THE ADVISORY · ISSUE 04 · 19 OCTOBER 2026

AI Moves into Everyday Business

Four developments on SME spending, CRM skills, agent data and connected tasks.

Torn-paper collage connecting small-business costs, an AI assistant, customer records and data protection

AI spending is rising among small firms

Capital on Tap's Q3 2026 spending report, published on 12 October, found that 14.5% of the small businesses in its card data paid directly for an AI tool between July and September. A year earlier, the figure was 8.0%. AI remains a small share of total card spending in the report, at 0.22%, but the share has grown quickly.

The figures are based on anonymised, aggregated purchases made with Capital on Tap business cards. They are not a count of every UK small business. The report says it counts direct payments to listed AI providers and excludes free plans, app-store subscriptions and invoiced contracts. The true number of firms using or paying for AI may therefore be different.

For an SME, the useful takeaway is not that every business should buy an AI subscription. It is that AI is becoming a recurring cost worth managing like any other software. A quick review can reveal multiple accounts, overlapping tools or charges that no one owns.

What to do now

List every AI tool the business pays for, including app-store and invoice payments. Record the owner, monthly cost and the work it supports. Keep the subscription only when the result is worth the cost.

Primary source · Capital on Tap, Spend Trends On Tap: July to September 2026 →

Microsoft adds 30 CRM skills to Copilot

On 8 October, Microsoft announced that 30 pre-built Dynamics 365 skills for Copilot Cowork are generally available. The examples include reviewing a sales opportunity, triaging a customer service case, researching an answer from verified material and preparing a customer reply. The skills bring selected CRM context into supported Copilot experiences so teams can work on customer tasks without starting each step from a blank prompt.

This is not a free-standing feature for every business. It depends on compatible Microsoft products, licensing, an administrator enabling the relevant tools, account connections and the organisation's policies. Microsoft also distinguishes between a suggested action and a completed one. For example, preparing a customer reply does not mean the message has been sent, and suggesting a CRM change does not mean the record has been changed.

Small teams already using Dynamics 365 may be able to try a narrow workflow without building a custom agent. The important question is which records the skill can access and whether it can change them. A drafting task is a safer starting point than allowing an AI to send customer messages or update records without review.

What to do now

Ask your Microsoft administrator which CRM skills are available under your current licences. Test one task on a low-risk case and have a team member verify the facts before anything is sent or saved.

Primary source · Microsoft, Bring Microsoft Dynamics 365 into the flow of work with 30 new CRM skills →

The ICO is asking how organisations manage AI agent data risks

On 8 October, the Information Commissioner's Office reported that ten leading AI developers had made, or committed to make, changes after regulatory scrutiny. The changes include clearer information about how data is used, stronger ways for people to exercise their rights and tougher assessments of safeguards. The ICO also opened a six-week call for evidence on the data protection risks of agentic AI. Responses are due by 20 November 2026.

The call is about how AI agents may use personal information while completing tasks, using tools and interacting with websites. The ICO is gathering evidence to inform its future guidance. This announcement does not create a new legal duty for SMEs. It does signal that businesses should be able to explain what their AI tools can access and what they can do with personal data once they are in use.

An AI assistant that can read a customer folder, draft a reply and update a CRM has a different risk profile from a chatbot that only answers general questions. Access limits, approval points and records of what happened make it easier to catch mistakes and answer customer or regulator questions later.

What to do now

For each AI tool connected to a business account, record the data it can see, actions it can take, human approval required and activity log available. Remove access the workflow does not need.

Primary source · ICO, ICO secures changes from leading AI developers as scrutiny extends to AI agents →

Google brings Gemini 4 Argon to connected tasks

On 13 October, Google announced Gemini 4 Argon in the Gemini app. Google says it is designed for complex tasks with several steps and can work with more than 40 connected apps, including Shopify. Google says access in the app is available to Google AI Pro and Ultra subscribers.

The practical change is that AI assistants are being designed to do more than produce a block of text. When a model can work across connected apps, a request may involve reading information from one service and preparing or carrying out a task in another. That can reduce switching between tools, but only where the account, app connection and permissions support the job.

Google's announcement does not confirm that every connected app or task is available to every user or business account. Nor does it mean an SME should connect business systems before checking what information the model can read and which actions it can perform. Start with an isolated task and keep a person in control of any external message, purchase or record change.

### The operating view

AI is becoming both a regular business cost and a route into the systems a team already uses. Before adding a tool, check what you already pay for, what information it can see and what actions it can take. A small, measured trial is more useful than connecting everything at once.

### Source 1: Capital on Tap, 12 October 2026

[Spend Trends On Tap: July to September 2026](https://www.capitalontap.com/en/blog/posts/spend-trends-on-tap-q3-2026/)

The report says 14.5% of its small-business cardholder sample paid directly for AI tools in Q3 2026, compared with 8.0% in Q3 2025. It describes anonymised and aggregated purchases by UK businesses using Capital on Tap cards. Its own methodology says it excludes free use, app-store subscriptions and invoiced contracts.

### Source 2: Microsoft, 8 October 2026

[Bring Microsoft Dynamics 365 into the flow of work with 30 new CRM skills](https://www.microsoft.com/en-us/dynamics-365/blog/it-professional/2026/10/08/bring-microsoft-dynamics-365-into-the-flow-of-work-with-30-new-crm-skills/)

Microsoft says 30 pre-built skills for Copilot Cowork are generally available. Its examples include sales opportunity analysis, service case triage, customer response drafting and consent-aware marketing work. Access remains subject to product licensing, account setup, administrator configuration and organisational policies.

### Source 3: Information Commissioner's Office, 8 October 2026

[ICO secures changes from leading AI developers as scrutiny extends to AI agents](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/)

The ICO says ten developers made or committed to changes including clearer transparency information, stronger ways for people to exercise their rights and tougher safeguards assessments. Its agentic AI call for evidence closes on 20 November 2026. The issue describes this as regulatory direction, not a new SME legal requirement.

### Source 4: Google, 13 October 2026

[Gemini 4 Argon is now available in the Gemini app](https://blog.google/innovation-and-ai/products/gemini-app/gemini-4-argon-availability/)

Google describes Argon as a model for complex, longer tasks and says Gemini can connect with more than 40 apps, including Shopify. Its announcement says Gemini 4 Argon access in the app is available to Google AI Pro and Ultra subscribers.

What to do now

If your account has access, test one low-risk task with non-sensitive information. Review the permissions for each connected app and confirm the expected result before using real customer or financial data.

Primary source · Google, Gemini 4 Argon is now available in the Gemini app →

Use AI with a clear purpose.

Choose a real business task, check the information and permissions, and keep a person in control of important actions.

Browse every Advisory edition