AI delay puts SMEs at risk of cyber, compliance gaps

By Francis Allan L. Angelo

Small- and medium-sized enterprises (SMEs) that postpone artificial intelligence (AI) adoption risk falling into an “AI divide,” creating serious competitive and operational vulnerabilities, according to Alvin Toh, co-founder and chief marketing officer of Straits Interactive.

Toh warned in an interview that the gap between early AI adopters and laggards is widening, with productivity and security implications.

“Early adopters are already seeing efficiency gains that compound over time,” Toh said, noting that while some companies are still manually handling tasks like drafting proposals or replying to FAQs, others use AI to automate those functions and offer customer support 24/7.

A recent Deloitte study found that 78% of SMEs in the Asia-Pacific region already use at least one AI tool, highlighting its role in enabling companies to do more with fewer resources.

Cybersecurity is another growing threat, with attackers leveraging AI to launch convincing phishing attacks and bypass outdated security systems.

“To counter AI-enabled attackers, SMEs need AI-powered defenses,” Toh said.

He also cautioned against “shadow AI,” where employees use free, unauthorized tools such as ChatGPT for work, potentially uploading sensitive data without company oversight.

“This exposes the business to data leaks, intellectual property loss and violations of privacy laws like the Philippine Data Privacy Act,” Toh said.

To illustrate the risks, Toh cited a case where a Singapore car grooming company was fined by the Competition and Consumer Commission of Singapore for posting AI-generated fake reviews using real customer data without consent.

Toh emphasized that SMEs without formal AI strategies leave themselves vulnerable to data protection violations and regulatory scrutiny.

“As such, it is critical for SMEs to begin building responsible AI practices early,” he said.

For SMEs with limited budgets, Toh recommends starting small by identifying one time-consuming, low-complexity task where generative AI could make a meaningful impact.

He advised companies to run a 30-day pilot using a trusted, paid AI tool—ideally setting aside PHP 5,000–10,000 (USD 88–176) for a business subscription.

“Most businesses start to see results within two weeks,” he added.

Afterward, businesses should create a lightweight governance checklist and, crucially, train employees on safe and effective AI usage.

“There are short courses on AI for business professionals at the Asian Institute of Management (AIM) and Adamson University,” Toh noted.

He dispelled the myth that AI is only for large enterprises, stating that SMEs can benefit from AI by applying it to targeted use cases.

“The true productivity gains of AI lie in helping your existing team work better, not when you try to replace them,” he said.

Toh highlighted data leakage and intellectual property risks as the top AI-related threats SMEs overlook, especially when using free, public AI platforms.

“Employees could be unknowingly making company secrets public,” Toh warned, explaining that data input into free AI models could be used to train the systems, risking exposure to others.

To prevent such breaches, Toh recommends establishing approved AI tools, standard operating procedures for validating outputs, and staff training on what is safe to share.

Operating across ASEAN presents another layer of complexity, as countries adopt different AI and data privacy rules.

Toh pointed to Singapore’s Model AI Governance Framework and the Philippines’ proposed Artificial Intelligence Act (HB 10944) as examples of evolving regional legislation.

“If an employee in Vietnam uses an AI tool to process data from a customer in Singapore, which country’s rules apply?” Toh asked.

He advised SMEs to align their operations with the strictest applicable regulations to simplify compliance and avoid cross-border legal exposure.

Universities, according to Toh, are key to closing the AI skills gap, particularly through industry partnerships and accessible, practical training.

While progress is evident in urban areas like Metro Manila, Toh acknowledged that SMEs in rural provinces still face digital skills barriers.

“Our recent National AI Prompt Design Challenge in the Philippines drew nearly 600 participants from 40 schools and 20 industries,” he shared, underscoring growing national interest in AI competency.

Straits Interactive has partnered with institutions like Adamson University and First City Providential College to develop certificate programs and expand AI initiatives beyond major cities.

Toh said these collaborations aim to help business professionals apply AI tools in specific domains to deliver measurable business outcomes.

Looking ahead, he predicted that success for SMEs will hinge on their ability to implement AI strategically and responsibly.

“AI won’t replace you, but someone who knows how to use AI might,” he said.

He explained that businesses must blend tools, training and governance to integrate AI where it drives the most value.

In the Philippines, this will be particularly transformative for the business process outsourcing (BPO) sector, enabling back-office roles to shift toward more value-added work.

“Toh envisions SMEs working alongside AI agents—customer service teams handling more inquiries, bookkeepers catching errors faster, sales teams guided by data insights,” he said.

AI literacy, he stressed, will be critical in orchestrating human and virtual collaboration for better outcomes.

“To thrive, SMEs must start small, think practically, and move steadily forward,” he concluded.