A business owner who hasn’t written an AI policy usually assumes that means AI isn’t really part of the business yet. That assumption is almost always wrong. It just means nobody has looked.
Recent workforce research puts a number on this. WalkMe’s 2025 State of Digital Adoption survey of more than 3,500 knowledge workers found that 78 percent of employees use AI tools that their IT department has never approved (source: Digital Chiefs summary of the WalkMe survey). The same research found that 46 percent of employees would keep using AI tools even if the business explicitly told them to stop.
Those figures come from larger organisations, but there is no reason to assume a five or ten person business is meaningfully different. If anything, a small team with no IT department and no formal software approval process has fewer barriers in the way, not more.
What “shadow AI” actually looks like in a small business
The term for this is shadow AI, using AI tools at work without the business knowing or approving it, and it rarely looks like anything dramatic. It looks like an admin assistant pasting a client email into ChatGPT to draft a reply faster. A tradesperson using an AI app to write up a quote. A bookkeeper asking an AI tool to summarise a spreadsheet. None of it feels like a policy violation, because in most small businesses there is no policy to violate.
That is precisely the gap. Staff are not doing anything malicious. They are solving a real problem, faster work, in the fastest way available to them. The business just has no visibility into what information went into that AI tool, what the tool did with it, or whether the output was accurate before it reached a client.
Why this is a genuine business risk, not just a technicality
- Confidential information leaves the building. Client details, financial figures, or supplier terms typed into a free AI tool may be stored or used to train that tool’s models, depending on its terms of service, which almost nobody reads before using it.
- Nobody checks the output. AI tools produce confident, well-written answers that are sometimes simply wrong. Without a review step, an error can go straight into a client-facing document.
- There is no record of what happened. If a client later disputes something in a quote, a report, or an email, and part of it came from an AI tool nobody knew was being used, there is no way to reconstruct what actually occurred.
- The business can’t manage what it can’t see. Even a business owner who is completely comfortable with staff using AI cannot set sensible boundaries, like which tools are fine and which information should never be entered, if they don’t know AI is being used in the first place.
The fix is not banning AI. It’s making the usage visible
The instinct some businesses have is to ban AI tools outright once they realise how widely they’re already being used. That rarely works, and the 46 percent figure above is a good illustration of why: a rule staff will quietly ignore is worse than no rule, because it creates the appearance of control without the reality of it.
A workable approach starts smaller. Ask staff directly what AI tools they are already using and for what. Decide, in writing, what information should never be typed into a public AI tool, client names and financial details are a reasonable starting line for most small businesses. Name one or two approved tools rather than leaving the choice open ended. None of this requires a formal ISO 42001 AI management system to start, though it is exactly the groundwork that standard eventually asks for.
The bottom line
If your business doesn’t have an AI policy, the honest starting assumption should not be “we don’t really use AI yet.” It should be “we don’t know what’s already happening.” Closing that gap starts with a conversation, not a document, find out what staff are already doing, then write down the handful of rules that actually matter.
