Risks of AI for small businesses in 2026: what can go wrong and how to protect yourself

A prominent example are hallucinations of AI chatbots, like ChatGPT or Claude. They have been built to answer any question with beautiful and sophisticated phrases. However, this is no indication on whether the response is correct. In a nutshell, modern AI models are probabilistic software - they don't write their answers based on experience and convictions, but what are the most likely words to continue a text.

If an AI chatbot does not have a good response to a question, chances are that it makes up an answer that sounds plausible - it hallucinates based on the most likely words. And it doesn't get aware of such wrong information, as it just continues writing text that is most likely to sound right. AI chatbots are lacking a true understanding of the world around us, so that they are not able to judge the quality of their answers in the way that humans do.

A second source of many risks is the progress by generative AI to create media like images, videos or mimic human voices at astonishing quality. Any situation where we are prone to blindly trust what we read or see, then, gives rise to novel risks.

Shadow AI is risky, because it often processes personal data, business critical and confidential data in ways that harms businesses and even violates law. The most common tools to consider are popular chatbots, such as Gemini, Claude and ChatGPT. In private (non-business) accounts, the data from chats is often used to train future AI models by default. In addition, data processing agreements (DPAs) are not part of such accounts - but these are an essential prerequisite to process personal data from employees and customers inside the EU.

As an example, when an employee pastes a customer's email into their personal ChatGPT account to formulate a response, the personal data from the email is processed without DPA - which likely violates GDPR. If the customer is writing about your unreleased innovative product, then its details can be part of the data that will be used to train OpenAI's next AI model - and your competitors might find out about some details of your company and your new products that you wouldn't want to share publicly. Ultimately, you are losing control over what happens to your data.

Therefore, just banning AI tools due to AI's risks is not the answer, as an absence of official tools gives rise to shadow AI usage. Rather ask your employees about the most important AI tools they would like to have, and provide them with tools that handle business data well. (Note that even ChatGPT exists in a version for business data.)

Finally, you can lay out an explicit AI guideline about AI tools can be used for which tasks, and which tools and usage scenarios are forbidden. This creates transparency and sheds light into the shadows.

Generative AI tools make it easy to fake emails, the voices of your CEO, or even imitate their appearance in a video call. That's why they no longer prove identity.

As we are used to trust the decisions of our colleagues and bosses in daily business life, malicious attackers use this against us by imitating them in realistic ways. If business processes are not secured against such attacks, they are prone to produce significant damage to companies.

A prominent example is given by an incident in the engineering company Arup. In 2024, an employee in the finance department got an email from his CFO with the request to transfer $25.6 million to a third-party account. Being sceptical about the request, he received an invitation to a video call with the CFO and other colleagues - only that all of them were AI-generated. This convinced the employee and he authorized the money transfer. The finance employee was right to be skeptical - but he wasn't aware that renowned faces in a video call is no longer sufficient to trust the identity of a person.

This isn't a singular incident. Record losses through global deepfake frauds have reached $3.7 billion through June 2026, as Surfshark notes. Further, personalized phishing emails have become cheap to produce with generative AI - and obvious signals like bad grammar and typos are no longer present.

What actions can you take? For critical businesses processes - e.g. for payments or product deliveries - clearly specify a process how decisions are taken and how they are communicated. Make sure that your managers will not call spontaneously and ask employees to "please be pragmatic" and forget about your process just this time. Validation routines can help - while incoming phone calls can be faked easily, validation calls to the known number of your manager are harder to attack. Consider applying a four-eyes-principle to validate important decisions, or introducing limits to the amount of money a single employee can transfer and spend.

Risks and their concrete impact are custom to your individual situation. Risk management, then, does not make all of these risks disappear - but it lets you consciously take certain risks while avoiding those that are unacceptable.

We know the situation: AI tools like OpenAI Codex, Claude Code or similar are making it easy to quickly create a first version of a novel tool. It looks beautiful, and does everything we expect from it in first tests.

