SME directors are facing a growing dilemma: AI has become embedded in daily operations long before the rules are written. The risks of ‘shadow AI’—where staff experiment with unapproved tools or automate sensitive processes beyond IT’s reach—are now hiding in plain sight. With Microsoft’s AI Code of Conduct setting out public governance standards, it is clear: technical controls and certifications will not protect your business from risks you can’t see or own.
What Are AI Governance Standards – and Why Is Microsoft’s Code Significant?
AI governance standards are the set of principles, controls, and accountabilities that guide the responsible use of artificial intelligence in business. Microsoft’s AI Code of Conduct has rapidly gained attention for moving beyond broad ethical statements to outline how AI should be controlled, reviewed, and owned at every stage—from design to deployment.
For SMEs, this shift has real implications. Microsoft’s code puts clear emphasis on measurable accountability, robust oversight, and transparent risk management. It sets an explicit expectation: boards and leadership teams can no longer delegate AI oversight to IT teams or rely on generic compliance statements.
Why This Matters for SMEs
The arrival of formal AI governance standards is not some distant policy concern. It signals a broad change in how responsibility for AI risk will be enforced—and ultimately, where liability will fall. For SME directors, the underlying risks of unsanctioned AI use—unmonitored data flows, unapproved automation, or unintended decisions—are strategic, not just technical.
In my experience, most SME leaders have invested in cyber security controls, staff awareness training, or data protection toolkits. Yet, shadow AI introduces a different type of risk. Unlike traditional IT, where service providers or certification schemes provide a sense of assurance, AI-driven risks often emerge quietly from day-to-day operations: a staff member experimenting with a ChatGPT plugin, sensitive data shared with a freemium AI assistant, or critical business decisions delegated to an unvetted algorithm.
Real-World Implications for SME Directors
Recent news has brought AI company leaders into the spotlight calling for a slowdown in AI development. The urgent message: the rate of innovation is now outpacing society’s ability to govern, regulate—and meaningfully control—the risks. I share this concern. If policy, leadership practice, and board oversight do not adapt, SMEs could find themselves exposed on multiple fronts:
- Regulatory exposure: Lawmakers are setting expectations for AI accountability. You may soon need to demonstrate not just intent, but auditable oversight of how AI is used by your staff and partners.
- Commercial risk: A single misapplied AI tool can put sensitive supplier, client, or compliance-related data in the public domain—compromising contracts or triggering legal complaints.
- Board accountability: Insurers and regulators are signalling that lack of AI governance could invalidate cyber insurance or increase liability in the event of a breach.
Shadow AI is no longer theoretical. Tech Insider and others have documented real cases: marketing teams using unsanctioned AI to draft sensitive copy, HR uploading personal data to AI resume screeners, or finance staff trialling AI-powered analytics without legal review.
Key Challenges and Risks for SME Leadership
| Visibility | Without clear policy, you likely have unknown AI tools acting on company data right now. |
| Risk ownership | Who, on your leadership team, owns the consequences if a staff member’s AI tool leaks personal data? |
| Policy lag | Most board policies have not kept pace with the versatility—and unpredictability—of modern AI. |
| False assurance | Certification, security tools and even managed services have limited ability to prevent risks emerging from ungoverned AI use. |
From a security perspective, shadow AI shifts risk from IT-controlled environments into board-level blind spots. Certification frameworks and technical controls are useful, but they are not substitutes for real-world ownership of emerging risks. As Microsoft’s conduct code makes clear, governance is about more than technology—it is a leadership function.
Practical Actions: Governing AI in Your Business
Practical, accountable action is now needed at board level. Based on established best practice and Microsoft’s public standards, SME directors should take the following steps:
- Formalise an AI usage policy: Clearly define what is (and isn’t) acceptable use of AI for staff, suppliers, and partners. Specify which tools are approved, who must authorise new deployments, and what types of data can be processed by AI.
- Establish oversight and reporting: Assign a board-level lead for AI risk—just as you would for finance or data protection. Regularly review AI use across business units with clear reporting lines.
- Educate and empower staff: Deliver awareness training that explains AI risks in business language, not technical jargon. Encourage early reporting of new tools, experimentation, or unintended outcomes.
- Map data flows: Identify where AI tools access sensitive or regulated data—especially personal data covered by GDPR or sector standards. Connect this review with your wider data protection obligations.
- Integrate AI governance into risk management: Extend your governance, risk, and compliance frameworks to cover AI-specific risk, policy exceptions, and incident response plans.
- Monitor regulatory guidance: Stay abreast of developments such as the EU AI Act and emerging UK codes of conduct. Update your governance model accordingly.
Future Outlook: Why a Strategic Pause Matters
Calls from AI leaders to slow the rate of innovation are more than a plea for responsible R&D. They are a signal that boards, regulators, and governments are scrambling to catch up with the real-world pace of deployment. For SMEs, using this window to implement accountable governance—and align with emerging standards like Microsoft’s AI Code of Conduct—may determine future commercial resilience.
Managing AI risk will become a test of board leadership, not just IT professionalism. Policy, ownership, and oversight must evolve in lockstep with the technology itself. Those willing to pause, reassess, and set clear boundaries now will be better placed as regulation— and customer scrutiny—intensifies.
Conclusion
For UK SME directors, the era of ‘AI on autopilot’ is ending. Microsoft’s AI Code of Conduct sets the standard for a new, governance-led approach—one where AI risk is visible, owned, and addressed strategically. The practical challenge is to bring shadow AI into the light before regulators, customers, or incidents force the issue.
A board-level response to AI governance is now essential. Taking measured action today will put your business on the right side of trust, compliance, and resilience tomorrow.
Henry Lawrence
Henry is the Managing Director of ITbuilder. He is also a CISM professional with over 7+years experience leading cyber security strategy and transformation initiatives across public and private sector clients. He has a strong track record of delivering maturity assessments, cyber governance models, and Secure by Design programmes in FS, Public Sector and E&U
More articles from Henry Lawrence