Ask most SME leaders whether their business uses artificial intelligence and the answer is cautious. “We are looking at it.” “We have not made a decision yet.” “We want to understand it better before we commit.”
The reality in most organisations is rather different. AI is already present, often extensively, in the software and platforms the business already pays for, in the tools individual staff have adopted independently, and in the features that have been enabled by default without anyone actively choosing them.
Understanding what is already in use is the essential starting point for any sensible approach to AI governance. You cannot manage what you do not know about.
The AI tools most commonly found in SMEs
*Microsoft 365 Copilot features
Even businesses that have not purchased a Copilot licence may have AI features active within their Microsoft 365 environment. Microsoft has been progressively embedding AI functionality into existing products, in Outlook, in Teams, in Word and Excel, sometimes as opt-in features, sometimes enabled by default as part of product updates. A review of your Microsoft 365 admin settings will typically reveal AI features that nobody in the business actively enabled.
*Grammarly
Widely used across business functions for proofreading and editing, Grammarly processes the text it is asked to review. For most business use this includes emails, reports, proposals and other documents, some of which will contain client information, commercially sensitive content or personal data. Most users have not considered what Grammarly does with the text it processes.
*ChatGPT and similar large language model tools
Direct use of ChatGPT, Claude, Gemini and similar tools for work tasks is widespread in most organisations, regardless of whether any formal decision about AI adoption has been made. Staff use these tools to draft emails, summarise documents, research topics and generate content. The data they input, including frequently, client and commercially sensitive information is processed by the tool provider’s systems.
*AI features in CRM and business software
Salesforce, HubSpot, Notion, Monday.com and many other common business platforms have added AI features in recent product updates. These features may be active by default and may be processing customer data, communication records and business information in ways that were not assessed when the platform was originally selected.
*AI writing and content tools
Jasper, Copy.ai, and similar tools used for marketing content generation are AI platforms that process the briefs, brand information and content context provided to them. Where this information includes client details, campaign data or proprietary business information, the data handling implications require assessment.
*AI features in communication platforms
Zoom, Teams and other video conferencing platforms now offer AI-powered transcription, summarisation and action tracking. Where these features are active, meeting content including confidential client conversations, board discussions and commercially sensitive negotiations, is being processed by AI systems.
What this means for governance
The first implication is practical. If you do not know which of these tools are in use in your organisation, you cannot assess the data protection and confidentiality implications. A structured AI usage audit, asking staff what tools they use for work, reviewing platform settings for enabled AI features, and reviewing software subscriptions is the starting point.
The second implication is regulatory. Where personal data is being processed through AI tools, the requirements of UK GDPR apply. This includes ensuring that there is a lawful basis for that processing, that there are appropriate contractual protections with the tool provider, and that individuals whose data is processed have been informed as required.
The third implication is commercial. Client confidentiality obligations, professional conduct requirements and contractual data handling commitments may all be relevant to how AI tools are used in your organisation. Understanding whether current AI usage is compatible with these obligations requires an assessment, not an assumption. The starting point for all of this is understanding what is already happening. In most organisations, that picture is more extensive than leadership expects.