By Chuck Gallagher — Business Ethics Keynote Speaker and Trainer
TL;DR The SAS and IDC Data and AI Impact Report found that 49% of organizations cite non-optimized cloud data environments as their primary barrier to AI progress, followed by insufficient data governance at 44% and a shortage of skilled specialists at 41%. Chuck Gallagher, business ethics keynote speaker and AI speaker and author, argues that for small and medium-sized businesses, the data foundation problem is not a technical problem — it is an accountability problem, and it creates ethical exposure that most SMB leaders have not yet quantified.
I want you to imagine a scenario. Your business deploys an AI system to help evaluate customer creditworthiness. The system produces scores quickly and confidently. You use those scores to extend credit or decline applications. Six months later, a pattern emerges: the system has been systematically disadvantaging applicants from certain zip codes. Not because anyone programmed it to do so, but because the training data reflected historical biases that the system learned and amplified. You had no idea. You had no governance process that would have caught it. And now you have a legal problem, a reputational problem, and a customer relationship problem — all from data you never fully audited.
That scenario is not hypothetical. It is a description of what happens when organizations trust AI systems built on weak data foundations. The SAS and IDC Data and AI Impact Report documents this risk with uncomfortable precision. The report found that only 10.2% of organizations have fully optimized data infrastructure. Nearly 14% are still operating with siloed or ad hoc data management — meaning basic frameworks are either absent or too fragmented to govern AI outputs reliably. For small businesses that lack dedicated data teams, those numbers reflect the rule, not the exception.
As a Business Ethics Keynote Speaker, I See the Data Problem Differently
As a business ethics keynote speaker, I do not approach the data foundation problem the way a technology consultant would. I approach it the way I approach every institutional risk: by asking what human behaviors, pressures, and rationalizations led to the current state. In most SMBs I have worked with, the data governance gap is not the result of ignorance. It is the result of prioritization. Business owners understand, at some level, that their data is messy. They rationalize that the AI tools they are using are smart enough to handle it, or that the risk is low enough to accept for now, or that governance can be addressed after the implementation is complete.
Those rationalizations are the same ones I spent years warning corporate audiences about before AI was part of the conversation. Need plus opportunity plus rationalization creates the conditions for ethical and organizational failures. The need here is to move quickly and gain competitive advantage from AI. The opportunity is the availability of powerful tools that can be deployed without rigorous data preparation. The rationalization is the belief that the tools are sophisticated enough to compensate for the foundation they sit on.
They are not. The SAS and IDC report is explicit on this point: weak cloud environments, siloed data, and limited governance are consistently holding back AI adoption across every type of organization surveyed. The most advanced AI use cases — fraud detection, personalized health care, predictive risk management — only succeed when powered by high-quality, well-governed data. The same principle applies at SMB scale. Better data governance produces better AI outputs. Worse data governance produces confidently wrong AI outputs. And confidently wrong is more dangerous than obviously wrong.
What Does ‘Good Enough’ Data Governance Actually Look Like for an SMB?
The SAS and IDC research found that since 2024, data centralization has surged to become the number one challenge in AI implementation. For large organizations, that means restructuring enterprise data architecture. For SMBs, it means something far more achievable: knowing where your data lives, who controls it, how it is collected, and whether it is accurate enough to trust as an input to decisions that affect people.
Start with inventory. Before any AI tool can be evaluated for trustworthiness, an SMB needs to know what data it is feeding that tool. Where does the data come from? How old is it? Does it reflect your current customer base or a historical one that may not represent who you serve today? Has it been audited for errors, duplicates, or gaps? These are not data science questions. They are business questions, and any leader running an organization that uses AI to make consequential decisions needs to be able to answer them.
The second step is governance assignment. Governance sounds like a bureaucratic concept, but at SMB scale it is simply an answer to a straightforward question: who is responsible for the accuracy and integrity of the data this AI tool uses? In a small organization, that person may wear multiple hats. But the responsibility needs to be explicit and named, not assumed or distributed without accountability. The SAS and IDC report found that only about a quarter of all organizations — regardless of size — have a central group dedicated to AI governance. The percentage for SMBs is almost certainly lower. That is the gap that creates liability.
The third step is output review. AI systems built on imperfect data produce imperfect outputs. The ethical and practical requirement is not to achieve perfect data before deploying AI — that bar will never be met. It is to build review processes that catch consequential errors before they reach customers, employees, or business decisions. The smaller the organization, the more personal the harm when an AI error affects a specific customer relationship. A human review checkpoint is not bureaucratic friction. It is the ethical safeguard that makes AI adoption defensible.