But we tend to consider only the 90 percent of standard cases in such tests - risks creep in from the so-called edge cases. AI automation tools mostly work on data provided by humans or other IT systems - if an information is wrong, the tool might not know how to handle it. Other examples are requests by customers that you did not expect during your internal tests. This can lead to wrong decisions, misinformation and cause damage.

Think about the following case of Air Canada. In 2022, a customer used their new chatbot to inform himself about the airline's reimbursement policies in case of sudden death of close family members. As part of this chat, the chatbot invented a reimbursement policy that did not exist. Later on, when the customer wanted to use this non-existing policy to get reimbursed for his ticket prices, a civil resolution tribunal decided that Air Canada is fully responsible for the information their chatbots share - or invent. Sharing wrong information about tariffs is a risk which the airline should have anticipated.

Applying risk management is a good practice here. But where do you get started? A public standard is provided by the ISO/IEC 42001 document. Just as ISO/IEC 27001 is the established standard on information security, ISO/IEC 42001 lays out all relevant steps you need to consider - for small business, however, the full setup might be overblown. Reach out to me if you are interested to get to know more about it.

As a start, ask yourself questions like: Where does your AI take decisions, create information, etc? How can this data/decisions be flawed? Who is using this information, or is impacted by the decisions taken? How can you measure potential damage for these stakeholders (financial damage, bad reputation, time wasted, etc.)? Once you have written down the relevant failure scenarios, you can pro-actively plan the measures to avoid them.

Always start with the actual business problem your AI agent is solving, work backwards toward the actions and information it really needs to take to achieve this goal. Instead of considering which responsibilities an agent is able to take over, rather ask yourself: "Have I cut down the responsibilities of my agent to the bare minimum of what it needs to do?"

Many AI agents make it convenient to solve many tasks at the same time, if we only give it access to some more tools like our mailbox - but this convenience comes at the price of risks.

Consider the following real example: GeminiJack was a vulnerability in Google's Gemini Enterprise, an AI assistant for companies, made public in December 2025 by Noma Security.

• The AI assistant can search across the company’s Gmail, Calendar and Google Docs to answer employees' questions.
• An attacker only had to get a single document, a calendar invite or an email, into the company, for example by sharing a Google Doc. It looked harmless, but contained hidden instructions for the AI.
• Later, an employee made a routine search, such as 'show me our budgets'. The AI pulled in the manipulated file, treated the hidden text as commands, and searched Gmail, Calendar and Docs for sensitive terms.
• Finally, the AI shared that information with the attacker - no employee had to click anything or take a wrong decision for the attack to succeed.

Google fixed this specific flaw after the researchers reported it. The underlying problem, however, remains: AI cannot reliably tell the difference between information it should read and instructions it should follow. Similar attack scenarios in other products, for example in Microsoft 365 Copilot and in Slack’s AI assistant, come up regularly.

To minimize the risks, you should therefore critically reflect:

• Which data and other IT services are connected to my AI tool or agent?
• What are the results, data or decisions that I expect from it?
• Which data or other IT services does it really need?
• Which content resources can it trust? Default to treat any email, shared document, calendar invites or websites as untrusted if they have not been checked properly.
• Which critical decisions that cannot be reversed must be approved by humans in any case?
• Everything that is not needed should not be connected. Even if it would increase convenience.

Many vendors are currently setting up their own environments which let you easily create your own AI agents or specialized AI services. This introduces a high degree of convenience to launch powerful solutions to your daily business problems. However, this comes at the risk of vendor lock-in - the more your business processes rely on a single provider, the harder it gets to switch to other solutions.

There are plenty of ways in which such a dependency can cause pain. First of all, the pricing models of many AI service providers are still in flux, so that price or usage limits can meaningfully change in the future. Then, AI models on which your AI services rely can be discontinued and replaced with a new model version with only little notice - but switching to that new model version can impact the behavior of your own service in unforeseeable ways. In addition, AI agents from small startups often provide innovative solutions - but the startups can go bankrupt, and access to their automation services can vanish within a day. On a smaller scale, temporary service outages directly impact your business if that AI service is a single-point-of-failure for your processes.

