The Human in Charge: what 53 small companies told us about running AI
A snapshot of AI governance in SMEs. October 2026.
of companies had already been asked about their AI use by a client, customer or partner.
23 of 39
9%
had changed anything concrete because of the EU AI Act.
4 of 44
Six numbers
Six key numbers to take into account when dealing with AI governance in small organisations.
asked by clients or partners
23 of 39
made a concrete AI Act change
4 of 44
have a person check AI output
of 53
keep a written record of AI use
of 53
brought in AI by founder decision
base to confirm
can’t prove the human check
12 of 43
Who answered, and how
Between 15 and 21 September 2026 we put eight open questions to people whose organisations use AI. 62 replied. We analysed the 53 that described their own organisation, and excluded 9: three pitches, four that answered only two questions, one hypothetical, and one adviser answering on behalf of clients.
45 of the 53 were the founder, CEO or owner, answering for the company they run. Of the 19 who gave a size, 10 were solo and 9 were between two and fifty people. Of the 31 who gave a country, 17 were in the US, 4 in the UK and 5 in the EU. By what they do: 19 use AI in their own work, 16 sell AI-based products, 13 are agencies and 5 are consultants.
Limitations
Everyone chose to reply, and the answers were free text, then coded by category. Each percentage is based on the people who answered that question, so the base varies between 29 and 53. At around 40 answers, any figure could be roughly 15 points higher or lower. This describes this group. It must not be read as representative of the whole market.
Customers are asking before the regulators
59%were asked about their AI use by a client, customer or partner
The questions arrive in security reviews, procurement forms and sales calls. Buyers want to know where their data goes, whether it is kept or used for training, and whether a person checks what the AI produces.
Meanwhile only 4 of 44 companies had changed anything concrete because of the AI Act. Of the 29 who gave a view on enforcement, 7 expect the first pressure on small firms to come through customers, contracts and insurers. It is not universal: 9 of 39 said nobody outside had ever raised it.
“Small companies will feel the AI Act as paperwork from their customers before they ever hear from an authority.”
Founder of a custom software firm, United States
The check sits on the output, not the tool
64%have a person read or approve AI output
Just over half described set steps for adopting a new tool. But the safeguard most of them pointed to was not a procurement gate. It was a named person standing between the AI and the outside world.
Only 4 of 53 had no approval step at all. Half keep a written record of where AI is used, and 7 more said their code or their tools are the record. Nobody named a dedicated AI governance role. In almost every case it was the founder.
“Our approval process doesn’t take place before adoption, but before shipping: nothing an AI produces goes out until the person accountable for it has read it.”
CEO of a software company, Greece
The pattern 11 of 53 described
The hard part is proving the human was there
28%can’t find out how to prove the check, or where an AI label belongs
Having a review step is one thing. Showing a client, months later, that it happened is another. 12 of 43 raised one or both of those. A further 17 of 43 asked whether the rules apply to them at all, or who is responsible when AI gets it wrong: the model provider, the software vendor or the customer.
What they can’t get answered
Of 43 who answered. Several raised more than one.
“And if the important thing is human oversight, how do I prove six months later that I really did all of that?”
Co-founder of an AI publication, Serbia
It has barely reached the working week
59% said the Act had changed nothing in how they work. 32% said it changed how they think or what they document, but not what they do. That leaves 9%: the four companies that changed a practice, two of them by adding AI labels under the transparency rules. Of the five EU-established firms, one had changed anything.
The regulation has been clear since 2024. What has not arrived is any reason to act on it that feels more urgent than the next invoice.
Three camps, one common point: what a company can show
We asked how enforcement will play out. Of the 29 who gave a view, most fell into three camps.
“The first real consequences for small firms won’t come from a regulator. They’ll come from a client, a licensing board or an insurer asking to see the list and finding there isn’t one.”
Co-founder, AI training firm and brokerage, United States
Five lessons for a small company
1. Prepare for your customers’ questions. They arrive before any regulator does, in writing, with a return date near the top.
2. Write down the list, where the work happens. Not a policy document. A list of what you use and who owns it.
3. Put the check on the AI output. The companies that felt in control were not the ones with the strictest procurement. They were the ones with a named person before anything shipped.
4. Let automation earn its freedom. Record-only first, approval second, autonomy last, and only after clean audits.
5. Keep evidence that the check happened. This is the one almost nobody had. The review usually happened. It just left no trace.
Check your own company
- Could you answer a client’s AI question in writing today?
- Is there a list of your AI tools with an owner for each?
- Does a named person read AI output before it goes out?
- Could you prove it six months from now?
- Do you know where an AI label is needed?
How to read this study
Show the human behind it.
Art50 records who reviewed a piece of work and when, and seals it so you can show it to a client later. Fifty-three companies told us the review almost always happened. It just left no trace.