The Agentic AI Warning SMBs Need to Hear Now
The SAS and IDC report includes a warning about agentic AI — systems that do not just generate outputs but take autonomous actions — that every SMB leader needs to understand before it becomes relevant to their business. The report found that 52% of organizations are already using some form of agentic AI, and that its progress will stall when faced with non-optimized cloud data environments, poor data governance, or talent shortages. More consequentially, agentic AI requires organization-wide process redesign because it scales one agent at a time and integrates into workflows rather than sitting alongside them.
For SMBs, the practical implication is this: the data foundation you build today — or fail to build — will determine whether you can safely use the more powerful AI tools coming in the next three to five years. Agentic AI operating on siloed, ungoverned data is not a productivity tool. It is a liability amplifier. The organizations that invest in data governance now, even modestly, will be positioned to use these technologies responsibly when they arrive. The ones that defer governance until the tools are already deployed will face the same pattern I described at the beginning of this article — but at higher speed and larger scale.
As a business ethics keynote speaker and AI speaker and author, the message I want every SMB leader to take from the SAS and IDC research is this: the data foundation is not a technology project. It is a leadership decision. And like every leadership decision, its consequences will be proportional to the care taken in making it.
Frequently Asked Questions
Q: What is a data foundation, and why does it matter for AI?
A: A data foundation refers to the quality, organization, governance, and accessibility of the data that AI systems use to produce outputs. According to the SAS and IDC Data and AI Impact Report, organizations with strong data foundations — centralized, well-governed, consistently managed — achieve significantly better AI outcomes than those with siloed or ad hoc data management. Only 10.2% of organizations surveyed have fully optimized data infrastructure, while nearly 16% are still operating at the lowest levels of data management maturity.
Q: What are the biggest data-related barriers to AI adoption for SMBs?
A: The SAS and IDC report identified three primary barriers that apply directly to small and medium-sized businesses: non-optimized cloud data environments, cited by 49% of organizations; insufficient data governance, cited by 44%; and a shortage of skilled specialists, cited by 41%. For SMBs without dedicated IT or data teams, all three barriers tend to compound each other — ungoverned data is harder to migrate to optimized cloud environments, and without specialists, governance processes are difficult to establish or maintain.
Q: Can a small business use AI responsibly without enterprise-level data infrastructure?
A: Yes, but it requires deliberate choices about which AI tools to use and for what purposes. Chuck Gallagher, business ethics keynote speaker and AI speaker and author, recommends that SMBs begin with a data inventory — knowing what data feeds each AI tool, how current it is, and whether it has been checked for errors or bias. From there, designating a named accountability owner for data quality and building a human review checkpoint for consequential AI outputs provides the minimum governance structure required for responsible AI use at any organizational scale.
Q: What is agentic AI, and should SMBs be concerned about it now?
A: Agentic AI refers to systems that take autonomous action rather than generating outputs for human review. Unlike a chatbot that responds to a question, an agentic AI system might schedule meetings, send communications, approve transactions, or restructure workflows without waiting for human approval. The SAS and IDC report found that 52% of organizations are already using some form of agentic AI. For SMBs, the concern is forward-looking: agentic AI requires organization-wide process redesign and scales with whatever data governance structure — or lack thereof — already exists.
Q: How does data quality affect the ethics of AI decisions?
A: AI systems learn patterns from historical data. If that data reflects historical biases — in customer demographics, hiring decisions, pricing structures, or service delivery — the AI will replicate and amplify those biases in its outputs. The SAS and IDC report found that concerns about data privacy (62%), transparency and explainability (57%), and ethical use (56%) are top of mind for organizations deploying AI. For SMBs, the ethical implication is direct: using AI to make decisions about customers or employees based on ungoverned, unaudited data creates liability exposure that cannot be addressed after the fact.
Share Your Thoughts
I want to hear a specific answer from you. Before reading this article, could you have described, in concrete terms, what data your primary AI tools are trained on or currently pulling from? Could you have named who in your organization is accountable for that data’s accuracy? If the answer to either question is no, you have identified your starting point. Share your situation in the comments below, and I will respond. The five questions that follow are designed to help you think this through before the next AI deployment decision lands on your desk.
Five Questions for Further Thought and Consideration
- If an AI tool your business relies on produced a systematically wrong output for six months before you detected it, what would the damage look like, and could you trace it back to a data problem?
- Who in your organization knows the most about the data quality of your AI systems, and does that person have the authority and resources to improve it?
- What would responsible data governance look like in a business of your size? What is the minimum viable version that would protect you from the most serious exposures?
- If agentic AI — systems that act autonomously rather than generate outputs for review — were deployed in your organization today, which processes would be most at risk if the underlying data were flawed?
- The SAS and IDC research found that data centralization has become the top AI implementation challenge globally. How centralized and consistent is your own business data, and what would it take to improve it?
