Five costly AI mistakes SMEs are making today

With the recent news that UK AI start-ups will be able to compete for a share of a new £100m government fund that can help improve public services, organisations are being encouraged to take this opportunity as a means to introduce AI into their business operations. According to the Department of Science and Technology 2026, 80% of UK businesses are neither using AI nor planning to. Among those companies who have begun utilising AI tools, the use remains shallow and uneven. Cybersecurity resilience firm FLR Spectron has identified five most common AI mistakes SME organisations are making when it comes to utilising AI effectively.

Lack of quality usable and structured data
When asked what stands between them and AI, SME leaders name skills, relevance, cost and security – data is rarely cited as a barrier. Yet across FLR Spectron’s Systematic Review 2026, data-related barriers rank near the top of documented, operational barriers to adoption. This is an original finding from the 1,607-claim dataset, indicating many SME leaders are unaware of the role data plays in successful AI adoption. As AI is a multiplier, it amplifies what is already in place.

“Data sprawled across various formats and systems is a huge barrier for effective AI adoption, in any business. An AI tool needs access to the full picture, so it is important to build high quality data in a connected and structured format to avoid offering a fragmented data set which cannot be read.” says Fabio Carvalho, Head of AI at FLR Spectron. Government research found that data quality was overwhelmingly identified as the most important data characteristic for organisational success, and that stronger data foundations are associated with higher levels of AI adoption.

Uncertainty of where AI should be applied
Many SMEs are adopting AI reactively due to industry pressure, because competitors are already utilising it or because it’s currently dominating the headlines. However, it is clear that organisations are often left uncertain of where AI should be applied and so no rollout plan is put in place, which can ultimately lead to low adoption across the business, unused expensive tools and insecure staff usage.

As uncertainty over where AI applies is the second most commonly evidenced barrier to adoption among UK SMEs, clarity is required by starting with a baseline to replace that uncertainty with specifics. “This can look like creating a data inventory, identifying employee skills baseline, a process map of workflow and eventually an AI tools shortlist before investing in one or multiple tools. Once the baseline is in place, leaders can pick one priority use case and address anything that would prevent the use of AI for that process,” explains Fabio.

Lack of employee skills training
One of the main overlooked risk areas for SMEs using AI is a lack of responsible ongoing employee training in how to use the tools safely and effectively. Businesses may not see a perceived return on investment in AI with poor adoption or inconsistent use because staff do not understand how to use them effectively, or lack the skills to do so. Between 2024 and 2025, £7.4m of public funding was made available to UK SMEs for AI training; only £381,096 was awarded owing to weak demand (DSIT, 2026). This is despite the scale of the need, as half of employers are unsure what AI training is relevant to their business, and 70% of businesses report no investment in staff training at all, up from 58% a year earlier (DSIT, 2026). High standard training in newly acquired tools will work in some part also as security risk reduction; helping employees to spot when AI may be incorrect, knowing what data is safe to input and what good practice looks like. Investing in the skills of the people using AI in a business is fundamental to the success of it working for SMEs today.

Overlooking AI as a new cyber attack entry point
As SMEs adopt AI tools, they’re also expanding their vulnerability to cyber attacks. Modern threat actors are increasingly targeting AI systems directly – through prompt injection, data poisoning, or exploiting poorly secured integrations between AI tools and business systems. Businesses that don’t factor AI into their existing cybersecurity strategy are leaving a growing, and often overlooked, entry point wide open to being exposed to data breaches. “AI adoption should be treated with the same approach as any other piece of newly introduced business software by being assessed, approved and monitored centrally to ensure cyber safety and compliance.” says Fabio. “Bringing in AI through individual departments and not looping in security or IT teams can create a ‘shadow AI’ issue with blind spots that can look like unvetted tools connecting to company systems, unmanaged data flows and lack of knowledge on what permissions are being authorised.”

Not being ready to adopt AI
Finally, the last costly mistake SMEs are making when it comes to adopting AI ties in most if not all of the above points, and that is simply not being ready to make the investment. With accurate data systems not in place, uncertainty on where AI can be utilised to improve internal efficiency or processes, and a company not able to commit to investing in team training, AI adoption can be a huge jump into the unknown. The businesses that are extracting genuine value from AI are the ones that build the data, processes and capability beneath it first.

How SMEs can get ready for AI
At SME scale, getting ready for AI is not a grand transformation but a sequence of small moves: a baseline diagnostic, targeted fixes around priority use cases, and specific tools deployed against clear success metrics:

• Start with the problem, not the tool
• Audit what is already happening in the business
• Focus on data governance
• Build a simple AI usage policy
• Involve security and/or IT teams from day one
• Train staff before rollout
• Review tools and permissions regularly

The research is clear on the challenges SMEs are facing, but it is possible for businesses to work through those challenges and begin to scale what works. The SMEs that do this will be the ones to benefit from future AI investment.