When even some of the world’s largest organisations are struggling to keep pace with AI, it’s no surprise that many SMEs are unsure what their approach should be.
The opportunity is clear to see. Used well, AI has the potential to improve productivity, reduce administrative work, help employees work more efficiently and give smaller businesses access to capabilities that were previously beyond their reach.
However, there are also some difficult questions businesses must answer before they can safely capitalise on this new technology. Which AI tools should you allow employees to use? Is the data you share secure? Who owns the output? Can you rely on the answers provided? Are your suppliers using AI appropriately? And how do you take advantage of AI without exposing your business to unnecessary legal, commercial or reputational risk?
Most SMEs don’t have the luxury of creating a dedicated AI team to answer these questions. Business owners and senior managers are having to develop an approach whilst continuing to run their businesses.
Fortunately, that does not mean you have to start from scratch. Looking at how larger organisations are approaching AI can provide useful insight into how to balance opportunity and risk.
One example is the Ministry of Defence’s AI policy. Its Joint Service Publication 936, Dependable Artificial Intelligence (AI) in Defence, mandates the application of “ambitious, safe and responsible” practices to Defence projects involving AI.
Whilst the risks facing the MoD are very different from those of the average SME, the underlying challenge is surprisingly similar: how do you embrace the opportunities AI creates without losing control of the risks that come with it?
Here are 12 lesson’s SMEs can learn from the MoD about how to embrace AI:
- Do not start with a blanket list of banned AI tools
- Know where AI is already being used
- Give someone clear responsibility for AI
- Keep humans accountable
- Build AI into your existing governance
- Consider legal and ethical risks from the outset
- Make sure employees understand the AI they rely on
- Make AI training role-specific
- Carry out proper due diligence on AI suppliers
- Treat AI security as an ongoing process
- Match the level of oversight to the level of risk
- Do not wait for AI regulation to be ‘finished’
Need support drafting an AI policy for your business?
Our corporate and commercial solicitors specialise in advising SMEs, combining corporate governance and regulatory compliance expertise with extensive experience in the technology sector. We can build on your existing policies to create a practical AI framework that mitigates risk without holding back adoption.
Contact our corporate and commercial solicitors →
1. Do not start with a blanket list of banned AI tools
Considering the risks involved, it’s easy to see why some SMEs may be tempted to ban AI tools altogether. However, most businesses and employees are already using AI in some capacity and blanket restrictions can remove tools that are already being used safely to boost productivity.
Whether an AI tool is compliant depends just as much on how it is used as how it is built. Asking ChatGPT to help you spot an issue in some code carries very different risks from using it to cleanse sensitive customer data.
The MoD clearly states that JSP 936 “does not provide a list of AI-enabled systems or capabilities which are compliant or not compliant with our policies and ethics.” Instead, it encourages the use of AI to be assessed in context, recognising that whether a system is appropriate depends on how it is implemented and used.
For SMEs, the aim should be to give employees enough guidance to use AI confidently within clear boundaries. With the right training, policies and procedures, staff should be able to recognise when a use is low risk and can proceed and when it could create legal, commercial or data protection risk and needs further approval. That balance allows businesses to benefit from AI without giving employees free rein to use it in ways that could expose the business to risk.
2. Know where AI is already being used
Before you can manage AI effectively, you need to know where it is already being used. The MoD recommends that Defence organisations “identify in-use, under development and planned AI applications or components” to help determine their priorities.
For SMEs, this means taking stock of AI use across the business. Employees may already be using tools such as ChatGPT to complete everyday tasks, whilst AI functionality is increasingly built into software businesses already rely on.
A simple AI audit can provide visibility of which tools are being used, who is using them and what they are being used for. From there, businesses can identify higher-risk uses, establish appropriate controls and make informed decisions about where AI could deliver further value.
3. Give someone clear responsibility for AI
JSP 936 emphasises the importance of strong AI governance and clear accountability, including requiring Defence organisations to appoint Responsible AI Senior Officers and ensure responsibilities are clearly defined.
Whilst most SMEs will not need a dedicated AI officer, ensuring someone takes responsibility for AI compliance and governance is just as important. It should sit with an appropriate senior person or team who can oversee policy, assess higher-risk uses and ensure issues are addressed consistently across the business.
This does not mean they need to approve every use of AI. The goal is to establish clear accountability, so employees know what they can decide themselves, what requires further approval and who to turn to when they are unsure.
4. Keep humans accountable
The MoD places “meaningful human control” at the heart of its approach to AI, making clear that responsibility should remain with people rather than being handed over to the technology itself.
There is a growing list of examples of what can go wrong without proper human oversight, from a newspaper publishing AI-generated recommendations for books that did not exist to a German medical company being taken to court after its chatbot made false claims about its doctors’ qualifications.
In the UK, the Competition and Markets Authority has made clear that businesses remain responsible for what their AI agents do, just as they would for the actions of an employee – even if the AI agent is provided by a third party.
To mitigate these risks, SMEs should be clear about where human judgement is still required. The greater the potential impact of an AI-assisted decision, the stronger the human oversight should be.
5. Build AI into your existing governance
The MoD specifically warns against creating “unnecessary duplicative processes”, instead encouraging Defence organisations to adapt their existing governance structures and assurance processes to address AI-related risks and opportunities.
