AI security checklist for small organisations.

Who this checklist is for

It is written for organisations that use third-party AI tools and may build small features such as a chatbot or document search. It is not meant for frontier model developers, and it is not a certification or an audit.

Step 0. Govern

In the NIST AI RMF, Govern builds a risk-management culture, policies and accountability across the system's lifecycle ². The UK Code of Practice asks, among other things, for awareness, human responsibility, and identifying, tracking and protecting assets (principles 1, 4 and 5) ⁴.

1. 1Make an inventory of the AI tools you use and give each one an owner.
2. 2Write a one-page acceptable-use policy: what may and may not go into AI tools.

The checklist, by risk

Each item maps to one risk in the OWASP LLM Top 10 (2025 edition) ¹.

1. 1Untrusted content (LLM01, prompt injection). Web pages, files and emails the model reads can carry hidden instructions. Treat them as untrusted, separate and label them, and do not let them alone trigger a privileged action ^{5 3}.
2. 2Data going in (LLM02, sensitive information disclosure). Do not paste secrets, personal or confidential data into public tools. Ask the provider for retention and deletion rules, and scrub data before use ^{6 4}.
3. 3Vendors and models (LLM03, supply chain). Vet suppliers, verify model provenance with signatures or hashes, apply patches and keep a list of components ^{7 4 3}.
4. 4Training and retrieval data (LLM04, data and model poisoning). Track where data comes from and how it changes, vet data vendors, and sandbox unverified sources ^{8 13}.
5. 5Output handling (LLM05). Treat model output as untrusted: validate and encode it before other systems use it ⁹.
6. 6Agency (LLM06, excessive agency). Give the minimum tools and the minimum permissions, and require human approval for high-impact actions. See the guide “Agentic AI: least privilege and human approval” ¹⁰.
7. 7Wrong answers (LLM09, misinformation). Require a human check for high-stakes output. Ground answers in trusted sources and tell users the tool's limits ^{11 3}.
8. 8Runaway use (LLM10, unbounded consumption). Set rate limits and quotas, monitor usage and use timeouts ^{12 4}.

Frameworks as a lens

• The NIST AI RMF has four functions: Govern, Map (context and risks), Measure (assess and track) and Manage (prioritise, respond, communicate) ². Its Generative AI Profile lists 12 risks that can serve as headings for a risk register ³.
• The UK Code of Practice: monitor system behaviour (principle 12), updates (11), communication with end users (10), disposal (13) ⁴.
• For hardening externally developed AI systems, see the CISA and NSA joint guidance “Deploying AI Systems Securely” ¹⁴.

If something goes wrong

1. 1Decide in advance who can switch the tool off, where the logs are, who contacts the vendor and who contacts CERT-UA ¹⁵.
2. 2Treat a prompt-injection or data-leak incident as a security incident and preserve the logs.

Limits