From 100 AI Prompts to a Governed AI Operating Model

Prompt libraries are everywhere. Lists of “100 AI prompts for work” promise quick wins, faster output and instant transformation.

What most organisations see instead is something more familiar:

• fragments of prompts saved across tools and teams
• no clear owner for any AI activity
• growing risk around data, brand and compliance

HubSpot’s Using ChatGPT at Work – with its 100 AI work prompts – is one of the better known examples. It is practical and grounded in real tasks, and a useful starting point for experimentation (Source: HubSpot).

The challenge is not the prompts themselves. The challenge is what happens when those prompts meet real systems, real customers and real regulation.

This guide does not add more prompts. Instead, it reframes HubSpot’s existing list as a leadership and governance problem:

• Which prompts create material business value
• Who owns the outcome
• What role AI should play – Assist, Co‑pilot or Agent
• Which guardrails are non‑negotiable

The goal is simple – help leaders move from using AI to operating with AI.

Why prompt libraries are a leadership problem

There is a common assumption:

“If we give people better prompts, we get better AI outcomes.”

In practice, unmanaged prompt libraries tend to create three problems.

1. Fragmentation
Teams adapt prompts locally. Versions spread across documents, chats and tools. There is no agreed standard, no shared learning and no single source of truth.

2. Unmanaged value
Some prompts support high‑value work such as pricing, retention or compliance. Others help with local productivity. Without a way to rate and compare impact, leadership has no of where AI is actually helping the business.

3. Rising risk
Prompts start to touch customer data, pricing rules, sensitive topics and regulated content. If nobody owns those prompts, nobody owns the risk.

At that point, AI is no longer a creativity exercise. It is an operating model decision – one that belongs with leadership.

From prompt lists to operating model decisions

Rather than treating prompts as tips, this guide treats each prompt as a small operating model decision.

For every HubSpot prompt, we ask four questions:

1. Business priority – How much commercial value does this activity create when it is done well
2. Typical owner – Which function should be accountable for the outcome, not just the prompt text
3. AI role – Should AI Assist, act as a Co‑pilot preparing work for approval, or operate as an Agent within strict limits
4. Governance guidance – What needs to be controlled for this to be safe and compliant

Those questions are reflected in the columns you will see in every table.

Taken together, they help leadership:

• map prompts to revenue, cost or risk outcomes
• assign clear ownership for each category of work
• decide where AI can automate work and where humans must stay firmly in control
• design controls that align with UK GDPR, sector rules and internal policy (Source: ICO)

How to use this guide

If you are already seeing AI experiments across marketing, sales, operations or support, use this as a decision tool, not a tutorial.

1. Start with High value prompts in the categories that move your revenue, cost, risk or customer metrics.
2. Keep early usage at Assist or Co‑pilot. Treat Agent‑style automation as a separate, later decision once controls are in place.
3. Introduce automation only when ownership, access and are defined. That includes data permissions, sign‑off rules and audit trails.

It is better to act on a small subset of prompts with clear accountability than to distribute all 100 with no operating model behind them.

1. Revenue, marketing and growth

Why this category matters

These prompts touch demand generation, sales performance and campaign optimisation. They are closest to measurable revenue, but they also carry brand, compliance and spend risk.

Used well, they can shorten time‑to‑value. Used without controls, they can introduce unapproved claims, poor targeting and budget drift.

High value

These prompts have direct impact on pipeline, conversion or retention.

Medium value

These prompts support ongoing marketing execution. They are valuable but slightly further from core revenue decisions.

Low value (still useful)

These prompts are tactically useful but should not dominate leadership time.

Leadership takeaway – Start by agreeing which revenue prompts deserve board‑level attention, and which should live as team productivity aids with local governance.

2. Customer experience and support

Why this category matters

Customer‑facing work is rich territory for AI drafting, summarisation and triage. It can reduce response times and give teams better starting points.

The risk is accuracy, tone and escalation. A small error in a billing response can have outsized impact on trust.

High value

Medium value

Leadership takeaway – Decide where AI can safely front‑load support work, and where human responsibility for decisions and escalations must remain explicit.

3. Operations, process and productivity

Why this category matters

Operations prompts focus on planning, reporting and internal coordination. They often touch internal data and workflows with relatively low external risk, which makes them good candidates for early Co‑pilot use.

High value

Medium value

Leadership takeaway – Treat these prompts as design inputs for your internal operating system, and set clear expectations about data quality, ownership and approval.

