Half of SMEs use AI regularly: Legal expert warns of hidden dangers in 2026 that could cost them millions
More than half (53%) of UK SME owners now regularly turn to AI tools for business advice, with the trend strongest among younger generations: 60% of founders aged 25 to 34 said they use AI for support.
However, a new intensive study evaluating over 3,000 AI-generated responses revealed that 45% had at least one significant issue, while about 1 in 3 (31%) included missing or misleading attributions. Under the EU AI Act, organisations (including UK businesses) that place AI systems on the EU market or whose AI outputs are used in the EU can face significant penalties, including fines of up to €35m (£30m) or 7% of worldwide annual turnover for the most serious infringements.
In light of this, Kirstin McKnight, practice group leader at commercial law firm LegalVision shared the most common legal risks that business owners need to be aware of in 2026 – and how to protect themselves.
Protect your business in 2026: Legal experts share common risks facing businesses using AI
Unclear ownership and copyright risks in AI outputs
When businesses use AI to generate content, there is a significant risk that the output could unintentionally infringe on copyrighted material. Ownership of AI-generated content is often ambiguous, which can lead to disputes over who has the right to use, modify or sell the content. A high-profile legal case, Getty Images v. Stability AI, highlights the uncertainty in this area. Getty alleged that Stability AI trained its image-generation model using millions of copyrighted images without permission. In the UK proceedings, Getty’s main copyright case did not succeed, while the court found limited trade mark infringement relating to early outputs that reproduced Getty’s watermark.
To protect your business, it is essential to carefully review the licensing and terms of service of any AI tool you use. Implement internal review processes to check outputs for potential infringement, and clearly define ownership rights in contracts. Businesses should also be cautious about using AI outputs commercially when training data sources are unclear, and make sure to document all review processes to avoid disputes.
AI ‘hallucinations’ misleading business decisions
20% of AI-generated outputs contain major accuracy issues, including fabricated details and outdated information. When businesses rely on these outputs for legal, financial, or product decisions, they expose themselves to serious legal risks, including misrepresentation, negligence claims and even fines of up to €7.5m (£6.5m) for providing incorrect, incomplete or misleading information to authorities. In March 2024, a Microsoft-powered chatbot, MyCity, was reported to have provided dangerously incorrect advice that could have led business owners to break the law, including falsely claiming they could take a cut of workers’ tips or fire workers who complained about sexual harassment.
To protect against this risk, businesses should never treat AI as a final authority. It is critical to implement human review and verification processes for AI outputs before they are shared or acted upon. Clearly disclosing when content is AI-generated and avoiding sole reliance on AI for high-stakes decisions can protect both the business and its leadership.
Lack of internal AI governance is a ticking time bomb
Many businesses adopt AI tools without establishing clear policies. This lack of governance can quickly turn into a serious legal and operational risk as employees may misuse AI, input inappropriate or sensitive data, or fail to recognise harmful outputs, which could lead to data breaches or escalate into costly lawsuits.
To safeguard your business, it’s important to implement a robust company-wide AI policy that clearly defines the purposes for which AI can be used, establishes protocols for reviewing AI outputs and assigns accountability for decision-making. Treating AI as a powerful but regulated tool can prevent it from being a ticking time bomb that threatens your business.
Data privacy violations
AI systems rely on vast datasets that often include personal information about customers, employees or third parties. Using this data without proper consent or anonymisation can lead to serious violations of data protection laws, resulting in hefty fines and reputational damage.
Any business that processes personal data through AI must ensure it complies with all relevant privacy obligations. This means collecting and using only the data that is strictly necessary, keeping clear records of consent or other lawful basis for use of the information, being transparent about how data is handled to build trust with customers and stakeholders.
Rapidly evolving AI regulations and compliance risks
The fast pace of AI innovation has prompted governments worldwide to introduce new regulations, such as the EU AI Act and the Data (Use and Access) Act 2025 (DUA). Businesses that fail to comply with these constantly evolving laws risk serious legal consequences, including fines, regulatory enforcement or lawsuits. AI regulations are dynamic and vary by jurisdiction, and can sometimes apply retroactively to systems already in use.
To protect your business, it is essential to stay informed about evolving regulations, conduct regular audits of AI systems, and design strategies with flexibility so you can adapt quickly to new legal requirements as they emerge. Companies that do not actively monitor regulatory changes or embed compliance into their processes may inadvertently violate the law, even when acting in good faith.