Nearly a third of UK businesses were using at least one AI tool as of last month, and the average small business now runs a median of five — built up tool by tool rather than through any single planned rollout. That pace of informal adoption is exactly why AI governance failures are becoming one of the most common — and most avoidable — risks UK SMEs are carrying right now. The mistakes aren’t exotic. They’re mundane, they’re already happening inside most small businesses, and they rarely get noticed until something goes wrong.

The AI you don’t know is being used

The most significant governance gap isn’t the AI a business has knowingly deployed — it’s “shadow AI,” the tools employees adopt on their own because they’re useful, free, and a click away. Staff paste customer details into ChatGPT to help draft a reply. A marketing assistant runs meeting notes through an AI summariser that stores everything on a third-party server. Someone tries an AI image generator for a client pitch without asking whether the output can legally be used commercially. None of this is malicious — it’s just normal, unsupervised tool adoption, and it’s how personal data ends up processed by external AI providers with no consent, security review, or contract in place. If UK GDPR applies to the personal data in question, and it usually does, that’s a compliance gap most business owners don’t know exists until an audit or a complaint surfaces it.

Unreviewed AI output creates risk that’s easy to underestimate until a court weighs in. When Air Canada’s customer service chatbot gave a passenger incorrect information about a bereavement fare refund, the airline argued in tribunal that the chatbot was effectively a separate entity it wasn’t responsible for. The tribunal rejected that outright and held the company liable for what its own chatbot had told the customer. That’s the pattern worth internalising: an AI tool speaking on behalf of your business, whether it’s a chatbot, an automated email reply, or a report an employee didn’t double-check, carries the same liability as if a member of staff had said it. Treating AI output as provisional rather than final — something a human reviews before it reaches a customer, a contract, or a regulator — is the difference between a useful tool and an unmanaged liability.

Building governance without a governance team

Most SMEs don’t have — and don’t need — a dedicated AI governance function. What closes most of this gap is far simpler: a short, plain-English policy on which AI tools are approved and what data can and can’t go into them, given to every member of staff, not buried in a handbook nobody reads. Pair that with a basic rule that any AI-generated content facing a customer, a supplier, or a regulator gets a human check before it goes out. Smallprint offers ready-to-adapt policy templates that make putting a basic AI-use policy in place a same-week job rather than a legal-drafting project. For businesses looking to move beyond ad hoc tool use toward AI that’s actually chosen and governed on purpose, ApplyAI works specifically with UK SMEs to work out which tools are worth adopting formally — and which unmanaged habits are worth shutting down first.

The takeaway

The AI risk sitting inside most UK small businesses today isn’t a dramatic new threat — it’s the accumulation of small, unreviewed habits: tools nobody approved, outputs nobody checked, data going somewhere nobody tracked. A short written policy and a human-review habit close most of that gap immediately, and doing it now is considerably cheaper than doing it after a mistake reaches a customer or a regulator.