Start

WHAT THE GUIDANCE SAYS

Check before you
switch it on.

AI is arriving in ordinary businesses.

A small workshop office with a laptop open on a wooden desk beside a paper notebook, while the owner, seen from behind, looks over shelves of tools and stock near a bright window — AI-generated image, not a photograph of a real person or place.

The Census Bureau says 19.8% of US businesses reported using AI in early May 2026, and 37% of firms with 250 or more employees. Federal guidance from NIST points to the same few questions before any of it goes live.

ASK FIRSTthen adopt

Check a use

Keep in mind

Check what it writes
Keep secrets out
Know your supplier
Three questions before any AI tool

THE SHORT ANSWER

Useful, but
not unsupervised.

Generative AI brings a short list of known risks.
NIST's guidance explains why they matter.

ACCURACY

Read it before you rely on it

NIST describes confabulation: generative AI systems that confidently present erroneous or false content, also called hallucinations.

Check a use

DATA

Keep sensitive details out

NIST lists data privacy as a generative AI risk, including leakage and unauthorized disclosure of personal and other sensitive data.

First steps

SUPPLIERS

Ask what it is built on

AI tools rely on third-party datasets, pre-trained models and software libraries, which NIST warns might not be properly vetted.

See the numbers

A QUICK USE CHECK

What do you want
AI to do?

Pick a planned use to see how much care US guidance points to. The bar shows how many extra checks the guidance raises before you start.

Use check

Choose a planned useDrafting a social media postSummarizing internal notes in a public chatbotA chatbot answering customersAnalyzing customer recordsScreening job applications

Drafting a social media postRead it first

No personal data needed. The main risk is accuracy: NIST says generative AI can confidently present false content, so check names, dates and claims before you publish.

Summarizing internal notes in a public chatbotStrip the secrets

NIST lists leakage and unauthorized disclosure of sensitive data among generative AI risks. Read the provider's terms and keep confidential details out of public tools.

A chatbot answering customersPlan for misuse

NIST describes prompt injection: attackers crafting inputs that make the system misbehave, either typed in directly or hidden in data the tool retrieves. Ask what happens if it is tricked.

Analyzing customer recordsAssess the risk

NIST's data privacy risk covers leakage and de-anonymization of health, location and other personal data. Decide what the tool really needs before any records go in.

Screening job applicationsAudit and notify

In New York City, an automated employment decision tool needs a bias audit within one year before use, public audit results and notice to candidates. Check the rules where you hire.

Sources: NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (July 2024); NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools.

Based on NIST's Generative AI Profile (NIST AI 600-1) and New York City's rules on automated hiring tools. General information only, not legal advice.

TWO NUMBERS WORTH KNOWING

Adoption is rising,
fastest at big firms.

Two figures from the Census Bureau's
Business Trends and Outlook Survey.

≈ 20%

Businesses using AI, as of May 3, 2026

AI use hovered between 17% and 20% of US businesses from December 2025 to May 2026, and 20% to 23% expected to be using it within six months.

US BUSINESSES · CENSUS BUREAU

37%

Firms with 250 or more employees using AI

Among firms with 100 to 249 employees the figure was 32%. Fewer than 20% of firms with four or fewer employees reported using AI.

LARGE FIRMS · CENSUS BUREAU

The Census Bureau changed its question in November 2025 to ask about AI use in any business function, rather than only in producing goods or services.

FOUR STEPS BEFORE YOU START

Small, checked,
and written down.

None of these needs a big budget. They turn the risks NIST lists for generative AI into a short routine for any new tool.

A hand closing a grey folder of customer paperwork on a desk beside a laptop showing a blank login screen — AI-generated image, not a photograph of a real person or place.

Step 1

Name the job it will do

Start from a task, not a tool, and write down what a good result looks like.

Step 2

Decide who checks the output

Agree who reads AI drafts and answers before they reach a customer, and how errors get corrected.

Step 3

Read the terms before the data

Find out whether the provider stores or reads your inputs, and keep sensitive details out of public tools.

Step 4

Ask the supplier what it is built on

Ask which models, datasets and software libraries the tool uses, and who vetted them.

HIRING TOOLS

Hiring tools
raise the bar.

Hands holding a pen over a printed draft, marking corrections line by line next to an open laptop — AI-generated image, not a photograph of a real person or place.

New York City's Local Law 144 says employers and employment agencies may not use an automated employment decision tool unless it has had a bias audit within one year before use, information about the audit is public, and candidates have been notified.

The city's Department of Consumer and Worker Protection began enforcing the law on July 5, 2023, and notice must be given 10 business days before the tool is used. Rules vary by city and state, so check the places where you hire.

Questions

Questions on the way

How many US businesses use AI?

The Census Bureau's Business Trends and Outlook Survey put the national rate at 19.8% of businesses as of May 3, 2026. Larger firms are much more likely to use it: 37% of those with 250 or more employees.

What is an AI hallucination?

NIST calls it confabulation: a generative AI system producing and confidently presenting erroneous or false content. It is one reason to check outputs before relying on them.

Do I need a bias audit to use AI in hiring?

New York City's Local Law 144 requires employers and employment agencies using an automated employment decision tool for NYC candidates to have a bias audit within one year before use, publish the results and notify candidates. Rules elsewhere differ.

What is prompt injection?

NIST describes attackers crafting malicious prompts and entering them directly, or hiding them in data an AI-connected app is likely to retrieve, so the system behaves in ways its owner did not intend.

Are small businesses catching up on AI?

Not yet. The Census Bureau found AI use rose among firms with at least 20 employees between December 2025 and May 2026, but did not change significantly among smaller firms.

Destination

Where the facts come from

Updated October 22, 2026

Check before youswitch it on.

Useful, butnot unsupervised.