Ungoverned AI Is a Business Continuity Risk, Not an IT Problem

When a company rolls out AI to its team with no policy, no approval structure and no definition of which data can go into which tools, it is not being agile. It is handing control of its operations to a set of individual decisions that no leadership team can audit, reverse or even see.

The most common argument for postponing AI governance is speed: "we need to experiment before we regulate." It sounds reasonable until something breaks. And what breaks, when it breaks, is rarely small, because the risks of unstructured AI do not show up as software bugs. They show up as lost intellectual property, as critical dependence on the one employee who "learned how to use the tool," as mass-generated code nobody can maintain, and as a sudden drop in productivity when the employee who built the workflow leaves the company and takes the prompt with them.

These are business continuity risks. And SMBs (small and mid-sized businesses), by definition, have less redundancy and less capacity to absorb disruption than large corporations.

According to a 2025 IBM survey, only 37% of organizations have formal governance policies for AI use. That means 63% of companies are operating without any defined structure for one of the highest-impact categories of tools in recent years.

The phenomenon has a well-established name in the security market: Shadow AI, the use of AI tools by employees without formal approval, visibility or governance from IT, legal, compliance or leadership. It is the modern equivalent of Shadow IT, but with a different scale of consequence: while an employee using a personal Dropbox for company files creates a localized data-loss risk, an employee using an AI tool with customer data, contracts or proprietary code creates a risk that can be immediate, irreversible and legally significant.

The problem is bigger than most leaders imagine. According to Netskope's 2026 Cloud and Threat report, 47% of generative AI users in companies access these tools through personal accounts, completely outside corporate controls. A 2025 Menlo Security survey found that 68% of employees had used personal accounts to access free AI tools at work, and 57% of them entered sensitive data in those interactions. IDC's 2025 survey indicates that 56% of employees use unauthorized AI tools at work, while only 23% use the tools the company provides and governs.

In other words: at most companies, most AI activity is already happening outside security controls, compliance frameworks and leadership visibility.

In March 2023, Samsung's semiconductor division lifted its internal restriction on ChatGPT and allowed engineers to use the tool to support development. In less than 20 days, there were three incidents of confidential data leakage, all unintentional, all committed by senior engineers who were simply trying to get their work done faster.

In the first incident, an engineer pasted proprietary source code from a semiconductor database into ChatGPT to find a bug. In the second, another pasted chip test sequence code into the same service. In the third, an employee recorded a confidential internal meeting, transcribed it with an audio app and fed the transcript into ChatGPT to generate the minutes. In every case, the data submitted to OpenAI's platform could have been incorporated into model training, leaving Samsung's control with no way to reverse it.

The company immediately banned ChatGPT and accelerated the development of in-house tools with proper data controls. The incident became a corporate governance reference in the global security market, not because Samsung was negligent, but because it did exactly what most companies are doing today: it opened access before defining the structure.

For an SMB, the equivalent risk is not smaller. It is proportionally larger: a 30-person company with one employee using ChatGPT with the pricing spreadsheet, customer contracts or the supplier database is exposing assets that represent a much larger share of the business's total value than they would for a Samsung.

There is a quiet dynamic that emerges in every company that adopts AI without structure: within a few months, one or two employees become the internal go-to people for the tools. They know which prompt works for generating the sales proposal, how to configure the agent that triages emails, how to build the flow that automates the weekly report.

In the overwhelming majority of SMBs, that knowledge lives in these people's heads, not in documentation, not in formalized processes, not in systems others can operate. When that employee leaves the company (and according to a 2023 SHRM survey, 72% of companies have at least one employee whose departure would significantly affect operations), what walks out the door is not just talent. It is the entire process.

Critical dependence on key people is not a new problem for companies. What ungoverned AI does is amplify that risk in a specific way: it creates dependencies that are invisible to leadership, because the processes live in personal tools, in browser tabs nobody else knows how to open, in prompts that were never documented as company assets.

The cost of replacing an employee is already high in the Brazilian labor market. According to estimates by consultant Josh Bersin, a global reference in talent management, replacing a single employee costs between 1.5 and 2 times that person's annual salary, including recruiting, onboarding, the learning curve and the team's lost productivity during the transition. When the departure also takes down a set of processes that depended exclusively on that employee, the real cost is even higher and much harder to quantify.

Panopto research with global companies found that employees in high-turnover environments are 65% more likely to say it is "very difficult" to get the information they need to do their job properly, an environment that generates errors, rework and further turnover in a cycle.

Beyond the security risk and the turnover-driven continuity risk, there is a third category of cost that is not yet on most SMBs' income statements, but will show up, typically in the second or third year of adopting AI without a quality framework.

A GitClear analysis of 211 million changed lines of code between 2020 and 2024 documented the pattern precisely: the "code churn" rate (code discarded less than two weeks after being written) jumped from 5.5% to 7.9% as AI took on more code generation. Refactoring volume fell from 25% to under 10% over the same period. More code going out, less quality per line, less structural review.

