Small businesses are not waiting for permission to use AI. They are already using it—to draft marketing copy, answer customer questions, analyze sales data, take clinical notes, and write code. The question is no longer whether your business will adopt AI. It is whether you will govern it before it governs you.
That distinction matters, because adoption is running well ahead of oversight. Nearly 60% of small businesses now report using AI, and that number has more than doubled since 2023, according to the U.S. Chamber of Commerce. Yet in IBM's 2026 Cost of a Data Breach Report, 68% of breached organizations said they had no AI governance in place to manage AI or detect shadow AI. The gap between “we use AI” and “we manage how we use AI” is where the real risk lives.
This guide is written for that gap. It is meant for the founder, the practice administrator, the operations lead—the person who sees the value of AI clearly but does not have a compliance department, a CISO, or a spare quarter to figure this out. You do not need any of those things to govern AI well. You need a clear-eyed view of how you are actually using it, an honest read on the risks, and a right-sized set of guardrails. That is what follows.
It helps to start with what is really happening on the ground, because the enterprise conversation about AI often does not match the small business reality. Large corporations talk about custom model training and AI centers of excellence. A small business is usually doing something far more practical: getting more done with the same headcount.
The survey data bears this out. Across small businesses, the most common uses of AI are data analysis, content generation, customer engagement, and marketing automation. In one 2025 survey by Thryv, 62% of small and mid-sized businesses using AI applied it to data analysis, 55% to content generation, and 46% to customer engagement tools such as chatbots. The U.S. Chamber's research similarly points to customer engagement and inventory management as leading use cases, with adoption highest in technology, finance, media, education, and health.
What is striking is that small businesses are not simply trailing behind large enterprises—in some areas they are ahead. The SBA Office of Advocacy found that small firms are outpacing larger ones in uses like automated marketing, and they tend to view AI as a way to grow and add people rather than cut jobs. Most small business workers using AI do so to boost productivity, not to automate roles away.
A few grounded examples of what this looks like across sectors:
It is worth pausing on a real discrepancy in the data, because you will see very different figures depending on the source, and understanding why makes you a smarter consumer of AI claims.
Self-reported surveys put small business AI adoption between roughly 55% and 60%. The U.S. Census Bureau's Business Trends and Outlook Survey, which asks a narrower, more specific question about AI use in producing goods and services, put small business adoption at about 8.8% in 2025, according to the SBA Office of Advocacy's analysis. Both numbers are accurate; they are simply measuring different things. The high figures capture any use of AI, including an employee occasionally using a chatbot. The low figure captures deliberate, operational AI integrated into how the business produces its work.
The honest takeaway is that casual, ad hoc AI use is widespread, while formal, integrated adoption is still early. That is actually the most important fact for governance: most AI use in small businesses today is informal—which means it is largely ungoverned.
There is a tempting assumption that governance is an enterprise problem—that a ten-person company does not need policies. The opposite is closer to the truth. A large enterprise can absorb a mistake. A small business often cannot.
Consider the single biggest AI risk most small businesses face right now: shadow AI. This is the everyday reality of employees using AI tools—usually free, personal-account versions—without any approval, oversight, or guardrails. The scale is significant. Research has found that a large majority of employees paste data into generative AI prompts, and much of that activity happens through personal accounts outside any company oversight, even as most breached organizations still have no formal AI governance in place.
The consequences are measurable. IBM's 2026 Cost of a Data Breach Report found that shadow AI incidents more than doubled in a single year—from 20% to 43% of breached organizations—and that breaches involving shadow AI cost an average of $5.39 million. The same report found that 68% of breached organizations had no AI governance in place to manage AI or detect shadow AI, and that shadow AI incidents disproportionately exposed customers' personal information.
For a small business, a breach of that magnitude is not a line item—it can be an existential event. As our breakdown of the true cost of a breach makes clear, the exposure is not abstract: it is a staff member pasting a customer list, a patient record, a signed contract, or proprietary source code into a tool that may use that data to train its models, because no one gave them a safe, approved way to do their job.
This is the reframe that makes governance click: governance is not a brake on AI, it is what lets you step on the gas safely. A clear policy and a short list of approved tools do not slow your team down. They remove the paralysis and the guesswork, so people can use AI confidently without gambling with your data.
You do not need to be a security engineer to reason about AI risk. Most of it comes down to a handful of failure modes. The security community has done the work of cataloging these, and the most useful reference for anyone building or buying AI-powered tools is the OWASP Top 10 for Large Language Model Applications, updated for 2025. OWASP (the Open Worldwide Application Security Project) is a respected nonprofit that publishes widely used security standards. Here is what its LLM Top 10 covers, translated out of engineer-speak:
System prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption round out the list, covering everything from leaked configuration to the AI simply making things up.
That last one deserves a plain-language name of its own. NIST calls it confabulation—most people call it hallucination. It is when an AI produces confident, fluent, and completely wrong information. For a marketing email, that is embarrassing. For a medical summary, a legal document, or a financial calculation, it can be dangerous. Every governance program needs a human review step for exactly this reason.
