• A person who knows the job. The one the others ask when a document doesn't make sense: often the bookkeeper, the order desk lead or the estimator, and sometimes the owner. They become your reviewer, the person on your team who knows this work best, named by the owner before anything starts. Their hours go into choosing the documents, agreeing the success criteria and judging the drafts, so avoid month-end.
• The old documents. Copies of 20 to 30 that your team already handled, each with what was done with it: the PO and the order entered from it, the vendor bill and the way it was coded. They are sent only after an NDA is signed. If they can't leave the building, look-alikes built with your reviewer stand in for them.
• Someone who can get files out. Saving an email attachment as a PDF, scanning a paper form, printing a record to PDF, exporting a report to a spreadsheet. Whoever runs your month-end reports can usually do all of it with the login they already have, without installing anything or asking for new rights.

A test on copies runs entirely outside your systems, and nothing in it touches a live one. Our free AI proof of concept works this way: one job, copies of 20 to 30 old documents sent after an NDA, your reviewer named by the owner and the success criteria agreed before it starts.

That gives you a simple rule for spotting trouble. The FTC's cybersecurity pages for small businesses, dated September 2025, tell owners never to give anyone their password and never to give remote access to a computer to someone who contacts them unexpectedly. For vendors, its advice is to limit access to a need-to-know basis, and only for the time the vendor needs to do the job. A test on old documents needs no access at all, so a request for a login or remote access to run one should get a no, whoever sends it. In practice the test needs:

• No access to your systems. Nobody logs in to your accounting system, your ERP, your email or your bank, and no account is created for anyone.
• No server and no software. Nothing is installed on your computers or your network, and nobody opens a port, changes a firewall or sets up remote access.
• No new login. Your people don't sign up for anything to take part. The documents travel as copies, and the drafts come back for your reviewer to compare side by side with what your team did.

If your reviewer says yes, the same job runs live in your systems for about 30 days, and a person on your team approves each item before it posts anywhere. This is where access starts to matter, because drafts now have to reach a real system. On a small team the roles are the same as anywhere. What changes is that one person often holds two of them, and nobody is spare:

• The owner decides. Whether the live month starts, carries on or stops, and which kinds of document always stay with a person. In an owner-led company this call sits with the owner, and it should.
• The person who knows the job approves. Usually your reviewer. Decide now what happens on the days they're out: someone else approves, or that day's documents are handled by hand the way they are today.
• Whoever holds the admin rights opens the door. The SBA's guidance says administrative privileges should go only to trusted IT staff and key personnel. With no IT staff, that means key personnel: often the owner, the controller or the office manager, sometimes with the outside provider holding a second set. Find out who it is for the system the job lands in: that person sets up any access the live run needs, and can switch it off.
• A second factor on every account the job uses. The SBA also tells owners to check with their vendors about multi-factor authentication on accounts such as financial, accounting and payroll. Ask the same about any account a live run would use, and decide who holds the second factor.

Live jobs change because the documents change. A customer moves to a new system and its POs arrive in a new layout, or a vendor adds a fuel surcharge line to every invoice. With no IT department, the approver is usually the first to notice, because drafts of that one form start arriving flagged or wrong.

So the support questions are practical ones. Ask them of any vendor, us included, and get the answers in writing before the live month starts:

• Who do we tell, and how? One named contact, and what they need from you: the new document and what was wrong with the draft.
• Who changes the setup? Whether the fix happens entirely on the vendor's side, and whether it ever needs anything from your systems or a login of yours.
• What happens to that form meanwhile? Drafts of it should reach a person as exceptions, or your desk handles it by hand, until the fix has been checked.
• How is the fix checked? A few documents in the new layout run through again, with your approver comparing each draft to what they would have entered, before anyone relies on it.
• What does monthly support cover? What is included once a job is live, what is quoted separately, such as a new kind of document, and what hours and response times are promised. Have it in the agreement.

For the test, neither does. Nothing connects, nothing is installed and no account changes, so there is nothing for them to set up or approve. A short note to your provider saying a test is under way does no harm. For the live run, bring them in when the job reaches something they look after:

• An account in your ERP or accounting system. Whoever set the system up, often the reseller, is the one to ask how it treats a user that isn't a person, which role fits a job like this, and what your license allows.
• Your email. A shared mailbox, a forwarding rule or a new address for documents to arrive at is set up by whoever runs your email.
• Security settings they manage. Multi-factor authentication, single sign-on or a device policy your provider looks after.
• Your contract with them. If your agreement says changes to your systems go through them, that applies here too.
• Not the business decisions. Choosing the job, picking the documents, scoring the drafts and deciding whether it passed belong to the owner and your reviewer. Among CISA's six tasks are protecting critical assets and applications, and making sure only those who belong on your digital workplace have access to it. Your provider helps with both; whether a draft is right is your reviewer's call. Before the live month, settle with them how drafts reach the system and who can switch that off. None of this is IT, legal or security advice, and where your provider's contract or your own policies say otherwise, follow them.