x
Four places. Write them down before you write a single disclosure line, because a disclosure on the wrong surface is worse than none — it tells a client you thought about this and still missed the bit that mattered to them.
Most founders can name the first two immediately and forget the second two entirely, which is unfortunate, because three and four are where trust is actually won or lost. A labelled image is hygiene. A proposal a client later discovers was drafted by a model is a relationship.
Set a timer for twenty minutes. This is a listing exercise, not a decision-making one — resist the urge to fix things as you find them, because fixing is a separate, faster job once you can see the whole surface at once.
For every item on your list:
Would a client be surprised? Not "is this technically permitted" — surprise is the honest test, and it's the one that predicts how a conversation goes. If you'd hesitate to mention it unprompted in a meeting, that hesitation is the finding.
Where would they find out — from you, or from someone else? This is the timing question, and timing is the whole value of a disclosure. Told first reads as confidence. Told second reads as damage control, even when nothing was hidden.
What's the one line that fixes it? Almost every gap closes with a sentence. "This chat is answered by an AI assistant." "Image generated with AI." "We draft with AI and review everything before it reaches you." If a surface needs a paragraph, you've probably found a genuine judgement call rather than a labelling gap — flag it and move on.
Three columns, one row per surface. That's the artefact. It should be ugly and it should take twenty minutes.
Because AI surfaces accumulate the way subscriptions do: one at a time, each justified, none reviewed. The tool you trialled in February is still answering messages in August. Nobody decided that. It simply never got switched off.
Two patterns show up in nearly every audit of this kind. The first is the forgotten automation — something conversational, running unattended, that the owner had genuinely stopped thinking about. The second is the unlabelled image on the highest-traffic page, usually the homepage hero, chosen precisely because it looked good enough not to question.
Neither is a scandal. Both are exactly what an unreviewed process looks like, and it is the same failure mode as an automation nobody prices: you cannot verify what you don't measure, and you cannot disclose what you've forgotten you're doing.
There's a real regulatory reason to do this now — the EU AI Act's transparency obligations became applicable on 2 August 2026, and they reach businesses that use AI, not only those that build it. But run the audit even if you're confident it doesn't apply to you. The list you produce is the same list either way, and the regulation is a deadline rather than a reason.
Not legal advice — scope depends on where your users are and on facts this post doesn't know.
Three things, in this order, and the order matters.
Fix the free ones first. Any surface where the answer to question three is a single sentence, do it now, while the list is open. Greeting lines, image captions, a line in your email footer. In most audits this clears more than half the rows in under fifteen minutes.
Batch the rest into one job. Everything left needs the same raw material — a statement of what you use AI for, what a human still does, and what you never feed it. That's tomorrow's post: the three sentences you write once and paste everywhere. Write them once, then walk your list.
Diarise the re-run. Quarterly, fifteen minutes. New surfaces appear every time you try a tool, and the audit's value is entirely in it being repeated — a one-off audit tells you about February, not about now.
Then keep the list. It becomes the source material for your policy page, it answers the "do you use AI?" question in a tender without a scramble, and it means the next time something changes you're editing a document rather than starting one. That's the same reason a decision log beats a good memory: the artefact outlives the afternoon that produced it.
Twenty minutes. Four surfaces. Three questions. Do it before you write anything.
For the checklists we use to run this — free, 5-min read: 7 AI Prompts That Run a One-Person Business.
Related Decodes
AI the Brief (@aithebrief) — AI advice you can act on and trust, for time-starved founders.
TL;DR: Before writing any AI disclosure, spend twenty minutes listing where your business already speaks with AI's voice — chatbots, auto-replies and DM automations; generated images, video and audio; client-facing drafts AI helped write; and your about, policy and bio pages. Most founders name the first two and forget the last two, which is where trust is actually won or lost. Ask three questions of each surface: would a client be surprised, would they hear it from you or from someone else, and what single sentence fixes it. Fix every one-sentence gap immediately, batch the rest into one job using a written three-sentence disclosure, and diarise a quarterly fifteen-minute re-run — because new AI surfaces accumulate the way subscriptions do, one at a time, none reviewed.