For SMEs, this is an important lesson. AI governance does not necessarily require an entirely new compliance framework. In many cases, existing processes around data protection, cybersecurity, procurement, HR and risk management can be updated to account for AI.
The goal should be to strengthen the systems you already have, rather than creating additional layers of bureaucracy that make AI harder to use effectively.
6. Consider legal and ethical risks from the outset
Whilst the MoD’s approach is intended to be ambitious, it maintains a clear focus on the legal and ethical considerations of using AI.
Equally, SMEs must prioritise compliance when selecting and implementing new AI systems. What information will the system process? How will its outputs be used? Could its use affect employees, customers, suppliers or job applicants?
Identifying potential legal and ethical risks early gives businesses the opportunity to put appropriate safeguards in place without unnecessarily slowing down AI adoption.
Failing to do so can have significant consequences. In 2023, iTutor Group “agreed to pay $365,000 to settle a suit brought by the US Equal Employment Opportunity Commission (EEOC)” after its AI recruiting software automatically rejected more than 200 qualified applicants based on their age and gender.
7. Make sure employees understand the AI they rely on
The MoD places significant emphasis on users understanding an AI system’s behaviour, performance and limitations, so they can judge how much trust to place in it in different situations.
For SMEs, employees do not need to understand the technical workings of every AI tool they use. However, they should understand its limitations, where errors are likely to occur and when an output needs to be checked before it is relied upon.
Placing too much trust in information provided by AI can have serious implications, as we have seen in the legal sector, where there have been a number of cases of legal professionals putting false information generated by AI before the court.
The more employees understand what an AI tool can and cannot reliably do, the better placed they are to use it productively without placing too much trust in its output.
8. Make AI training role-specific
The MoD’s AI policy recognises that general AI awareness is not enough. JSP 936 states that basic training should be supported by “role specific AI competency training” and requires staff working with AI to be suitably qualified and experienced for the roles they perform.
Whilst it may not be necessary for every employee, SMEs should tailor training where there are specific requirements or risks. Someone using AI to create marketing content will face different risks from an employee using it to analyse customer data, support recruitment or inform commercial decisions.
Training should therefore reflect the tools people use, the information they handle and the consequences if something goes wrong.
9. Carry out proper due diligence on AI suppliers
The MoD places particular emphasis on assessing suppliers of third-party AI platforms and how they handle data.
SMEs should take the same principle into procurement, especially given the CMA’s confirmation that businesses are responsible for the actions of third-party AI agents they use. Before adopting an AI tool, consider what happens to the information you provide, how the supplier protects it, what data the system has been developed using and whether the contractual terms adequately protect your business.
The level of due diligence should reflect the risk. A tool being used for relatively low-risk administrative tasks may require a very different level of scrutiny from an AI system processing customer data or supporting important business decisions.
10. Treat AI security as an ongoing process
AI is evolving rapidly, and so are the risks associated with it. In JSP 936, the MoD recognises that traditional approaches to security risk management may not always be enough for AI and that security must be treated as an ongoing process to keep pace with the technology.
Similarly, for SMEs, security should not be treated as a one-off check when an AI tool is introduced. Tools change, new features are released and the way employees use them can evolve over time.
Businesses should therefore keep AI-related risks under review, ensuring their policies, security controls and approved uses continue to reflect how the technology is actually being used.
11. Match the level of oversight to the level of risk
JSP 936 states that “the level of confidence developed in the system must be commensurate with the reliance placed upon it”. Put simply, the more you rely on an AI system, the more confident you need to be that it can be relied upon.
By adjusting the level of scrutiny applied to a system or use case based on the level of risk and potential impact on the business, SMEs can focus their resources on the issues that matter most. Taking this proportionate approach allows businesses to manage genuine risks without creating unnecessary barriers to productive uses of AI.
12. Do not wait for AI regulation to be ‘finished’
Like many organisations today, regulators are having to respond to a rapidly developing AI landscape. The MoD recognises that its understanding of the risks, safeguards and assurance standards will continue to develop, describing the implementation of JSP 936 as an “ongoing process”.
Whilst it remains to be seen how AI regulation will develop, SMEs can lay sensible foundations now by ensuring their use of AI complies with existing legal and regulatory requirements and putting clear policies, responsibilities and controls in place. This gives SMEs a practical framework for using AI confidently and productively whilst keeping risk under control.
AI governance should enable adoption, not prevent it
If there is one message SMEs should take away from the MoD’s policy, it is that good governance and innovation are not mutually exclusive. You do not have to take unnecessary risks to benefit from AI. In fact, clear policies, proportionate controls and appropriate training can give employees the knowledge and confidence to embrace AI, helping to boost productivity, increase efficiency and transform how your business operates.
The businesses that benefit most from AI will not necessarily be those that use every new tool first or those that wait for complete certainty. They will be the businesses that understand where AI can add value, recognise where the risks lie and put in place proportionate controls.
How we can help
AI will continue to evolve and no business can eliminate every risk or predict exactly how the technology will develop. What you can do is put strong governance in place now, giving your employees a clear framework for using AI productively whilst protecting your business.
At Scott Bailey, our corporate and commercial solicitors support SMEs with creating practical AI policies tailored to the way their business operates. We can help you establish clear responsibilities, appropriate controls and proportionate safeguards that reflect the rapidly changing AI landscape, mitigate risk and position your business for success.
If you need support putting an AI policy in place, get in touch today.
