AI Risks by Industry: What Actually Applies to Your Business

If you've noticed that most "AI risk" content assumes you're running a hospital, a law firm, or a bank, you're not imagining it. Most existing coverage describes AI risk using a handful of high-profile sectors and treats everyone else as an afterthought.

That's not because your business is safe by default. It's because the risk you carry as, say, a professional-services or retail operator often gets described using someone else's vocabulary. This guide breaks AI risk down industry by industry, so you can tell which warnings genuinely apply to a business like yours and which are noise from someone else's headlines.

Why "AI risk" is not one thing

Coverage of AI risk tends to talk about it as a single topic, when it is really four or five distinct categories that show up in different mixes depending on what a business does.

Client or customer data exposure happens when sensitive information ends up inside an AI tool that stores it, trains on it, or hands it to a third party under terms nobody read closely. Output accuracy and professional liability is the risk that AI-generated content is wrong, but gets treated as finished because it reads with confidence. Bias in decisions about people covers any case where AI influences hiring, lending, pricing, or eligibility, and treats similar people inconsistently. Intellectual property risk covers what an AI-generated output might infringe, or whether your own inputs get used to train someone else's model.

These categories map closely to how the U.S. National Institute of Standards and Technology frames the problem in its AI Risk Management Framework, which groups AI risk around harm to people, harm to an organisation, and harm to a wider ecosystem, rather than treating "AI risk" as one single bucket. Working out which of these categories actually applies to your business matters more than knowing which industry gets the most headlines.

What that looks like for an accounting practice, specifically

Morgan owns a nine-person accounting practice. She had read three different "AI risks in business" articles, each clearly written with a hospital or a law firm in mind: patient records, legal privilege, professional indemnity claims from a misdiagnosis. None of it read as her problem, so she filed AI risk under "not really about me" and moved on.

Then a staff member started using a general AI writing tool to draft client-facing financial summaries, pasting in real client account details to get a more specific first draft. That is the same underlying risk a healthcare article would call "patient data" and a legal article would call "privileged information," just filed under a heading Morgan had been skipping past.

Once she recognised the shape of the risk instead of the industry label attached to it, she moved that workflow to a business-tier tool with a written no-training-on-your-data clause, and had the team stop pasting real account numbers into anything else. Nothing about her business became a hospital or a law firm in the process. The risk had simply been sitting under someone else's heading the whole time.

Industry by industry: what actually applies

The sections below cover the industries most small and mid-size businesses fall into, and describe what AI risk genuinely looks like in each one, not the generic version. If your business spans more than one of these, more than one section will apply.

Professional services: accounting, bookkeeping, consulting

For an accounting, bookkeeping, or consulting practice, the primary AI risk rarely looks like a data-breach headline. It looks like a staff member pasting a client's account numbers, tax details, or financial statements into a general AI tool to get a faster draft summary or letter. That information can end up stored on a vendor's servers under terms nobody read closely.

A second, quieter risk sits in reliance. An AI-drafted summary of a client's financial position that contains a wrong figure or a misapplied rule, reviewed quickly because it "looked right," carries the same professional liability exposure as if a junior staff member had made the same error. Neither risk requires a dramatic AI failure. Both come from ordinary daily use.

Legal services

Legal work gets more AI-risk coverage than almost any other sector, and for good reason. An AI tool that invents a case citation that does not exist, presented with confident, correct-looking formatting, has already led to real sanctions against lawyers who filed it without checking. In 2024, the American Bar Association issued its first formal ethics guidance on generative AI, confirming that a lawyer's existing duties of competence and confidentiality apply in full when AI tools are used, including verifying AI-generated content before relying on it.

The less-discussed risk sits earlier: privileged or confidential client information entered into a general AI tool loses the controlled handling that legal privilege depends on. For a solo practitioner or small firm without a dedicated research team, the discipline of verifying every citation against a primary source before it reaches a filing or a client is not optional.

Financial services

For lenders, insurance brokers, and financial advisers, the sharpest AI risk is often bias in decisions that affect real people: credit approvals, premium pricing, or risk scoring that an AI model influences without anyone testing whether it treats similar applicants consistently. Credit scoring and creditworthiness assessment are explicitly listed as high-risk uses under the EU AI Act's Annex III, meaning some jurisdictions already impose formal testing and explainability obligations for exactly this kind of decision.