4. Meetings, communication and collaboration

Why this category matters

These prompts improve how teams plan, communicate and use meeting time. They rarely justify heavy governance on their own but can free capacity for higher‑value work.

Medium value

Low value

Leadership takeaway – Encourage teams to use these prompts for efficiency, while keeping strategic focus on the prompts that move revenue, risk or experience.

5. People, HR and culture

Why this category matters

HR and people prompts can be powerful and sensitive. They influence culture, fairness and how people feel at work.

AI can help design programmes and communications, but humans must own decisions, especially where appraisal, promotion or sensitive topics are involved.

Medium value

Low value

Leadership takeaway – Treat AI as a drafting partner for HR, never as the decision‑maker where people’s careers or wellbeing are affected.

6. Technology, data and systems

Why this category matters

Technology prompts often touch systems of record such as CRM and websites. They bring questions about permissions, security and integration.

In UK SMEs, this is also where UK GDPR and the UK’s evolving data protection regime bite hardest, as AI tools frequently process personal data drawn from these systems (Source: ICO).

High value

Medium value

Leadership takeaway – Make sure prompts that touch CRM and web platforms sit inside a clear integration and security strategy, not in isolated experiments.

7. Personal productivity and admin

Why this category matters

These prompts are low risk and highly adoptable. They are excellent entry points for teams learning to work with AI.

They should be encouraged, but not confused with strategic adoption.

Low value

Leadership takeaway – Encourage these prompts as part of enablement, while staying focused on the higher‑value prompts above when you measure ROI.

Deciding between Assist, Co‑pilot and Agent

The AI Role column is a practical way to express risk appetite and control.

A simple decision pattern:

• Assist – AI drafts or suggests; a human always completes and submits. Best for early adoption or high‑risk areas.
• Co‑pilot – AI prepares work to a defined standard; a human approves and sends. Useful for campaigns, reporting or triage where speed matters but accountability stays human.
• Agent – AI executes actions within strict limits, often via integrations or workflows. Reserved for mature use cases with strong controls, clear rollback paths and monitoring.

To decide which role fits a prompt, test it against five questions:

1. Impact if wrong – If the AI output is wrong, what happens to revenue, customers or compliance
2. Data sensitivity – Does this touch personal data, special category data or regulated content
3. Reversibility – Can you easily undo the action
4. Regulatory lens – Would this trigger additional obligations under UK GDPR, sector rules or the emerging Data (Use and Access) Act 2025 (Source: UK Parliament)
5. Maturity – Do you already have standards, training and monitoring in place for this activity

If in doubt, default to Assist, move to Co‑pilot once you have evidence and only consider Agent once governance is tested and documented.

What governance controls UK SMEs need around AI

For UK SMEs, AI prompts are now squarely in scope for data protection and governance. The ICO’s guidance on AI and data protection sets clear expectations around accountability, transparency, data minimisation and fairness (Source: ICO).

At minimum, leadership should ensure that:

• Use cases are documented – Record what AI is used for, which systems it touches and which prompts are in regular use.
• Owners are named – Every category above has a clear functional owner with authority to change or withdraw prompts.
• Data protection is designed in – For prompts touching personal data, complete or update Data Protection Impact Assessments and records of processing.
• Data minimisation is applied – Prompts are written to share the minimum data required to complete a task, especially for CRM and support use cases.
• Human is defined – For Co‑pilot and Agent roles, decision points and approvals are explicit, recorded and trained.
• Access and identity are controlled – AI tools that connect to CRM, email or other systems use proper authentication, role‑based access and logging.
• Audit trails exist – Key prompts and outputs that affect customers, pricing or compliance are logged and can be reconstructed if challenged.
• Policies match practice – AI policies, staff training and contracts with suppliers are aligned with real usage.

The ICO’s consultation work on generative AI makes clear that regulators expect organisations to reassess governance and risk management once AI starts to affect how data is used at scale (Source: ICO).

Prompt libraries are a visible part of that reassessment.

Next step

Get a quick of your organisation’s AI maturity and recommended next steps.

• Your firm’s AI maturity level
• Instant personalised results
• Clear next steps for your organisation
• How you compare to similar organisations

Growcreate’s wider AI consultancy practice helps SMEs that roadmap into governed adoption – with services for AI strategy, marketing and visibility designed around measurable outcomes and compliance (Source: Growcreate).