As you see, vendor lock-ins to AI services can be costly and disrupt your business processes. So how do you keep your company resilient?

• Control your data: keep your documents, prompts and configurations for each service in an exportable format.
• Proprietary platforms vs. open standards: prioritizing usage of open standards over supplier-specific toolkits will simplify a supplier change in the future.
• Check contracts: which uptime guarantees are specified, which deadlines for data deletion are specified, is there a guaranteed way to export your data?
• Manual fallback: can your team conduct the urgent tasks themselves, if they need to?
• Create a business continuity plan: for the urgent and critical processes, write down the explicit steps that your teams need to take when worst case scenarios happen. Also, specify which processes have low priority and don't need to be executed immediately. With this at hand, they can take immediate action and thus minimize the impact of severe business disruptions.

That said, a vendor lock-in does not need to be bad in any case. Having all data in one place reduces complexity for your teams and increases the chances that different services interact seamlessly with each other. Most importantly: be aware of the risks, and take an educated decision.

These obligations apply to you today:

• No prohibited practices. Manipulative AI, social scoring and unrestricted biometric surveillance have been banned since February 2025. Fines can reach 35 million euros or 7% of annual turnover; for SMEs, the lower of the two amounts applies.
• AI literacy. You must take measures to support the AI skills of your employees. Since the amendment in July 2026, you no longer have to guarantee a specific skill level for each person. You should still be able to show what you did, for example training and a clear AI guideline.
• Transparency. Since August 2026, people must be able to tell when they interact with an AI, for example a chatbot. Deepfakes and AI-generated texts on matters of public interest must be labeled. Providers of generative AI additionally have to mark their outputs in a machine-readable way. For systems already on the market before August 2026, this applies from 2 December 2026.
• High-risk systems. If you use AI for HR decisions such as CV screening, or in education or credit scoring, strict rules apply. They have been postponed until December 2027 (and August 2028 for AI embedded in regulated products), so you have time to prepare.

Your first step: create an AI inventory. List which AI tools you use, who uses them, for what purpose, and which risk category they fall into. For the details of the law, risk categories and deadlines, read my full article on the EU AI Act.

Start with risk management. As described above, ask yourself: Where does my AI make decisions or create content? How can decisions/content be wrong? Who is affected, and what is the potential damage? Write it down, plan countermeasures, and revisit the analysis whenever your product changes.

Know your role under the EU AI Act. Even if you build on a model from OpenAI, Google or Anthropic, you are the provider of the AI product you offer to your customers. That means you are responsible for transparency. Users must know they are dealing with AI, and generated content must be labeled. Your business customers need to understand what your product can and cannot do. If your product falls into a high-risk area, requirements such as data quality, technical documentation, event logging, human oversight and cybersecurity apply from December 2027.

Monitor your AI in production. Classic software behaves the same way until you change it. AI does not: model providers update their models, customers send requests you never tested, and quality can degrade without any error message. Measure continuously:

• Quality: Run a fixed set of test cases automatically whenever you change a prompt or model, and let humans regularly review real conversations.
• User interaction: Track feedback ratings, how often users are asking to be handed over to a human, how often they rephrase the same question, where they give up - everything that lets you measure customer satisfaction is helpful.
• Safety: Count how often guardrails trigger and how often attacks such as prompt injection are attempted.
• Operations: Watch response times, error rates and costs per request.
• Control: Pin model versions, test before switching, and keep a fallback to a human process.

Logging also helps with AI Act requirements and incident analysis. Keep GDPR in mind, though: store only what you need, and delete it on schedule.

AI did not invent a new kind of attack here. It found bugs that had stayed hidden for more than a decade, and it made them practical to exploit much faster than before. Expect more such waves.

What protects you: automatic updates wherever possible, one named person responsible for patches, as few publicly exposed systems as possible, and tested backups. I explain the background in my article on AI and software security.