Why the FSB’s warning matters for SMEs as the UK pushes ahead with AI policy, adoption, and business transformation The UK’s AI conversation is moving quickly, but small firms do not adopt new technology because government sounds enthusiastic. They adopt when the business case is clear, the risks feel manageable, and trust is earned in practical terms.
That is why the FSB press release, “Burnham Government’s AI reset must build trust in AI among small firms, says FSB,” is worth close attention. The key word is trust. It does not suggest that SMEs need more hype around AI. It suggests they need more confidence that AI can be used safely, sensibly, and with proper accountability.
According to the FSB, if confidence among small firms is not built into the UK’s AI push from the start, policy ambition could move ahead of business reality. For SMEs, that gap matters. Smaller firms often lack the in-house legal, compliance, and technical resources that larger organisations can use to test new tools aggressively. If trust is weak, adoption will remain cautious, fragmented, or poorly governed.
For SMEs, trust in AI is not an abstract policy issue. It is shaped by straightforward operational questions. Can staff use AI tools without exposing sensitive customer or business information? Are suppliers clear about what happens to submitted data? Who is responsible if AI-generated output is inaccurate, misleading, or commercially damaging? Will the tool save time, or create extra work and extra risk?
Those questions sit directly in the Cybersecurity and governance space. A small firm with weak access controls, no AI usage policy, and little oversight of staff behaviour is more likely to run into trouble, even if the tool itself looks impressive. In practice, AI risk often begins with ordinary actions such as employees pasting confidential information into public tools, relying on unchecked outputs, or signing up to third-party services without any review of retention, privacy, or access terms.
This is why trust and Cybersecurity are so closely linked. SMEs are far more likely to adopt AI confidently if they can see basic safeguards around its use. These safeguards do not need to be complex. They need to be clear, proportionate, and realistic for smaller organisations.
A credible AI reset for small firms should include plain-English guidance on safe business use. Many SMEs do not need another abstract strategy document. They need practical advice on what staff can enter into AI tools, which tasks need human review, how to assess suppliers, and what kinds of information should never be shared with public platforms.
It should also include a baseline expectation of AI governance. For most SMEs, that does not mean building a formal ethics board. It means having a short internal policy that covers approved tools, restricted uses, sensitive data handling, and responsibility for checking outputs. Even a simple policy can reduce risk significantly.
Security-first adoption support also matters. Trust grows faster when AI use sits alongside sensible business controls such as multi-factor authentication, role-based access, approved software lists, audit visibility, and supplier due diligence. Small firms are much more likely to use AI productively when it feels contained within a secure operating environment rather than added informally on top of weak existing practice.
Vendor clarity is another important issue. SMEs need suppliers to be transparent about data retention, model training, access permissions, and where data is processed. If these basics remain vague, smaller firms will either avoid adoption or take risks they do not fully understand.
Human oversight must remain central. AI can support productivity, drafting, summarising, and administrative efficiency, but it should not quietly replace human judgement in sensitive legal, financial, HR, or customer-facing work. For SMEs, trust in AI grows when people know where the boundary sits between assistance and decision-making.
The FSB’s position is important because it recognises that small business adoption cannot be taken for granted. It must be enabled. That is especially relevant in the 2026 Cybersecurity environment, where concerns around shadow AI, sensitive data leakage, unclear provider terms, and overreliance on automation are already becoming more visible.
This means the Government’s AI reset should not be measured only by how ambitious it sounds. It should be judged by whether small firms feel more capable of using AI safely and more confident that the surrounding risks are understood and manageable.
