An AI risk matrix for SMEs: impact against control

In my recent article I listed five AI risks SMEs need to watch (as do larger businesses): vendor, supply-market, legal, implementation and strategic risk. Now, back from my very rewarding and busy Spanish solar eclipse road trip, I'll add a consultancy cliché: The 2x2 matrix is here! Cliché, maybe, but it does provide a modest framework to think about risk and using your time well.

Not all risks deserve the same amount of management attention. Some are quite serious, but mostly outside of your control. Some are limited but very manageable. You should of course focus on what is both important and controllable. But don't treat this matrix as fixed. Part of the trick is moving important stuff into your control, or making risk lower impact.

The top-left quadrant is where you need options. Avoid lock-in. Keep data portable. Know your fallback provider or go open source/local. Don't build your whole process around one black box.

The bottom-right quadrant is where you need hygiene. Simple rules. Basic training. Clear ownership. Don't waste time, but don't let it sit there.

The top-right quadrant is of course where the real work starts. That is where your AI setup will succeed or fail: choosing the right use cases, designing them properly, managing legal/accountability issues, embedding the tools into real workflows, and making sure people actually use them.

As with other business decisions, you need to watch the skies above you while staying down to earth (incidentally, that's BrA1n's motto too ;-). This framework helps in a modest way.

The big external risks may make the headlines. The manageable internal risks make the value.

Next, I'll run down the manageable and significant risks that deserve your time.