Artificial intelligence dominated US business headlines again this week in March 2026, with new state regulations now active, adoption rates surpassing 57% of small businesses, and a majority of those businesses still lacking any formal AI policy. For small business owners, the question has shifted from "should we use AI?" to "are we legally exposed if we do?"
AI adoption in US small businesses: the March 2026 snapshot
The numbers are striking. According to data compiled by Business.com in early 2026, more than 57% of US small businesses now use AI tools in some capacity — up from 36% in 2023. Employees are saving an average of 5.6 hours per week through AI-assisted work.
But adoption has outpaced governance. The same research found that 77% of small businesses using AI have no formal AI policy. That gap is now a legal liability.
New AI laws that took effect in 2026
Two significant state-level regulations came into force at the start of 2026, directly affecting small businesses:
Illinois HB 3773 (effective 1 January 2026): Requires employers to notify workers when AI is used in hiring decisions, performance reviews, promotions, or disciplinary actions. Failure to disclose exposes companies to employee complaints and potential legal action.
Colorado AI Act (effective 1 February 2026): The most comprehensive state-level AI law in the US to date. It establishes obligations around "high-risk AI" systems — those that make consequential decisions about people — and requires impact assessments, transparency, and appeal mechanisms.
A coalition of 42 state attorneys general is actively pursuing AI violations, and enforcement is expected to intensify throughout 2026. The compliance overhead for small businesses has been estimated at approximately 17% of AI system costs — meaning a $10,000 annual AI software budget could generate $1,700 in compliance expenses. California's upcoming requirements alone could cost small businesses around $16,000 per year.
What every US small business owner needs to understand
The regulatory landscape creates four specific risk areas that an IT specialist can help you navigate:
1. AI in hiring and HR If your business uses any AI-assisted screening tool — even a basic resume filter or scheduling bot — you may be subject to the Illinois disclosure requirements. An IT specialist can audit your HR tech stack and help you implement the necessary notification protocols.
2. Data privacy and AI training data Many AI tools are trained on or ingest company data. Understanding what data your AI tools are sending to third-party servers — and whether that data includes customer PII — is now a compliance necessity, not an optional IT concern.
3. Cybersecurity exposure from AI tools Employees using consumer AI tools (such as public chatbots) for work tasks may inadvertently share confidential business information. An IT specialist can implement acceptable-use policies, configure approved AI environments, and train staff on safe AI use.
4. Vendor contracts and liability When an AI system makes a mistake — a wrong recommendation, a biased output, a data breach — who is liable? The answer often lies in the vendor contract. IT specialists and legal counsel can review these agreements before you sign, identifying clauses that may leave your business exposed.
The upskilling opportunity
The situation is not purely about risk. Businesses that invest in AI governance are also better positioned to capture the productivity gains that AI offers.
The data supports this: managers who use AI tools save an average of 7.2 hours per week, compared to 5.6 hours for individual contributors. Companies with formal AI training programs are achieving faster, more consistent productivity improvements — and reducing the employee anxiety that comes with poorly managed AI adoption.
Only 12% of US small businesses plan to reduce headcount because of AI in the next 12 months, according to PwC's 2026 AI Business Predictions. The majority are investing in upskilling instead. That means helping employees work with AI effectively is now a strategic priority — and an IT specialist is the right partner to design and deliver that capability.
What to do now
If your small business is using AI tools but lacks a formal policy, the following steps are a practical starting point:
- Audit your AI tools: List every software that uses AI in your operations, including tools that may not advertise AI prominently
- Check state applicability: If you hire, operate, or market in Illinois, Colorado, or California, specific regulations already apply
- Draft an acceptable-use policy: Define which AI tools employees may use for work and what data may be input into them
- Review vendor data terms: Understand what your AI vendors do with the data you provide them
- Consult an IT specialist: An independent technology professional can assess your current setup, identify exposure, and recommend a compliance roadmap
Not sure if your business is AI-compliant? An IT specialist on Expert Zoom can conduct a fast, practical audit of your technology setup and help you build a policy that keeps you covered. Consultations are available online.
Disclaimer: This article provides general information and does not constitute legal or professional IT advice. For guidance specific to your business, consult a qualified IT specialist or attorney.
