Everyone's Doing AI. Are They Doing It Safely?
Why the rush to adopt large language models shouldn't mean leaving good security behind
If you run a business in 2026, you've almost certainly felt it. Every conference keynote, LinkedIn feed and vendor email carries the same message: adopt AI now or get left behind. Competitors are "AI-powered". Boards are asking what the AI strategy is. Staff are already pasting work into chatbots, whether you've approved it or not.
The pressure is real. But pressure is a poor substitute for a plan.
In this post I want to look at the gap between what businesses think everyone else is doing with AI and what's really happening, point out how much AI you're probably already using without realising it, and make the case for something unfashionable: slowing down just enough to do the security basics properly.
Perception vs reality: is everyone really doing it?
The headlines suggest every business has already transformed itself with AI. The data tells a more measured story.
According to the Office for National Statistics (July 2026), around 35% of UK businesses with 10 or more employees now use at least one AI technology. That's a big jump from about 12% in late 2023, but it still means most businesses aren't using AI in any formal way. The ONS also found the average adopter uses only 1.6 AI technologies, and describes the impact so far as "relatively limited" for most firms. Adoption is uneven too: 58% in information and communication, just 13% in construction.
And where businesses have invested, results are mixed. MIT's widely quoted State of AI in Business 2025 research found that around 95% of corporate generative AI pilots showed no measurable return. The methodology has been debated, but the message is hard to ignore: buying AI isn't the same as getting value from it.
Here's the twist. The same ONS research found that 55% of employees say they use AI for work or education. In other words, your people are often further ahead than your policies. MIT found the same pattern: staff at over 90% of companies were using personal AI tools at work, while only around 40% of those companies had bought official licences.
So the real risk for most businesses isn't being "left behind". It's that AI is already in use, unmanaged, while leadership is still debating whether to start.
You're probably already using AI
While many businesses that think they're "behind" are already using AI every day. it's simply arrived inside tools they bought for something else.
Microsoft 365: Copilot Chat now ships as standard in Microsoft 365 business plans, following the July 2026 price changes
Google Workspace: Gemini features sit inside Gmail, Docs and Meet
CRM and marketing platforms: HubSpot, Salesforce and others now draft emails, score leads and summarise calls with built-in AI
Security tools: email filtering, endpoint protection and fraud detection have used machine learning for years
Everyday apps: meeting transcription, Grammarly-style writing aids, smart replies and chatbots on your own website
This matters for two reasons. First, you may already have the AI capability you need, paid for, and waiting to be configured properly. Second, every one of those features touches your data. If you haven't checked what they can access, where that data goes and who can see the results, you've adopted AI without assessing it.
Before buying another AI product, take stock of what's already switched on.
Don't let the rush undo your security basics
AI doesn't change the fundamentals of information security. It just makes skipping them more expensive.
IBM's 2025 Cost of a Data Breach report found that 13% of organisations had suffered attacks on their AI models or applications. Of those, 97% lacked proper AI access controls. Some 63% of organisations had no AI governance policy at all, and high levels of "shadow AI" added around US$670,000 to the average breach cost. IBM's 2026 report puts the global average breach at a record US$4.99 million.
None of the fixes are exotic. They're the same disciplines we already apply to any new system or supplier:
Due diligence on the supplier. Where is your data processed and stored? Is it used to train the vendor's models? What certifications do they hold (ISO 27001, SOC 2)? What happens to your data when the contract ends?
A risk assessment before go-live. What data will the tool see? What's the worst realistic outcome if it leaks, is wrong, or is manipulated? Where personal data is involved, a DPIA is usually the right vehicle
Access controls and least privilege. AI assistants inherit the permissions of the user. If your SharePoint or shared drives are over-shared, Copilot-style tools will surface that data to anyone who asks
A clear acceptable use policy. Tell staff which tools are approved, what data must never be pasted into public chatbots, and give them a sanctioned alternative. Banning AI outright simply drives it underground
Human review of outputs. LLMs can be confidently wrong. Anything customer-facing, legal or financial needs a person to check it
Awareness of new attack types. Prompt injection, data poisoning and AI-generated phishing and deepfakes are real. Update your training and incident response plans to match
Logging and monitoring. Know who's using which AI tools and what they're connected to, especially as AI agents start taking actions on your behalf
Regulation is catching up, and it's worth knowing where things stand:
UK GDPR and the Data (Use and Access) Act 2025: the Act's main data protection changes took effect on 5 February 2026. Rules on automated decision-making have been relaxed, but people keep the right to contest decisions and ask for human involvement, and you still need documented safeguards
UK AI Cyber Security Code of Practice: now underpinned by ETSI TS 104 223, the first global baseline standard for securing AI across its lifecycle, developed with the NCSC
EU AI Act: if you serve EU customers, it can apply to you. Transparency duties, such as telling people when they're talking to a chatbot, apply from August 2026, while most high-risk obligations have been pushed back to December 2027
Keep up, but don't trip up
You don't need to be first to adopt AI. You need to adopt it deliberately. Start with what you already have, find a real problem worth solving, and apply the same due diligence, risk assessment and controls you would to any other system that touches your data.
The businesses that win with AI won't be the ones that rushed. They'll be the ones their customers still trust.
Need help reviewing your AI tools, policies or supplier risk? Get in touch for a no-obligation conversation.
Comments