A new Nationwide survey turns shadow AI from an abstract concern into a practical management backlog for small and mid-market businesses.
Introduction
Employees are already using public AI tools for work, often before management has decided what safe use looks like. A new Nationwide survey of small and mid-market business owners reports that six in ten say staff use public chatbots or writing tools, while only 36 percent have written AI policies and 37 percent provide responsible-use training. The release also points to gaps in data-entry rules, output verification and incident planning. These are survey findings published by an insurer, so they describe the respondents rather than every SME. Even with that limitation, the operational lesson is blunt: banning AI in theory does not create control. Businesses need a short, usable policy tied to approved tools, protected information and real review steps.
What happened
Nationwide reports that 35 percent of surveyed owners believe employees use unauthorized AI tools. Only 27 percent say their business has rules defining what company or customer information may be entered, and 25 percent report procedures for verifying AI-generated information before it informs business decisions. On external threats, 31 percent say their company was targeted by a generative-AI scam or fraud attempt during the previous year. Just 35 percent report an up-to-date incident response plan. The release does not provide enough methodological detail in the extracted page to generalize these percentages to every geography or industry. They are still useful as a risk checklist because each gap can be tested directly inside an organization without buying another dashboard.
Why it matters for growing businesses
An employee can paste a customer contract into a chatbot in seconds, create a convincing but false supplier message or rely on an invented figure in a proposal. None of those failures requires a sophisticated autonomous agent. They arise from ordinary tools used without agreed boundaries. SMEs are especially exposed because people wear several roles and often choose software independently to keep work moving. A policy that simply says “use AI responsibly” will not change behaviour. Staff need examples: which accounts are approved, what data is prohibited, when output must be checked and who handles a suspected leak or fraudulent instruction. Clear rules also make experimentation easier because employees no longer have to guess whether every useful prompt is forbidden.
Practical actions this week
Start with a confidential, non-punitive inventory of the AI services employees actually use. Record business purpose, account type, connected systems, data entered and whether the vendor retains prompts. Approve a small toolset with business-managed accounts and remove shared credentials. Create a one-page policy that prohibits passwords, payment data, sensitive personal information, unreleased financials and client-confidential material unless an explicitly approved environment covers that use. Require human verification for customer-facing, financial, legal, employment and security decisions. Add a visible reporting route for mistakes and suspicious messages. Train staff with examples from their own workflows, not a generic slideshow. Schedule a quarterly review because products and data terms change faster than annual policy theatre can keep up.
A lightweight incident plan
Define who receives the first call when sensitive data is pasted into an unapproved tool, an AI-generated payment request is acted upon or an account is compromised. Preserve the prompt, output, account, timestamp and connected systems. Revoke sessions and tokens, then assess whether data left the organization or records were changed. Contact the vendor through the documented privacy or security channel and involve legal, insurance or affected clients when obligations require it. For payment fraud, contact the financial institution immediately rather than waiting for an internal post-mortem. After containment, update the policy and controls based on the actual failure. Run a 30-minute tabletop exercise with management, finance and IT. A concise plan used under pressure beats a thick binder that nobody can locate.
How VDS Consultoria can help
VDS Consultoria can run an AI-use inventory, classify data and translate the findings into practical policies that fit a growing business. We help select managed tools, configure access, separate personal from company accounts and connect approved automation to Odoo or other systems with narrow permissions. We can also create verification steps for sales, finance and customer service, plus an incident playbook that names owners and technical actions. Training uses realistic prompts and scams rather than abstract warnings. The objective is not to suppress useful experimentation. It is to make approved use easier than shadow use, while ensuring confidential data, financial decisions and customer commitments receive the human judgment they deserve.
Owner checklist
Can management list the AI tools in active use today? Are accounts owned by the business and protected with strong authentication? Does every employee know which data may never enter a public tool? Are high-impact outputs checked against an authoritative source? Can finance independently verify any change to bank details or payment instructions? Is there a current incident contact list and a way to preserve evidence? Do contracts and privacy notices cover the selected services? Review these questions with department heads and assign due dates for every “no.” The first version can fit on one page. Complexity can be added when justified; vagueness should not be mistaken for flexibility.
Source
Nationwide Survey: Businesses Are Using AI Faster Than They Are Managing Its Risks, Nationwide, 2026-09-15.