Risks & control

The risks of AI in business, and how to deal with them

The five real risks of AI in business are data leaks, dependency on a supplier, invisible errors, the erosion of in-house skills and a cost that exceeds the gain. None of them is a reason to do nothing, and none is solved by banning the tool: a ban produces hidden use, and therefore uncontrolled use.

The five risks

What can really go wrong, and the matching countermeasure

Each risk is presented as it shows up in practice, followed by the measures we put in place.

High

Your data leaves without anyone having decided it should

A salesperson pastes a contract into a consumer assistant to summarise it. A developer pastes proprietary code into it. Nothing is malicious, nothing is tracked, and the information has left the company.

Countermeasures

An inventory of the tools actually in use, without sanctions, to get to the truth
A short, readable usage rule that teams can apply
An internal tool at least as convenient as the unofficial one, otherwise the rule will be circumvented
Supplier contracts checked on one specific point: whether your data is used for training

High

You become dependent on a supplier you do not control

Prices change, terms of use change, a model is withdrawn from the catalogue. If your production depends on it directly, you are subject to these decisions with no recourse.

Countermeasures

An abstraction layer between your tools and the model supplier
A second qualified, tested supplier, ready to take over
Your data and your prompts stored with you, not on the supplier's platform
A switchover test carried out at least once before going into production

Underestimated

Errors become invisible

A wrong answer arrives with the same confidence as a right one. As volume grows, nobody reviews any more, and the error travels through the documents all the way to the customer.

Countermeasures

Uses ranked by what is at stake: what requires human review and what does not
Traceability of outputs produced by AI, so that an error can be traced back to its source
Business test sets re-run whenever the model changes
A simple channel for reporting a wrong answer, and someone who reads it

Underestimated

Your teams lose the skills they delegate

A skill that is no longer exercised erodes within two or three years. The day the machine needs correcting, nobody in the company can judge whether the output is good.

Countermeasures

Identify the critical skills you refuse to delegate, and write them down
Keep real practice of these skills, even when the tool could do the work
Focus skills development on checking and decision-making, not on the tool

Medium

The project costs more than it brings in

The visible cost is the subscription. The real cost includes integration, data migration, training, checking time and maintenance at every version change.

Countermeasures

Full costing before launch, including the cost of checking
A short pilot on a narrow scope, with a stopping criterion defined in advance
Gains measured on an existing business indicator, not on one created for the occasion

Being replaced

“Am I going to be replaced?”

Short answer

Who is really under threat, and over what time frame?

It is tasks that are exposed, not people. According to the International Labour Organization (2025), one job in four worldwide involves tasks exposed to generative AI, and these jobs will more often be transformed than eliminated. The greater the share of repetitive, structured work in a role, the more it will change. A role that carries responsibility, arbitrates between conflicting interests or maintains a relationship is not replaced: it shifts towards checking and decision-making.

So the right question is not “will I be replaced” but “what share of my work can be automated, and what do I do with the time freed up”. It is a question that can be quantified role by role, and that is exactly what the audit does.

For a business leader, the risk is not being replaced by a machine. It is being overtaken by a competitor who structured their data while you waited for things to settle down. That race is won or lost on organisation, not on technology.

Sovereignty

Keeping control of your working tools

Short answer

How can you tell that you are still in control?

By one thing only: you can change supplier within a few days without stopping production. If the answer is no, you do not have a tool, you have a dependency. Everything else — hosting, contracts, certifications — follows from this test.

Diagram of a large network in which a central cluster stays enclosed in a frame, connected to the rest by only a few links, with an amber node inside.

Staying in control does not mean cutting yourself off: it means knowing exactly which links cross the boundary, and being able to break them.

The four things to keep in-house

Your raw and cleaned data. It is the only asset that gains value over time. It must never be stored solely with a third party.
Your business rules. Written down, versioned, readable by a human. If they exist only in the instructions given to a model, they disappear with it.
Your supplier accounts. In your name, with your means of payment. Never in the provider's name, even during the engagement.
The ability to judge the output. At least one person in-house must be able to say whether the result is good, without asking the provider.

Governance

How to govern AI without building a bureaucracy

Four rules are enough for most SMEs. They fit on one page and can be put in place in one meeting.

A named owner

One person, not a committee. They do not need to be technical; they need to be listened to and to be able to say no.

Four indicators, not forty

Time saved on a measured task, error rate observed, real monthly cost, number of uses stopped. The last one is the most revealing.

A quarterly review

This is where uses are approved, extended or stopped. A use that has no owner by the second review is stopped by default.

A register of uses

Who does what, with which tool, on which data. Without this register, none of the other three rules can be applied.

Frequently asked questions

The risk questions that keep coming up

Will AI replace my employees?

AI replaces tasks, not entire jobs. It first takes over work that is repetitive, structured and involves little decision-making: data entry, sorting, first drafts, document search. Roles made up mostly of these tasks will change and need support. Roles that rely on judgement, customer relationships and legal responsibility shift towards checking and oversight, but do not disappear.

Is my data used to train the models?

That depends entirely on the contract you have signed. Consumer offerings often provide for conversations to be reused, whereas business offerings and access through an application programming interface (API) generally exclude it. It is a clause to check supplier by supplier, before any deployment, and to check again whenever the terms change.

Can you use AI without sending your data outside Europe?

Yes. Capable models run on European servers, and some can run on your own infrastructure. The choice depends on how sensitive the data concerned is: not all data requires the same level of protection, and hosting everything in-house is unnecessarily expensive.

What does the EU AI Act mean for an SME?

Up to date as of 10 October 2026. The EU AI Act (Regulation (EU) 2024/1689, amended in July 2026) classifies uses by level of risk. An SME that uses AI tools currently has a general obligation: to take measures so that its teams understand these tools, with no level to guarantee and no certificate to obtain. Certain practices have been prohibited since February 2025, and since August 2026 manipulated content (“deepfakes”) that you distribute must be disclosed. Most office uses entail no other obligation. High-risk uses, such as screening job applications, access to credit or employee monitoring, will be subject to stricter obligations from 2 December 2027 and deserve a dedicated review before any deployment.

How do you keep control of a tool developed by a provider?

By requiring three things from the contract stage: ownership of the code and data, direct access to supplier accounts in your name, and operating documentation sufficient for a third party to take over. A provider who refuses any of the three is selling you a dependency, not a tool.

Shadow AISpotting and governing undeclared AI use.AI usage policyAn annotated outline, section by section.The EU AI Act for SMEs, date by dateWhat applies, to whom and from when, with sources.The countermeasures planHow these responses become a costed, sequenced plan.OpportunitiesThe other half of the picture: what you stand to gain.AI audit servicesDiagnostic, audit and projects: how these risks are measured, then dealt with.Questions and answers on AI in businessData, the EU AI regulation, informing employees: the short answers.

Next step

Take stock before the incident

The audit puts on the table what your teams already use, and what it really exposes you to.

Book 30 minutes Take the AI maturity test