Ai adoption in the UK has moved past the experimental stage, though how far past depends entirely on which survey you read. The government's own DSIT-commissioned research, based on 3,500 business interviews, found that only 16% of UK firms have made a deliberate, strategic Ai deployment with a defined business purpose, while the British Chambers of Commerce puts active use above half once every embedded feature and free chatbot account is counted. The two figures are not contradictory. They are measuring different things, and that gap is exactly where most SME owners get stuck.
Even businesses that have adopted are not seeing the returns they expected. The same DSIT research found that 75% of adopters report improved workforce productivity and 57% have built new or improved processes, yet only 12% report an increase in revenue. That is the productivity-profit gap, and it usually opens up because a tool was bought before five decisions were made, not after.
What are you actually buying this to fix
DSIT lists lack of identified need as the single most common barrier among businesses that have not adopted, cited by 71%, ahead of limited skills at 60%. That finding cuts both ways. Businesses that buy a tool without a defined problem tend to end up doing what 85% of current adopters already do: using Ai for natural language processing and text generation, the accessible end of the technology, while agentic Ai, the kind that actually acts on your systems rather than drafting a document, sits at just 7% adoption.
Before you sign anything, write down the specific task the tool is meant to remove or shorten, and the number you expect to move as a result. If you cannot name either, you are buying a subscription, not a solution.
Where your data goes once you hit send
Every Ai tool your business signs up for is, in data protection terms, exactly as accountable as any other supplier. The Information Commissioner's Office has been clear that there is no such thing as an 'Ai exemption' from data protection law: if a tool trains on, stores, or generates outputs containing personal data, UK GDPR applies in full. The ICO has also said it intends to support SMEs specifically with data protection due diligence for cloud-based Ai tools and services as part of its 2026/27 work, which suggests the regulator does not think most small firms are currently doing that homework well.
The scale of the problem inside most businesses is larger than owners assume. Microsoft's own research found that 71% of UK employees have used unapproved consumer Ai tools at work, and 51% continue to do so every week, yet only 32% expressed concern about company or customer data going into those tools. A separate KnowBe4 study put UK unapproved use at 55%, with one in ten employees knowingly entering sensitive company information into an unauthorised tool. The decision here is not whether to allow Ai. It has largely already happened without you. The decision is which tool gets sanctioned, what data is allowed into it, and what an impact assessment for that tool actually says before it goes live.
Who is accountable once it is live
Ownership of Ai tools tends to default to whoever asked for the budget, which is rarely the same person who understands the data risk. That matters because the evidence on who goes around policy first is not reassuring. TrustedTech's research with Censuswide found that senior decision-makers are more than twice as likely to use unapproved Ai tools as the staff they manage: 65% against 31%. Directors setting the policy are often the ones breaking it first, usually because they have the broadest system access and the least patience for asking permission.
Before you buy, name one person accountable for the tool: for the contract, the data it touches, and the decision to switch it off if it stops earning its keep. That does not need to be a new hire. It usually needs to be an existing role with the authority made explicit, in writing, rather than assumed.
Whether your people can actually use it
The FSB found that 46% of small firms say they or their staff lack the knowledge to use Ai successfully, and the picture further up the size scale is not much better: one analysis of official ONS, DSIT and BCC data found that 97% of organisations report an Ai skills gap, with two in three employees having had no formal Ai training at all. A tool bought for a team that has not been shown what it is good for tends to get used for the easiest, lowest-value tasks and then quietly dropped once the novelty wears off.
Budget for training as a line item alongside the licence, not as something to fit in later. A short session on what the tool actually does well, and what it should never be trusted to do unsupervised, usually pays for itself faster than the tool does.
How you keep governing it after the contract is signed
None of the above is a one-off exercise. The Federation of Small Businesses found that 92% of small firms using Ai still have concerns about data security, copyright and liability, even as adoption has climbed to 55% from 20% in 2023, and it is now calling on government for standardised supplier disclosures setting out where data is stored, whether it trains on it, and who is liable when the tool gets something wrong. Until that exists as a requirement on suppliers, the due diligence sits with you.
For businesses that want a structured way to hold that governance in place, ISO/IEC 42001 is now a certifiable standard for Ai management systems, with BSI the first body accredited by UKAS to certify against it in the UK. Full certification is not a prerequisite for borrowing the discipline: a named owner, a documented risk assessment per tool, and a review point built into the contract renewal date will do most of the work. Given that shadow Ai, employees using tools without approval, is estimated to affect around half of UK organisations, the governance has to survive the point where the initial excitement about the tool wears off, not just the sign-off meeting.
None of these five decisions require a large budget or a compliance department to answer honestly. They require the tool to follow the decision, not the other way round. Most of the UK businesses currently disappointed with their Ai spend bought the software first and are still working through this list afterwards. Answer it before you sign, and the productivity gains that three-quarters of adopters already report have a much better chance of turning into the revenue gains that, for now, only 12% do.