Most SMB Employees Are Using AI. Has Governance Caught Up?

BIZTECH: Although plenty of small business employees are using AI regularly, most SMBs have no formal policies in place. What do you think is driving that governance disconnect, and why haven't more SMBs caught up? 

BUZZELLI: AI’s evolution has been so rapid that, for a lot of small businesses, the potential use cases and value there really encouraged experimentation. Small businesses are nimble; they can often move more quickly when introducing new technologies and systems. For owners who are managing many roles, the appeal and potential impact of AI are significant. The perceived value showed up before the structure did, which is normal for technology adoption in this segment. 

When a small business brings in new software, there's typically a step built into the process where someone has to ask who's going to use it and for what purpose, whether you're signing a contract, paying for seats or setting up accounts. The policy conversation tends to happen because the purchase requires it. AI came in differently. It was immediately accessible and ripe for experimentation. 

READ MORE: Email security evolves as AI assistants proliferate.

The other factor is that for small businesses that tend to operate without a dedicated HR department, writing policy can often happen in response to something, such as an incident, an insurance requirement or a client contract that asks how you handle data. Some small businesses may not have hit that trigger with AI yet, so governance might be sitting below other pressing operational needs that need attention in a given week. 

The reality is, though, that while AI can transform work, it doesn’t eliminate the need to manage it. Setting up a sound governance structure can help small businesses navigate the increased compliance and workforce complexities that come with AI use.

BIZTECH: You've worked with SMBs for over two decades. What separates the SMBs that are baking AI governance into their operations early from those that are letting adoption run ahead of oversight? 

BUZZELLI: For the past 20 years, new software has often reached a small business through a purchase, and that purchase has started the conversation about who uses it and how. AI is the first technology I've seen at this scale that employees and businesses started to leverage without someone necessarily making the decision to bring it in. The businesses that are ahead aren't the ones with better technology instincts. They're usually the ones who decided early what they wanted AI to do for them, and that clarity has turned into a real advantage. 

Some early adopters may have faced a moment in the past that made the risk real of not having a sound governance structure. A small business sold into a larger company may have received a vendor security questionnaire. Or a business operating in a regulated industry may have experienced a breach or a compliance issue that was expensive enough that data handling stopped being theoretical. With AI, small businesses can unknowingly scale that risk, so it’s important to ask questions about your data and how your team is leveraging it to set up clear expectations and guidelines from the start.

BIZTECH: Can you walk us through what shadow AI looks like for SMBs? How does unsanctioned AI use typically start, and what are the data exposure risks that SMBs don't see coming until it's too late? 

BUZZELLI: Shadow AI generally looks like people doing their jobs — it's office managers whose rosters exported badly, so they paste it somewhere to fix the formatting. It's someone building a schedule template who tests it with real names and hours because test data wouldn't tell them whether it works. In each case, the tool did what was asked, and the person's day got easier. That's how it starts, and it's also how it grows. Someone mentions that it worked well, a few coworkers try it, and within a month, you may have several people using several different unapproved tools. 

What accumulates underneath is a set of accounts the business doesn't administer and can't oversee, holding employee information, customer records and contract terms. If that office manager leaves, the account leaves too, along with everything that ever went into it. 

DISCOVER: Mobile API security is under scrutiny amid the rise of agentic AI.

Where this usually becomes visible is when someone outside asks a question, whether that's a larger customer sending a vendor review before renewing, a contract with a clause about where customer data can be processed, or an insurer asking about AI use. The owner might find they can't describe what's happening because the activity was never visible. But it’s a much harder task writing the policy in that moment than six months earlier, when you could establish a clear structure around how you’d leverage AI within your business. 

BIZTECH: What does a realistic, rightsized AI governance framework look like for an SMB that doesn't have a dedicated IT or data team? 

BUZZELLI: For most small businesses, it should include a number of things. 

The first is which tools people are allowed to use. It’s important to consider the paid business version over a free tool because the terms governing your data are usually different, and you get some visibility into who's using it. 

The second is what information should never be fed to an external tool, meaning confidential information such as Social Security numbers, bank details and health information. A good rule of thumb is that if you wouldn't email something to someone outside your business, don't paste it into a public tool. 

EXPLORE: What should enterprises know about AI orchestration?

Third, ensure human review of anything that affects another person, such as pay, hiring and performance actions. The tool can help automate processes, but the human in charge signs off before decisions are made. 

And fourth, make it clear who people should go to with questions about AI use. In a small business, that's often the same person doing the reviewing, and frequently it's the owner. The point is that there's a name attached because sometimes, what goes wrong with AI use can stem from an employee who had a question, had nowhere to take it and made a reasonable guess.

Click the banner below to find more IT support for small businesses. 

This general framework can help small businesses establish a policy that’s comprehensive but simple enough for employees to understand and follow. It’s important, too, to review your policies at least every six months, so your framework keeps pace with the technology. 

BIZTECH: What's your practical advice for making the shift for SMBs from reactive to strategic on AI, without it becoming another thing on an already overwhelming to-do list? 

BUZZELLI: It’s important to find out what's already happening, because it's impossible to establish guidelines for something you can't see. 

Ask people what tools they're using and what they're using them to accomplish. Owners can be surprised in both directions because some of what's happening might carry more risk than they expected or uncover work they didn’t have context around. 

Next, decide which use cases are driving impact and put the structure in place to establish clear guidelines and manage compliance. Level-set with employees which tasks can and cannot be done with AI. From there, establish a process so that employees can bring new tools and use cases to you first for review before proceeding. It helps establish a foundation for continued innovation and experimentation, but within the right boundaries. 

It's also important to ask your current providers what they've built. It’s important to understand the oversight and controls your vendors have in place and what you can confidently leverage.