Your Staff Are Already Using AI. You Just Do Not Know Which Client Data They Gave It.
Why small-business owners do not need an AI strategy: they need a one-page rule and three questions they can ask this week.
Sign up for my Substack daily AI newsletter here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
In a twelve-person accounting practice, a boutique logistics firm or a dental surgery, artificial intelligence did not arrive through a boardroom decision. It arrived through a browser tab. An administrator pastes a client’s bank statement into a free chatbot to reformat it. A practice manager drops the day’s patient notes into a text summariser to save forty minutes. The work gets done faster, everyone goes home earlier, and the owner, who has no idea it happened, is grateful for the lift in productivity. That same owner is also carrying a liability they cannot see, enforced by a regulator that no longer treats small firms as too small to notice.
CONTEXT AND BACKGROUND
The scale of this is not hypothetical. Forty-five per cent of employees now use AI tools on work devices, up from fifteen per cent in 2025, according to Verizon’s 2026 Data Breach Investigations Report. Seventy-seven per cent of those users paste data into chatbots, and eighty-two per cent of those pastes come from unmanaged personal accounts, outside any employer’s visibility. Forty per cent of files uploaded to generative AI tools contain personally identifiable or payment card data, and the median time to detect an unauthorised AI tool in an organisation is 403 days.
In a listed bank, these numbers get escalated through a chief information security officer, a data protection officer and a legal team. In a six-person accounting practice they land on one person. That person is the owner.
INSIGHT AND ANALYSIS
South African law does not reduce the duty of care for size. Under the Protection of Personal Information Act, a sole practitioner holds the same obligation to safeguard a client’s personal information as a listed insurer, and a single employee pasting a tax number or a medical history into a public chatbot can constitute a breach. The Information Regulator has become sharper on enforcement. Fines have been issued against the Department of Basic Education, Lancet Laboratories and FT Rams Consulting, among others, and security compromises reported rose from two hundred in 2021/22 to almost three thousand so far in 2025/26.
I have previously written about who the law looks for when the AI gets it wrong, arguing that the algorithm is not the legal actor and that accountability falls on the human who relied on it. For a small business, that human is you. There is no CIO to take the blame, no legal team to argue reasonable precautions, no insurance policy quietly updated to reflect the risk. The regulator does not need to find the employee. It needs to find the responsible party. That is the owner, by name.
IMPLICATIONS
Enterprise governance literature is written for companies you will never be. It assumes a committee, a budget and a six-month roadmap. For a twelve-person firm, the right answer is one page and three questions, delivered in a conversation on Monday morning.
The three questions are these. What tools are my people using? What data has already left the building? Which accounts hold the record? The virtue of being small is that you can get a straight answer in an hour. You know every employee by name. You sit ten feet from the person doing the work. Enterprise governance frameworks spend millions trying to simulate that proximity. You already have it.
The one page follows from the answers. Name the tools you authorise and the account they must be tied to. Name the data that never leaves the firm: client bank details, patient notes, tax numbers, employment records. Name a single person to be told when something looks wrong. Print it, sign it, put it on the wall near the printer.
CLOSING TAKEAWAY
The small firm is not disadvantaged in AI governance. It is the one place where governance can be lived rather than audited. The regulator does not care whether you had a committee. It cares whether you had a rule, whether your staff knew it, and whether you can show the conversation happened. A one-page policy, three questions asked this week, and a ten-minute meeting on Monday will put you ahead of nine out of ten firms your size. That is cheaper than the fine, cheaper than the client who leaves, and cheaper than the week you will spend answering questions you did not know you had to be able to answer.
Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net
Comments