The operational result of this pattern is starting to surface in 2026: Codebridge data indicate that AI-generated code without quality governance drives maintenance costs to four times the traditional level by the second year, as technical debt accumulates. The first months show a speed gain. The second year shows the bill for speed without discipline.

According to Faros AI research cited earlier in this series, under high adoption of agentic AI for code, "code churn" rose by more than 800% in some teams. Gartner projects that 75% of organizations will have moderate to high levels of technical debt in 2026, directly linked to the expansion of AI use without adequate review.

MIT professor Armando Solar-Lezama summed up the phenomenon with a precise metaphor: AI for code is like a "brand new credit card that is going to allow us to accumulate technical debt in ways we were never able to do before."

This risk is not limited to code. The same pattern applies to any process where AI is being used without review criteria: sales proposals generated in bulk without checking whether they fit the customer, automated financial reports without validation of the input data, customer service replies sent without human oversight. Output speed goes up. The error rate goes up with it. And the second bill (the rework, the correction, the litigation) arrives late enough that the cause is not obvious.

There is a fourth risk dimension that is still underdiagnosed, but that InformationWeek and Omdia analysts are flagging with growing urgency: the AI vendor as a single point of failure.

Companies that have built critical operational flows on a single AI platform, whether ChatGPT, Claude, Gemini or any other, usually have no continuity plan for the day that model is discontinued, repriced or acquired. Mike Leone, an analyst at Omdia, described the pattern in an interview with InformationWeek: "I talk to companies that have disaster recovery plans for every layer of their infrastructure, but almost none of them have thought about what happens if the AI model running their product disappears tomorrow."

For SMBs, repricing risk is the most immediate. Companies that built processes assuming a certain cost of AI access may find those processes become economically unviable if the vendor changes its pricing model, something that has already happened and is likely to happen more, since the vendors themselves are recalibrating the relationship between inference cost and access price.

The second lock-in risk is subtler: when an entire process has been optimized for the specific behavior of one model (its strengths, its limitations, its response patterns), migrating to another model is not trivial. Prompts have to be rewritten, workflows revised, outputs recalibrated. Without documentation and governance of usage, this turns into a full restructuring project.

A common misconception is to equate AI governance with AI restriction. Organizations that tried an outright ban quickly found that it does not work: research shows that almost half of employees would keep using personal AI accounts even after a formal ban. Prohibition without an alternative does not eliminate Shadow AI; it pushes it deeper underground, removing whatever visibility the company still had.

The approach the data show to work is different. When companies provide approved AI tools with proper controls, unauthorized use falls by 89%, according to 2026 data from Healthcare Brew. The problem is not that people use AI; it is that they use it without structure because no structure was offered.

Functional AI governance for an SMB needs at least four components:

Data classification and usage policy. Which categories of data can go into which tools. Customer data, contracts, proprietary code, sales strategy and financial information need explicit classification, and the rule needs to be known before the incident, not after. The absence of such a policy is what turned the Samsung incident from an operational mistake into an irreversible intellectual property problem.

Inventory of tools and processes. The company needs to know which AI tools are in use, by whom, for which processes and with which data. Without that map, there is no possibility of auditing, switching vendors, onboarding a new employee or assessing risk. The inventory does not need to be a complex system; it needs to be real and up to date.

Documentation of prompts and workflows as company assets. Every recurring prompt, every automated workflow and every process that depends on AI to function needs to be documented and versioned as an operational asset, not as the individual knowledge of whoever created it. That is the difference between a process that survives turnover and a process that vanishes when the person who built it leaves.

A defined human review point. Every AI output that triggers a real action (a proposal sent, a document signed, data recorded, an order processed, a communication published) needs an explicit, documented human checkpoint before it goes out into the world. Not because AI is always wrong, but because when it is wrong at scale, without review, the cost of correction is far greater than the cost of the review that did not happen.

There is a way to sell AI governance to an SMB's leadership that goes beyond the risk argument and that, paradoxically, uses the very speed argument usually invoked to postpone it.

Companies with well-structured AI governance scale their use of AI faster than those without structure, because they can onboard new employees with documented processes, because they can assess which tools are generating returns and which are generating costs, and because they can extend usage to new areas without the risk of replicating problems that have already occurred elsewhere.

McKinsey's State of AI 2025 documented this: organizations classified as "AI high performers" (those with the greatest real impact on EBIT) are 3.6 times more likely to fundamentally redesign workflows when implementing AI. Workflow redesign presupposes documentation, an owner and criteria. It is, by definition, governance.

AI governance is not the brake on innovation; it is the structure that allows innovation to become operations. Without it, what an SMB has is a set of individual experiments that work while the people who created them are at the company, and that disappear when those people leave.

The question every SMB leadership team should answer today is not "do we have AI?" It is "if our best AI user leaves tomorrow, what breaks in our operations?" If the answer is long, the continuity risk is already in place. Governance is not what will create that risk; it is what will finally make it visible and manageable.