Beyond the OWASP list, three business-level risks are worth naming explicitly: data privacy and regulatory exposure (especially where personal or health data is involved), intellectual property loss (your proprietary information becoming part of someone else's model), and bias, where an AI system produces unfair or discriminatory outcomes—a risk regulators are increasingly focused on.
The good news is that you do not have to invent your own approach. Two established, credible frameworks give you a ready-made structure, and both can be scaled down to a small business without a compliance team.
The National Institute of Standards and Technology publishes the AI Risk Management Framework (AI RMF), a voluntary, widely respected structure for managing AI risk. In July 2024, NIST released a companion specifically for generative AI: the Generative AI Profile (NIST AI 600-1), which identifies twelve risk areas unique to tools like ChatGPT—including data privacy, information security, confabulation, and intellectual property.
The framework is built on four plain-English functions that map neatly onto how a small business already thinks:
You do not need to implement the NIST AI RMF as a 200-page program. For a small business, it works best as a mental model: govern, map, measure, manage. Even auditors and cyber insurers are increasingly using it as a reference point for how well a business governs AI, so aligning with it has practical value beyond good hygiene.
Where NIST gives you the governance structure, the OWASP Top 10 for LLMs gives you the security checklist. Use NIST to decide how you make decisions about AI, and OWASP to pressure-test the specific tools you adopt. If you are evaluating an AI vendor, the OWASP list is a ready-made set of questions: How do you prevent prompt injection? How is sensitive data handled? What controls limit what the AI can do on its own?
Two other frameworks are worth knowing by name, even if most small businesses will not implement them directly yet. ISO/IEC 42001 is the international management-system standard for AI, useful if you already follow ISO 27001 for information security—you can extend those controls to cover AI. And the EU AI Act matters if you serve customers in Europe or build products used there, as it imposes obligations based on how risky an AI use case is. For now, these are context; NIST and OWASP are where a small business should start.
If your business touches protected health information—a medical or dental practice, a therapy group, a billing company, a health tech startup—AI governance is not optional, it is a compliance obligation. And the rules are tightening.
On January 6, 2025, the HHS Office for Civil Rights (OCR) issued a notice of proposed rulemaking to update the HIPAA Security Rule—the first significant overhaul in more than a decade. The proposal explicitly addresses emerging technologies, including AI. Under the direction it signals, organizations that use AI tools to create, receive, maintain, or transmit electronic protected health information (ePHI) would need to include those AI tools in their risk analysis and risk management activities, and list AI software that interacts with ePHI in their technology asset inventory—tracking and reviewing it like any other system that touches patient data. OCR has also issued guidance addressing AI-driven decision-support tools and the risk that they could produce discriminatory outcomes.
This is the same direction of travel we cover in our guide to the 2026 HIPAA Security Rule. The practical implications for a small practice adopting, say, an AI scribe or a patient-facing chatbot:
The tools themselves are worth adopting—the burnout and productivity benefits are well documented. But in healthcare, “we started using an AI tool” and “we did a risk assessment and signed a BAA first” need to happen in that second order.
Here is the part that turns all of this into action. You can stand up a credible AI governance program with a handful of steps. None of them require enterprise budgets.
1. Write a short, plain-language AI acceptable use policy. Keep it under three pages. State which tools are approved, what data must never be entered into AI tools, when human review is required, and who to ask when unsure. The single most important line in any such policy is simple: do not put sensitive or regulated information into unapproved AI tools.
2. Create an approved-tools list. Shadow AI thrives when employees have no sanctioned option. Give them one. A short list of vetted, appropriately licensed tools—ideally business or enterprise tiers that do not train on your data—removes most of the temptation to use risky personal accounts.
3. Classify your data. People cannot protect what they cannot categorize. A simple scheme—public, internal, confidential, regulated (PHI, PII, financial)—tells staff at a glance what can and cannot go into an AI tool.
4. Control access. Limit who can connect AI tools to sensitive systems, and never give an AI system the ability to take consequential actions without a human approving them. Missing controls like these are exactly what turn casual AI use into a costly breach.
5. Vet your vendors. Before adopting any AI tool, ask where data goes, whether it is used for training, what security certifications the vendor holds, and—where PHI is involved—whether they will sign a BAA.
6. Train your people. Most AI risk is human, not technical. Short, practical training on what shadow AI is, why it matters, and how to use the approved tools safely does more than any single piece of software. Extend your existing security awareness training to cover AI specifically.
7. Keep a human in the loop. For anything that matters—clinical notes, legal language, financial figures, public-facing content—a person reviews AI output before it is used. This is your defense against confabulation.
8. Map, then monitor. Know which AI tools are in use (map), and revisit periodically as tools and risks change (monitor). Governance is not a one-time document; it is a habit.
None of this needs to happen all at once. A business that does even the first three of these steps is dramatically better protected than one relying on hope.