A second risk is model reliance in advice generation: an AI-drafted summary of a product or a market position stated with more certainty than the underlying data supports, then repeated to a client as fact.

Healthcare and health-adjacent services

Healthcare AI-risk coverage tends to focus on clinical decision-making, and that is real: an AI tool that suggests a diagnosis or treatment path with a confident tone but no clinical validation behind it is a genuine patient-safety risk, not a hypothetical one.

But a large share of healthcare-adjacent risk is administrative, not clinical. A practice using AI to draft patient correspondence, insurance claims narratives, or intake summaries is handling health information just as sensitive as a clinical record. Data protection regulators, including the UK's Information Commissioner's Office, have published specific guidance on how existing data protection law applies when AI processes personal data, including health information, regardless of whether a clinician is the one operating the tool.

Retail and e-commerce

For retail and e-commerce, the AI risk that gets the least coverage is often the most common: an AI-powered chatbot or product-description generator making a claim about a product, a price, or a policy that is not accurate, reaching a customer as if it were the business's own statement, because it is. The U.S. Federal Trade Commission has warned specifically that a business is responsible for the accuracy of a claim made by an AI system it deploys, the same way it would be responsible for a claim made by a staff member.

A second, quieter risk is dynamic pricing or personalisation models that end up treating customer segments inconsistently in ways nobody explicitly designed, discovered only after a customer or regulator notices the pattern.

HR and recruitment

Using AI to screen resumes, rank candidates, or draft interview questions puts a business squarely inside employment-discrimination law in most jurisdictions, whether or not anyone involved thinks of it as an "AI decision." Recruitment and employment decisions, including resume screening and candidate ranking, are explicitly named as high-risk under the same EU AI Act Annex III referenced above, meaning some jurisdictions already require testing and documentation for exactly this kind of tool.

For a small business with no dedicated HR or legal function, the practical risk is treating an AI screening tool as neutral by default, rather than testing whether it produces consistent outcomes across candidates.

What to do about it, regardless of industry

The industry differences above point to one practical takeaway: work out which risk categories your business actually touches, rather than which industry's AI-risk headlines you have or have not seen.

• Map what categories of sensitive data (client financial details, health information, candidate data, payment details) your business actually handles day to day.
• List every AI tool currently in use across the team, including ones nobody formally approved, and check what each one's terms say about using your inputs to train its models.
• Set a verification step for any AI output that reaches a client, customer, candidate, or regulator, scaled to how much damage a wrong answer could do.
• If AI touches any decision about a person, such as hiring, pricing, credit, or eligibility, check whether it treats comparable people consistently, not just whether it is fast.
• Check whether your sector's regulator has published anything specific on automated decision-making or AI use, since general privacy law rarely covers every angle.

Related reading: our AI governance by region.

Try our free AI Privacy Risk Scorer to score your current AI tool setup against data-privacy best practice.

Does every industry face the same AI risks?

No. The underlying risk categories, including data exposure, output accuracy, bias in decisions about people, and intellectual property, are shared across industries, but which one dominates depends on what a business actually does. A retailer's biggest exposure is rarely the same as a law firm's, even though both face genuine AI risk.

How do I know which AI risks actually apply to my business?

Start from what your business handles, not what industry label it wears. If you handle sensitive client or customer data, data exposure is relevant. If AI touches a decision about a person, bias and consistency are relevant. Most businesses carry two or three of the risk categories, not all of them equally.

Is AI risk only a real concern for regulated industries like healthcare and finance?

No. Healthcare and finance get more coverage because the consequences are visible and the sectors are heavily regulated, not because the underlying risk is exclusive to them. A retail business handling customer payment data or a recruitment process using AI screening carries a comparable version of the same risk under a different heading.

What is the most common AI risk across small businesses generally?

Unverified output reaching someone outside the business, whether that is a client, a customer, or a candidate. It is rarely a dramatic AI failure. It is an ordinary AI-drafted answer, treated as finished because it read as confident, that turns out to be wrong or misleading.

Do I need a formal AI policy if my business is small?

A written policy is not a universal legal requirement, but a documented understanding of what AI tools your team uses, what data goes into them, and who checks the output before it goes out is worth having at any size. It is what you would need to produce if a mistake ever became a dispute.