Most SME owners picture shadow AI as something that happens at companies far bigger than theirs: a compliance headache for organisations with thousands of staff and a dedicated security team. New research says otherwise.

Stratix Corporation's "State of MDM in 2026" report, alongside this year's IBM Cost of a Data Breach Report, found that 63% of organisations have already had a data compromise linked to shadow AI, meaning AI tools staff are using that nobody in the business approved, reviewed, or even noticed. Shadow AI's role in breaches has doubled in a single year, from 20% to 43%. And 92% of AI-related breaches happened at organisations with no AI access controls in place at all.

That last figure is the one worth sitting with. This isn't mostly a story about staff being careless. It's a story about nobody having decided anything. A business goes from having no AI policy to having AI everywhere without a single meeting in between, because someone pastes a client brief into a free chatbot to save half an hour, someone else uploads a spreadsheet to a summarising tool, and none of it looks like a decision because no decision was actually made.

Why smaller businesses assume this isn't about them

Shadow AI research tends to get reported through headlines about breach costs at large enterprises, and that framing does smaller businesses a disservice. Smaller businesses often have fewer formal controls, not more informal AI use. Staff at a 30 or 50-person business are just as likely, arguably more likely, to reach for a free AI tool when nobody's told them otherwise, because there's no IT department setting the default and no policy to bump up against.

The instinct when this comes up is to reach for a ban: block the tools, send a stern email, move on. It rarely works, and it isn't really the point. Staff use AI tools because they're useful. Banning them without offering an alternative just pushes the behaviour further out of sight, onto personal devices and personal accounts, where it's even harder to see and even harder to fix.

What actually closes the gap

The fix that works is smaller and less dramatic than most business owners expect. It starts with an honest, unemotional look at what's already being used, not to catch anyone out, but to understand the real shape of the risk. From there, a business needs a plan that says which tools are approved for which kinds of work, what data should never go near a public AI tool, and who staff can actually ask when they're unsure. None of that requires a security consultant on retainer or a six-figure governance programme. It requires someone to sit down, map it properly, and write it down.

That's precisely the gap the Governance dimension of an AI readiness diagnostic is built to catch, alongside the five other areas, vision, opportunities, people and culture, tools and data, and value, that between them determine whether AI adoption actually works or quietly creates more problems than it solves.

The EU AI Act's transparency and disclosure requirements, in force since 2 August, add a second reason to get this right, particularly for any business with EU customers or EU-based staff. But the governance case stands on its own. A business doesn't need a new law to justify knowing what its own team is doing with AI.

If nobody in your business has sat down and decided how AI should be used, the honest starting point isn't a policy document. It's finding out what's already happening, quietly and without judgement, and going from there.

Go wisely.

Stratix Corporation, "The State of MDM in 2026," 12 August 2026; IBM Cost of a Data Breach Report 2026 coverage