AI adoption has accelerated significantly since ChatGPT became widely available to the public in 2022 with 54% of UK firms now actively using AI, up from 35% in 2025,as businesses of all sizes look for ways to improve efficiency, streamline processes, and reduce costs.
However, the introduction of new tools and ways of working also brings a new set of risks. For SMEs, which often have fewer resources and personnel dedicated to managing these risks than larger organisations, this could leave businesses exposed to potential data, security, copyright and reputational issues.
Rob Rees, Divisional Director at Markel Direct, small business insurance specialists, highlights why SMEs should consider whether an AI policy or guidance would beappropriate for their business, even if AI is not formally adopted within the organisation.
Why does an SME need an AI policy
1. Your employees could already be using AI
Even if your business is not currently incorporating AI into its workflows or technology stack, that does not necessarily mean your employees are not already using it.
“Shadow AI” is a term used to refer to the unauthorised use of AI tools, applications or features by employees without the knowledge, approval or oversight of the business.
Employees may be turning to free and easily accessible tools such as ChatGPT and Claude to help them complete tasks more efficiently, such as drafting content, summarising meeting transcripts, data analysis or simply supporting their day-to-day work.
While this can improve efficiency, it can also introduce risks if employees are entering confidential business information, customer data or other sensitive material into AI tools without understanding how that information may be handled, stored or used.
2. AI can create a data protection headache
One of the biggest risks associated with the use of AI is what happens to the information employees enter into these tools. Personal data, customer information, confidential business details and financial information can all be highly sensitive, and employees may not always understand how an AI platform handles the information they submit.
Before using an AI tool, businesses should understand how data is processed, stored and used by the provider, as well as whether information entered into the platform could be retained or used to improve its services.
Some AI providers may use information entered into their platforms to improve or train their models, although practices vary between providers and products. Businesses should review the provider’s terms, privacy notices and data handling arrangements before use.
It is important that business owners set clear boundaries around data use when it comes to AI, and these should complement, rather than replace, existing GDPR, data protection and information security policies; think of this as an extension to the way your business handles other data.
Additionally, businesses should ensure any use of customer data within AI systems complies with UK data protection requirements, including identifying an appropriate lawful basis for processing, meeting transparency obligations, and understanding how any third-party AI provider handles that data.
3. What happens when AI gets something wrong?
Just as Wikipedia should not be relied on as a source of absolute truth due to its open editing feature, neither should AI. AI can generate responses that appear convincing and authoritative but may contain inaccuracies or fabricated information.
This makes human oversight over AI’s outputs particularly important when used within a business. The UK Jurisdiction Taskforce has highlighted that professionals remain responsible for exercising reasonable care and skill in their use of AI – including checking the accuracy of AI tool’s outputs before relying on them.
Any AI-generated information or sourced data should be reviewed and fact-checked before it is relied upon, particularly when it is being used for customer-facing content, business decisions or professional advice.
It is important to consider that an incorrect AI-generated statement could mislead customers, damage a business’ reputation or result in poor decisions being made.These checks are essential for maintaining credibility and trust, and protecting your business against allegations of professional negligence.
It is important to remember that businesses should ensure clear accountability for reviewing, approving and using AI-generated outputs.
4. Intellectual property and copyright risks
A mistake many people make when using AI is assuming that AI-generated content is free to use and without copyright or intellectual property risks, because it was made for them.
However, as AI draws from existing materials that exist on the internet, there may be circumstances where AI-generated content reproduces or closely resembles protected material, potentially creating intellectual property or copyright risks.
Employees may also inadvertently expose the business to risk by uploading the company’s own intellectual property, such as proprietary information, original content or commercially sensitive material, into an AI platform, potentially leading others to use the brand’s intellectual property within AI-generated materials.
What should an SME AI policy cover?
An SME AI policy should establish:
- Approved AI tools: Outline which platforms employees can use.
- Permitted uses: Make clear what tasks AI can and cannot be used for.
- Data protection: Have a robust list of what information must never be entered into AI tools.
- Human oversight: Establish when AI-generated outputs must be checked and by who.
- Accountability: Make obvious who is responsible for the final work.
- Copyright and IP: Lay out how AI-generated content should be reviewed.
- Incident reporting: Have a process in place which details what employees should do if sensitive information is accidentally shared
