A policy defines what AI tools are approved, what data can be used with them, and what's off-limits.

• Yes, we have a documented, signed AI policy
• We have informal guidelines, nothing formal
• No policy, employees decide on their own
• We haven't thought about this yet

Examples: customer lists, financial records, contracts, employee data, proprietary processes, or passwords.

• Definitely not, we have controls preventing this
• Unlikely, but we can't say for certain
• Probably yes - employees have access to both
• Yes, and we're not sure what was shared or where it went

Shadow AI - tools used without IT's knowledge - is one of the fastest-growing data risks for small businesses.

• Yes, we have full visibility and an approved list
• We know the main tools but not everything
• No, employees choose their own tools freely
• I have no idea what tools are being used

Training helps employees recognize what's safe to share and how to spot AI-assisted phishing or fraud.

• Yes, regular training is part of our onboarding
• We've done some training, but it's not consistent
• No formal training, employees figure it out themselves
• Training hasn't been on our radar yet

Detection and response capabilities determine how quickly a business can contain a data exposure event.

• Yes, we have monitoring and alerts in place
• We'd probably find out eventually, but not immediately
• Probably not, we do not have visibility into this
• No, and I do not know how we would find out