AI Is Only as Smart as Your Filing Cabinet

5 days ago

4 min read

Here's a scene I'd bet is playing out in your business this week. Someone pastes a client contract into a free chatbot for a quick summary. Nobody approved the tool. Nobody knows where that contract lives now.

I've spent more than 30 years in records and information management. Email, shared drives, and cloud storage each arrived with big promises. Each one inherited the mess that came before it. AI is no different. It just moves faster.

And your people aren't waiting for permission. Microsoft's 2024 research found that 80% of AI users at small and midsize companies bring their own AI tools. So you already have an AI program. You just didn't write it down.

"We're Too Small for AI Governance"

I hear this a lot. You don't have a compliance department or a governance committee. You have a business to run.

Fair enough. But AI governance for small business isn't a committee. It's knowing three things: what information your AI can touch, where it goes, and how long it stays. That's records management. It's your filing cabinet, just digital.

Here's the pattern I've learned to expect. AI rarely creates a new information problem. It exposes the one you already had.

Most small businesses haven't started. Gusto's 2025 survey found that only 15% of small businesses using generative AI have AI guidelines or policies.

Four Ways the Filing Cabinet Bites Back

1. What goes in doesn't come back out.

A prompt is a disclosure. Once a contract, client list, or payroll file leaves in a prompt, you can't call it back. So my first rule is simple. Decide what never goes in before you pick a single tool.

IBM's 2025 breach research found that high levels of shadow AI added about $670,000 to breach costs. And 63% of breached organizations had no AI governance policy or were still writing one. IBM doesn't break that out by company size, so treat it as a warning sign.

2. AI shows people what they could already reach.

Plenty of businesses rely on security through obscurity. Nobody can find the HR folder, so nobody worries about it. AI assistants end that. They surface whatever a user's permissions allow.

Microsoft's own guidance says to find and fix oversharing before you turn on Copilot. I'd go a step further and fix retention too. In records work, we call stale files ROT: redundant, obsolete, and trivial. ROT doesn't just leak. It feeds your AI bad answers.

3. "The AI said it" is not a defense.

Air Canada's website chatbot gave a customer wrong bereavement-fare information. A Canadian tribunal held the airline liable in 2024. It rejected the argument that the chatbot was a separate entity.

Courts are just as blunt about fake citations. In September 2025, a California appeals court sanctioned an attorney $10,000 for AI-fabricated quotes. If your chatbot, proposal, or filing is wrong, the mistake is yours. Every AI output that leaves your business needs a named human reviewer.

4. Your AI records are business records.

This is the risk owners overlook most, and it sits squarely in my field. Prompts, outputs, and meeting transcripts are information your business creates. Retention, discovery, and consent rules apply. A record is a record, no matter what created it.

The New York Times copyright case shows the stakes. In May 2025, a federal court ordered OpenAI to preserve ChatGPT output logs. That included logs OpenAI would otherwise have deleted. The court wound that order down in October 2025. OpenAI still had to keep most logs it had already saved.

AI note-takers raise their own problem. California's Penal Code §632 requires consent from all parties to record a confidential conversation. In August 2026, a federal court declined to dismiss key privacy claims against Otter, an AI transcription company. That free bot joining every call deserves a hard look.

Hiring Rules Already Reach Small Employers

This is where "too small" really breaks down. California's automated-decision system rules took effect October 1, 2025. They work through the Fair Employment and Housing Act, which covers employers with five or more employees. They also require you to keep automated-decision records for at least four years. Notice that last part. A four-year retention requirement is a records requirement.

Illinois went further. As of January 1, 2026, its Human Rights Act bars AI use that discriminates in employment decisions and requires notice. It reaches employers with one or more employees in Illinois. If your HR software offers "smart screening," that's your risk, not just the vendor's.

Governance Is How You Get the Payoff

Here's the part owners like. Governance doesn't slow AI down. Gusto found that 32% of small businesses with an AI strategy saw productivity gains above 20%. Only 14% without a strategy did. With an AI policy, it was 33% versus 15%. Those are self-reported correlations, not proof. But they match a lesson records work teaches again and again: organized information gets used.

Start With the Information Layer

You don't need an enterprise program. You need someone to answer five basic questions. Which AI tools are your people using? What data must never go in? Who can see what? How long do prompts, outputs, and transcripts stay? Does your legal hold process cover AI?

None of this is new. It's records work, applied to a new kind of system. ARMA International's Generally Accepted Recordkeeping Principles already fit: accountability, protection, retention, and disposition. For the bigger picture, see why you need to get your IG fundamentals right before AI can deliver. If you're wondering whether outside help fits a business your size, here's why the fractional model works.

When you book a conversation, we can walk through how AI-ready your records are.

This post is general information, not legal advice. Talk with your attorney about how these rules apply to your business.

Want to know what your AI can see before someone else finds out? Book a conversation, and we can look at your records together with AI in mind. Let's talk. No obligation. Just a straight conversation about where you are and what it would take to get where you need to be.