Is AI dangerous for my business? The fears, checked

People ask us this in two quite different voices. Some have read a headline about AI hacking a bank and want to know whether they should unplug something. Others have just watched a colleague paste a contract into a chatbot and would quite like someone to tell them that was fine. Same question, though. Is AI dangerous for my business?

Neither yes nor no is much use as an answer, so we took the fears we hear most in offices around Dagenham and East London and checked each one against people who publish evidence rather than opinion: the NCSC, Microsoft's own documentation, the Office for National Statistics and, for one of them, the High Court. Some fall apart. Two are dead right. And the one that causes most damage day to day is the least dramatic of the lot.

The scorecard

Here's the whole article in one table. Each fear gets its own section below, with the source.

"It learns from what we type and gives it to other people"

This is the fear we hear most, and the part about the model is wrong. The NCSC's guidance on large language models is specific. A model doesn't add information from your queries to itself for other people to query. Your customer list won't turn up in a stranger's answer next week.

The part about the account is right. The same guidance says the provider can see the query, stores it, and will almost certainly use it to develop the service at some point. The NCSC's September 2026 blog on shadow AI says much the same of consumer AI services in general: what staff put in may be stored, retained or used to improve the service, outside your own security arrangements, unless specific privacy controls are in place.

Business accounts change the terms. Microsoft's enterprise data protection page, updated in May 2026, says organisational use of Copilot and Copilot Chat sits under its Data Protection Addendum with Microsoft acting as a data processor. Prompts, responses and the data Copilot reaches through Microsoft Graph aren't used to train foundation models. So the risk lives in which login somebody used far more than in which AI they used. We went through the account question, and the Bing searches that sit under separate terms, in our piece on staff using AI tools at work.

"Copilot will show staff everything"

Half true, and the true half is useful to know. Microsoft's Copilot privacy documentation says it only surfaces organisational data that a user has at least view permission to. It can't open a folder the person couldn't open themselves.

The catch is that "could already open" is usually a far bigger set than anybody meant. A folder shared with the whole company for one afternoon in 2021 was safe while nobody remembered it existed. An assistant that searches everything a user can reach finds it in seconds. Copilot exposes that problem. It doesn't create it. Our Copilot readiness guide covers the clean-up, and the order to do it in.

"Criminals with AI can hack anyone now"

The NCSC has published two formal assessments of this, and both are calmer than the headlines. The May 2025 assessment says AI will almost certainly make parts of cyber intrusion more effective and efficient, and make attacks more frequent and more intense. Then it says how. Through evolution and enhancement of existing techniques, it judges, rather than new kinds of attack. It also judges fully automated, end-to-end advanced attacks unlikely before 2027. Skilled people still have to stay in the loop.

For a ten-person firm, that's the overstated part. Nobody needs to defend against a robot army. The attacks are the ones you already know: phishing, stolen passwords, software nobody updated.

What has changed is how good those attacks look. The NCSC's January 2024 assessment said that by 2025, generative AI would make it difficult for everyone, whatever their level of cyber security understanding, to judge whether an email or a password reset request is genuine. Its own table puts the biggest uplift for less-skilled criminals in social engineering and phishing. The old advice to look for bad spelling is finished. A fake invoice can now arrive in flawless English, in your supplier's tone of voice, written by somebody who spent five minutes on their website first.

Speed is the other change. The 2025 report says the gap between a vulnerability being disclosed and being exploited has already shrunk to days, and that AI will almost certainly shrink it further. It also predicts a digital divide between systems that keep pace and a large proportion that are more vulnerable.

Which side of that line a small business ends up on comes down to unglamorous things. Updates applied within days, not months, which our patch management guide covers. Multi-factor authentication on every account, so a phished password isn't enough by itself. Email filtering that checks a link at the moment somebody clicks it, the subject of whether the Microsoft 365 spam filter is enough. And one rule that beats the best-written fake invoice ever sent: before paying changed bank details, phone the supplier on a number you already had. Invoice fraud worked before AI and it works the same way now.

"It will replace our staff"

This one isn't really a security question. It comes up in the kitchen, though, so it belongs here.

The Office for National Statistics published its fullest look yet at AI in UK businesses on 20 July 2026, built on its business survey from June. Among firms with ten or more employees, self-reported AI use has gone from around 12% in late 2023 to around 35%. It's shallow use, mostly. The average adopter uses about 1.6 AI technologies, up from 1.4.

On jobs, the ONS is plain. Most businesses say AI hasn't changed their overall headcount, with around half reporting no impact at all and the share highest among firms of 10 to 249 people. Just under 7% of medium-sized businesses reported a fall. Among businesses using AI to improve their operations, which is the commonest use, 63% saw no change and 6% a decrease. The ONS also points to the Bank of England's Decision Maker Panel, which found in January 2026 that for most firms AI had made no material difference to employee numbers over the previous three years.

