Nationwide Survey: 60% of Businesses Use AI but Lack Formal Risk Policies

Businesses are embracing artificial intelligence faster than they are putting formal rules around its use, according to a new Nationwide survey of small and mid-market business owners.

Six in 10 business owners say employees use public AI chatbots or writing tools for work-related tasks, while just 36% have written policies governing employee AI use and 37% provide training on responsible use. The findings point to a growing gap between how quickly businesses are adopting AI and the safeguards they have in place to manage its use.

More than a third (35%) believe employees are using unauthorized AI tools for work, potentially leaving business owners with less visibility into how the technology is being used across their companies. Only 27% of business owners say their businesses have rules governing what company or customer information can be entered into AI tools, while just 25% have procedures for verifying AI-generated information before it is used for business decisions.

"AI is already becoming part of how many businesses work, but the policies around its use haven't necessarily caught up," said Bobbie Goldie, Vice President of Commercial Cyber at Nationwide. "Business owners need to know which tools employees are using and set clear expectations around what information can be shared and how AI-generated work should be reviewed."

AI-enabled scams are reaching businesses

The same technology businesses are adopting internally is also being used by cybercriminals to target them from outside. Nearly one-third (31%) of small and mid-market business owners say their company has been targeted by a scam or fraud attempt using generative AI within the past 12 months.

More than half of independent insurance agents (52%) say they have observed an increase in claims related to generative-AI scams or fraud attempts over the same period. Business owners expect the challenge to grow as the technology changes what cybercriminals can do. Nine in 10 or more say AI is making it easier for cybercriminals to launch attacks at scale, while 88% say AI-enabled attacks have become more sophisticated over the past year.

Preparing for changing cyber risks

As AI changes both how businesses operate and the cyber threats they face, many still have work to do to prepare. Only 35% of owners say they have an up-to-date incident response plan.

"Small and mid-market businesses are often balancing cyber preparedness with a long list of other business priorities," said Goldie. "That makes it especially important to understand where the business may be exposed, make sure employees know what to do and have a plan in place before an incident occurs. Business owners should also talk with their insurance professional about how their risks are changing and whether their protections are keeping pace."

Business owners recognize they have more to learn. Eighty-two percent say they need more information and resources to protect their businesses from AI-enabled cyberattacks. Regularly reviewing cyber risks, preparedness and insurance needs can help businesses keep pace as both their use of AI and the threats around it change.