Most small and mid-sized business leaders know that AI carries risk. Far fewer know exactly where their own organization stands. This practical self-check walks through the questions that matter most, the answers that should reassure you, and the gaps that deserve attention. It is not a substitute for a full assessment, but it is a useful starting point — and the questions you cannot answer confidently are usually the ones worth investigating first.
Do you know every place AI is being used in your business?
If your answer is anything other than a confident yes, you are not alone. AI features are appearing inside tools businesses already pay for, often without much fanfare. A short cross-team survey, combined with a review of your existing software, almost always uncovers more AI usage than expected. That visibility is the foundation everything else rests on.
Is there a clear owner for AI risk?
Strong AI programs have a senior leader who owns AI decisions, an oversight committee that brings cross-functional perspectives, and clear escalation paths for new use cases and incidents. If AI risk lives nowhere in particular — quietly absorbed by IT, scattered across departments, or simply unowned — that ambiguity itself is the risk worth addressing first.
Do employees know what data they can and cannot put into AI tools?
An acceptable use policy that no one remembers is no policy at all. Strong businesses combine a plain-language policy with simple, fast access to approved tools and ongoing reminders tied to the situations employees actually face. The test is whether a new hire could explain the rules in a sentence — not whether the policy document exists.
Could you contain an AI incident quickly?
If an AI tool started producing harmful outputs tomorrow, or an agent began taking unintended actions, how quickly could you disable it, communicate with affected parties, and restore service safely? A documented incident response plan, tested at least once a year, dramatically shortens the gap between something going wrong and someone confidently doing something about it.
Are your AI vendors held to clear standards?
Every AI vendor is a doorway into your data and operations. Strong businesses tier their vendors by risk, review the most important ones at least annually, and include AI-specific terms in contracts — covering data use, breach notification, and responsible AI commitments. If your vendor reviews stopped when the AI features started, that gap deserves attention.
What should you do next?
Start where you are. Pick the question above where your answer feels least confident, and address that first. AI security is rarely about heroic projects — it is about steady, deliberate improvement that compounds over time. The businesses that handle AI well are not the ones with the largest budgets, but the ones that commit to taking consistent, thoughtful action.
Email noelga@vastmanagementcorp.com
Phone +1-516-449-7411