Roles do change. Over half of businesses using AI image processing reported effects on administrative or clerical roles. And only 11% of businesses had trained more than half their staff on AI. That's the number we'd worry about. Your team will use these tools whether or not anyone shows them where the edges are.

"It makes things up"

True. The vendors say so themselves, which surprises people.

Microsoft's transparency note for Copilot, updated in August 2026, describes AI services as fallible and probabilistic. It names ungrounded content, meaning content that appears correct but isn't present in the source material, as a known risk of large language models. Even when Copilot is summarising your own documents, Microsoft says, it may include information that isn't in them, and users should take caution and use their best judgement.

The clearest British example came out of the High Court on 6 June 2025. In Ayinde v London Borough of Haringey, heard by the Divisional Court alongside Al-Haroun v Qatar National Bank, the judges dealt with court papers citing authorities that didn't exist. In Ayinde, five cases cited in the grounds of claim turned out to be fake. In Al-Haroun, the claimant accepted that citations in his witness statement had come from publicly available AI tools, legal search engines and online sources, many of them fictitious or not saying what they were quoted as saying. Paragraph 6 of the judgment is worth reading if anyone in your office uses these tools for work. It says freely available generative AI tools can produce coherent, plausible answers that turn out to be entirely incorrect, cite sources that don't exist and quote passages that aren't in the genuine source.

Lawyers have a professional duty to check, and the court spent pages on what happens when they don't. The office manager drafting a contract clause, a method statement or a reply to a complaint has the same exposure and none of the training. Our view is simple. AI can draft. A person who knows the subject signs it off, and anything carrying a figure, a date, a regulation or a name gets checked against the original before it leaves the building.

"The AI tool could be turned against us"

Most people don't have this fear yet. It's the one growing fastest.

Prompt injection means hiding instructions in something an AI tool reads, a web page or an email or a shared document, so the tool does what the attacker wrote instead of what your user asked. The NCSC's 2025 assessment says direct and indirect prompt injection, alongside software flaws and supply-chain attacks, can already be used to exploit AI systems and get into the wider systems they're connected to.

A chat box that only answers questions can't do much harm with a hidden instruction. Agents can. These are the tools that act rather than talk: send the email, move the file, raise the payment. The NCSC's shadow AI blog spells out what that means. If an attacker exploits a vulnerability in an agent, they get the same data, services and privileges the agent legitimately has.

Microsoft says its enterprise protections include safeguards against prompt injection, and it also tells customers to check the privacy statement and terms of use of any agent they use inside Copilot. In the Integrated apps section of the Microsoft 365 admin centre, admins can see what data and permissions each agent needs. Our advice for a small firm is to give an agent the narrowest access that does the job, keep a person approving anything that sends money or data out of the business, and keep that list of allowed agents short.

"Banning it keeps us safe"

Tempting, and it doesn't work. The NCSC's shadow AI blog says outright that it isn't recommending people stop using AI, and that unapproved use is unlikely to disappear completely. Where official tools don't meet what people need, it expects staff to keep reaching for ones nobody approved. In a nine-person office a ban mostly moves the chatbot from the work laptop to somebody's phone, where you can see even less of it.

The NCSC's alternative is a positive security culture, so people tell you what they're using, plus approved tools that actually do the job. For a small business that's one business account everyone uses, a short list of what never goes into it, and nobody getting told off for owning up to a bad paste.

What it costs with us

Nothing on our price list is called AI, and we're not inventing a package for this article. The controls that answer the real risks above are already in the managed plans.

Essential, at £50 per user per month, covers 24/7 monitoring, automated patch management and endpoint antivirus, which deals with the speed problem. Professional, at £77, adds EDR, email security and anti-phishing, staff phishing-awareness training and a quarterly IT strategy review. That review is the right meeting for deciding which AI your business uses, on which accounts and for what. Complete, at £108, adds 24/7 out-of-hours support and managed detection and response. All three run monthly on 30 days' notice, and the full rate card is on the pricing page.

Microsoft 365 licences, Copilot included, are supplied at list price and we don't mark them up. Tightening sharing and permissions before anyone switches Copilot on is ordinary tenant work, described on our cloud and Microsoft 365 page: £86 an hour on a plan, £126 without one, or £167 out of hours with a two-hour minimum. All prices exclude VAT. If you'd like a second opinion first, the free IT health check is the place to start.

Five things to do this week

Ask your team which AI tools they use and which account they're signed in to, and make it clear nobody is in trouble. Pick one business tool and make it the easy option. Switch on multi-factor authentication anywhere it's still missing. Tell everyone that an email changing bank details gets a phone call to a number you already had. And make it a rule that nothing an AI wrote goes out with a figure, a date or a citation that a person hasn't checked.