Most small businesses do not fail at AI governance because they do not care. They fail because they do not have the time or the in-house expertise to translate frameworks like NIST and OWASP into something practical, and because AI adoption tends to happen bottom-up, one employee and one tool at a time, before anyone has drawn a policy around it. That is the gap our work is built to close. The scenarios below are illustrative of the kind of engagements we typically run—representative of the work rather than specific named clients.
AI risk assessment for a growing startup. A fast-moving software company had engineers using AI coding assistants and support staff running customer messages through a chatbot—all through personal accounts, with no oversight. An engagement like this typically starts by mapping every AI tool in use (the “map” function in NIST terms), classifying what data each one touches, and testing the highest-risk tools against the OWASP LLM Top 10. The deliverable is a prioritized risk picture and a short, workable acceptable-use policy with an approved-tools list—so the team keeps its speed without gambling with its own source code and customer data.
HIPAA-aligned AI rollout for a medical practice. A multi-provider clinic wanted to adopt an ambient AI scribe to cut documentation burden. Before the tool went live, an engagement like this focuses on the compliance path: confirming a Business Associate Agreement is in place, folding the AI tool into the practice's HIPAA risk analysis and technology asset inventory in line with the 2025 OCR direction, applying minimum-necessary access, and setting a clinician-review step so no AI-drafted note enters a record unchecked. The practice gets the productivity benefit with its compliance posture intact.
Governance program and staff training for an established SMB. A professional services firm knew its people were using AI but had no policy and no visibility. A typical engagement here builds the full program end to end—a plain-language governance policy mapped to the NIST AI RMF's govern/map/measure/manage structure, a data-classification scheme, access controls, vendor-vetting criteria, and hands-on staff training so the policy actually gets followed rather than filed away. For organizations too small to justify a full-time security hire, we deliver this through a fractional CISO model scaled to your size and budget.
Across all three, the throughline is the same: right-sized governance that fits a small business's resources, grounded in credible frameworks, so you can adopt AI with confidence instead of crossed fingers.
AI governance is the set of policies, approved tools, and safeguards that define how your business uses AI safely. For a small business it does not mean a compliance department—it means a short acceptable-use policy, a list of vetted tools, data-handling rules, access controls, and a habit of human review, ideally structured around the NIST AI Risk Management Framework's govern, map, measure, and manage functions.
Shadow AI is employees using AI tools—usually free, personal accounts—without company approval or oversight. It is risky because staff can paste customer data, patient records, contracts, or source code into tools that may use it to train models. IBM's 2026 Cost of a Data Breach Report found that shadow AI incidents jumped to 43% of breached organizations, with those breaches costing an average of $5.39 million.
Start with two. The NIST AI Risk Management Framework (and its Generative AI Profile, NIST AI 600-1) gives you a governance structure that scales down to a small team. The OWASP Top 10 for LLM Applications gives you a security checklist for evaluating specific tools and vendors. ISO/IEC 42001 and the EU AI Act are useful context if you are larger or serve regulated or European markets.
Yes, but only with the right safeguards. You need a Business Associate Agreement with the vendor, minimum-necessary access to PHI, documented vendor vetting, inclusion of the tool in your HIPAA risk analysis and technology asset inventory, and a clinician reviewing AI-drafted notes before they enter the record. A consumer AI tool with no BAA is not appropriate for patient data.
Write a short, plain-language acceptable-use policy and publish an approved-tools list. Those two steps alone give employees a safe, sanctioned way to use AI and remove most of the temptation toward shadow AI. From there, classify your data and add access controls.
AI is genuinely good for small business. It levels the playing field, giving a ten-person company capabilities that used to require a department. The data is clear that small firms are adopting it, benefiting from it, and in some areas moving faster than the enterprises above them.
The businesses that will win with AI are not the ones that adopt the fastest or the most cautiously. They are the ones that put light, sensible guardrails in place early—a clear policy, a short list of approved tools, a habit of human review, and a compliance path where regulated data is involved. Governance is not the thing that slows AI adoption down. It is the thing that lets you adopt without looking over your shoulder.
You do not have to do it all at once, and you do not have to do it alone. Start with a policy and an approved-tools list this quarter. Map what you are already using. And where the stakes are high—patient data, client confidentiality, your own intellectual property—get the assessment done before the tool goes live, not after.
Book a 30-minute discovery call with Cybersecurity Advisory Group, and we will walk through how AI is being used in your business and what right-sized governance would look like for you.
Sources: U.S. Chamber of Commerce; U.S. SBA Office of Advocacy; IBM Cost of a Data Breach Report 2026; NIST AI Risk Management Framework and NIST AI 600-1 Generative AI Profile; OWASP Top 10 for LLM Applications 2025; HHS Office for Civil Rights, HIPAA Security Rule guidance.
This article is provided for general informational purposes and does not constitute legal advice.
Connect with Melissa Thornton on LinkedIn
