BUSINESSES are being warned employees may be using artificial intelligence tools outside their control, exposing commercially sensitive information and creating a growing ‘shadow AI’ risk.
The technology is used by millions of workers in the UK each day, and many have used it to change and improve how they live and work.
However, the breakneck speed of advancements and adoption of AI has left some small and medium enterprises (SMEs) at risk of failing to integrate and govern them properly.
And it could lead to serious security, financial and reputation risks if plans are not put in place urgently, according to an expert.
Neil Bayliss, director of Birmingham-based IT consultancy Hubtel IT, said:
“The biggest risk is not AI itself, but that businesses are allowing AI tools to be used without clear policies, security controls or accountability.
“AI can help SMEs improve productivity, streamline processes and give employees better tools. But adoption is moving faster than many organisations can govern it, and leaders may not have a complete view of how AI is already being used across their business.
“That creates practical risks. Sensitive information can be entered into unapproved platforms, AI-generated work can be accepted without proper checks, and nobody may be clearly responsible when an output is wrong.
“Every business should define which AI tools are approved, what data can be used, how outputs must be checked and who remains accountable for decisions.”
How widespread is AI usage?
New figures from the Office for National Statistics show that 55% of employees report using AI for work or education, while only 35% of businesses with 10 or more employees report using at least one AI technology.
The latest ONS analysis also shows that the proportion of UK businesses with 10 or more employees using at least one AI technology has risen from around 12% in late 2023 to around 35% in June 2026.
The data suggests some AI use may be informal or taking place without full organisational visibility, according to the ONS.
Large language models are the most widely used AI technology among these businesses. Improving business operations is the most commonly reported purpose, reinforcing the potential for AI to support productivity when it is introduced with clear business objectives and appropriate controls.
For small and medium-sized enterprises, this can make it harder to understand which tools are being used, what information is being shared and who is accountable for the output.
Employees may, for example, upload customer details, financial information or internal documents to public AI platforms, rely on inaccurate AI-generated content, or use unapproved tools without understanding how business data is stored and processed.
Who is responsible for AI governance?
Mr Bayliss said AI governance should not sit solely with an IT department, because the people who understand the work are best placed to identify where the technology can deliver genuine value.
He added:
“Business owners and operational teams need to lead on where AI should be used and what outcomes it should support. Technology teams must lead on governance, security and the secure integration of business data.
“That shared responsibility helps organisations move beyond experimenting with AI and introduce it in a controlled way that supports employees, protects information and delivers a measurable return.
“AI is no longer a novelty. It is already part of day-to-day work, whether every business has formally approved it or not. Leaders need to close that governance gap now rather than waiting for a data breach, costly error or customer complaint to expose it.”
Hubtel IT is a leading IT support provider in Birmingham, delivering services such as cyber security solutions, hosted telephony and managed print to SMEs, schools and charities.
