Your team is using AI. Who’s managing the risk?
The useful question is not simply whether your business uses AI. It is whether you know how it is being used, where the boundaries are and who remains responsible.
Three signals worth examining
- 17%: UK small businesses with 10–49 employees already using AI that reported a formal written AI policy. This is the size-specific finding in section 3.4 of the UK Business Data Survey 2026; fieldwork ran from October 2025 to January 2026. Policy absence alone does not establish unsafe practice.
- 71%: UK employees surveyed who said they had used unapproved consumer AI tools at work. Microsoft commissioned Censuswide to survey 2,003 employees in October 2025. The sample includes large employers and the public sector; it is not an SME-only estimate.
- 35%: employers reporting training and support for generative AI in the preceding 12 months, in CIPD’s analysis of its autumn 2025 employer survey. This does not mean everyone else had never provided training.
What those findings mean for a smaller business
Together, these findings justify asking about policy, unapproved use and staff preparation. They do not establish your incident probability, loss or compliance status. That requires looking at your organisation.
Start with three questions: what information enters these tools, which outputs are relied on, and who would notice and act if something went wrong?
Recognise the warning signs
- Leaders cannot name the tools being used across teams.
- Staff rely on personal accounts without an agreed process.
- Important outputs reach customers or decision-makers without a named checker.
- People cannot explain how to report a mistake or an accidental disclosure.
- Training is limited to prompting, without verification, boundaries or accountability.
Respond with six practical checks
Our GOOD TO GO checklist covers visible use, clear ownership, practical boundaries, human control, prepared people and ongoing review. For each one, look for evidence of what happens in practice.
Make readiness a planned piece of work
Set a realistic date, name an owner and agree the first actions. Our recommended summer 2027 target is a planning prompt, not a government deadline. Serious known exposure needs attention sooner.
The Review from £5,000 gives you a structured assessment and action plan. Implementation and staff training follow through Governance where needed.