Two pieces of research landed this week that say the same thing in different ways.
AI Score surveyed 250 senior decision-makers in UK organisations. 92% are using AI beyond pilots. Only 16% have a complete, up-to-date list of their AI tools, and only 27% can say what data, tools and permissions each AI system can reach. Almost a third, 31%, have had an AI incident or near miss.
Pax8's Q3 SMB AI Pulse looked at small businesses, including the UK. 54% of AI-engaged UK small firms have built at least one AI tool that is now in regular use. 24% found AI running without approval in the last six months. Only 23% have a formal, documented review for AI they built themselves.
So small firms are moving fast. Good. I'd rather that than sit and wait. But the gap is obvious.
Chat is cheap. Action is where it matters.
Most small businesses started with AI for writing: emails, product copy, social posts. If that goes wrong, you delete a paragraph.
The next step is AI that does things. Updates a stock level. Raises a purchase order. Sends an invoice. Replies to a customer about their order. That is where the hours are saved, and it is also where a wrong answer costs real money.
I've written before about why AI that takes action is a different product from a chatbot. This research is the other side of that. If nobody knows what the AI can touch, nobody can tell when it touched the wrong thing.
The one-page list
For every AI tool in the business, write down:
- What it can read. Which systems, which records, whose data.
- What it can change. Stock, orders, invoices, customer records, or nothing.
- Who approves a change, and how. A button, a daily review, or a hard no.
- What it costs each month and who's watching that.
That's it. One line per tool. If a tool can change something and nobody approves it, that's the first one to look at.
Where it goes wrong in operations
In a warehouse or a shop, the dangerous ones are quiet. An AI that "tidies" product data and changes a SKU. An assistant that marks an order as dispatched because the customer email said it arrived. An app that writes to Xero from a figure it pulled from the wrong place.
None of those are dramatic. They just make the numbers drift, and you find out at month end.
How I'd approach it
Read access first. Let AI summarise, flag and draft. Then give it the ability to change one thing at a time, with a person confirming, and a log of every change it made. Widen it only when the log shows it's getting it right.
That's slower than switching everything on. It's a lot faster than unpicking a month of wrong stock.
If you want help working out what your AI tools can actually reach, give me a shout.
Sources
- AI Score research, reported by IBS Intelligence, 15 Oct 2026: ibsintelligence.com/ibsi-news/uk-smes-struggle-to-keep-pace-with-ai-governance/
- Pax8 Q3 2026 SMB AI Pulse (UK findings), reported by Comms Business: commsbusiness.co.uk/content/news/uk-small-businesses-are-building-ai-faster-than-they-can-govern-it