73% of HR professionals already use AI for recruiting and onboarding.
Small and mid-sized business (SMB) HR teams are adopting AI tools faster than large enterprises, but they often do so without formal policies in place, security checks, or clear strategies for use. While 73% of HR professionals use AI for recruiting, onboarding, and administrative tasks, most SMBs still lack basic AI governance.
As a result, some of the most sensitive data in the organization, such as employee records, candidate information, payment details, and performance reviews, increasingly pass through consumer-grade AI tools that no one has selected, vetted, or can audit.
In practice, HR teams often paste resumes, performance documents, and compensation details into general AI tools to summarize, rewrite, or score them. If AI platforms store, share, or leak this data, organizations might never realize the exposure has occurred. Risks include accidental data leaks and prompt-injection attacks, where malicious input tricks AI into revealing confidential information.
“What most HR leaders don't realize is that consumer AI tools do more than summarize resumes. They keep training data, compare patterns across sessions, and expose organizations to prompt injection risks that even enterprise models find hard to fully prevent,” says Žilvinas Girėnas, head of product at nexos.ai. “HR teams should not wait for perfect policies. They must act now by restricting sensitive data uploads to unapproved tools and auditing current usage.”
The governance gap inside SMB HR
Across the industry, SMB HR teams work inside a maze of separate workflows, with each recruiter using different AI tools on their own. Recruiters and HR leads sign up for separate AI accounts, run candidate data through tools like ChatGPT or Claude, and build screening processes that others on the team cannot see or copy.
And the results speak for themselves. Research from Gartner and Phenom shows 88% of HR tech leaders have not seen much business value from AI investments even though adoption is widespread. Many teams pay for AI licenses while recruiters still manage spreadsheets, copy candidate data between tools, and rely on gut instinct for final decisions.
At the same time, a growing majority of small businesses use AI regularly, but most still have no formal policies to guide how it is used. This governance gap keeps growing.
“The people creating AI workflows in HR are not acting recklessly. They are solving real problems with the tools they have,” says Girėnas. “But when five team members use five different AI tools without shared workflows, visibility, or guardrails, it creates fragmentation, risk, and wasted spend. It is the shadow IT problem again, now involving personal data.”
A compliance time bomb in hiring
The governance gap is no longer just an operational issue — it is becoming a legal liability. A wave of state-level AI hiring rules is taking effect in the US, and most SMB HR teams are unprepared.
- Illinois amended its Human Rights Act effective January 1, 2026, to cover any employment use of AI that results in discrimination, requiring employers to notify candidates and provide opt-out options.
- Colorado's AI Act (SB24-205) introduces obligations for organizations deploying “high-risk AI systems” in employment decisions, including mandatory bias audits.
- New York City's Local Law 144 requires annual bias audits for automated employment decision tools.
- The US Equal Employment Opportunity Commission (EEOC) has clarified that under Title VII, employers remain liable for discriminatory outcomes caused by AI tools, even if provided by a third-party vendor.
- Multiple states now require disclosure and transparency when AI is used in hiring decisions. Individual ChatGPT accounts cannot meet these requirements.
For small HR teams, this means informing candidates which tools are used in hiring, why they are used, and how they may affect screening decisions.
“The challenge for HR teams isn't adopting AI – it's doing it with the right infrastructure and governance,” says Girėnas. “A head of talent acquisition at a 200-person company should not need an engineering team to automate candidate screening or piece together three AI tools hoping for compliance. They need a single platform to build workflows in minutes, with governance, audit trails, and compliance built in from the start.”
Burnout and tool sprawl: A vicious cycle
HR teams often use commercial AI tools out of the box largely because they are overwhelmed by their workload and the pressure to deliver faster hiring results. Recruiter burnout is at 68%, with many describing their tech stack as “one platform for every single step” rather than a coherent system. Instead of reducing stress, each new tool adds logins, workflows, and tabs, pushing recruiters closer to exhaustion.
AI use in recruiting has jumped from 26% to 53% in one year, but much of this growth is ad hoc and reactive. Under pressure to fill roles, recruiters sign up for AI tools that seem helpful, often using personal accounts without IT or legal review. The result is not just fragmentation, but rising burnout from constant context switching and growing exposure to compliance failures. A single candidate might be handled by several sourcing platforms, multiple scheduling tools, and a personal ChatGPT account before anyone even picks up the phone.
“Burnout and tool sprawl feed each other,” adds Girėnas. “The more exhausted recruiters become, the more often they reach for quick-fix tools that create new silos and extra work. Instead of one clear workflow, they're juggling tabs, logins, and half-finished automations. The real fix isn't adding yet another point solution — it's designing a small number of shared, well-governed workflows that actually reduce clicks, context switching, and stress for HR teams.”
Skills-based hiring raises the stakes
The pressure on HR teams is increasing due to the rapid shift to skills-based hiring. Forbes and other analysts name it as a top workplace trend for 2026, and LinkedIn data shows candidates use AI to highlight experience around skills rather than credentials.
This change requires AI tools that evaluate skills, not just keywords, going beyond resume scanning to measure real ability. AI-powered interview analytics improve hiring accuracy by 40%, and predictive analytics improve talent matching by 67%. But these features are often locked in expensive platforms that cost six figures and require complex IT projects to set up.
SMB HR teams use consumer AI tools that summarize resumes but cannot run detailed skills assessments, integrate with applicant tracking systems (ATS), or generate the audit trails new laws require. This means candidates show up with AI-polished applications, while hiring teams make decisions with basic tools and little visibility into why the tools rank one profile above another.
Four actions SMB HR teams can take this week
SMB HR teams use AI extensively but often lack governance, exposing employee and candidate data to security, compliance, and bias risks. Many of these risks can be reduced quickly by:
- Conducting a 30-minute AI audit. Ask every HR team member which AI tools they use, including free tools, browser extensions, and personal ChatGPT accounts.
- Creating a simple AI policy. Use free templates from SHRM, AIHR, HiBob, or Triple AI Agency. At a minimum, define approved tools, permitted data, and who reviews AI-assisted decisions.
- Banning sensitive data in unapproved tools. Prohibit team members from entering employee PII, compensation data, performance reviews, and candidate personal data in any unapproved AI tool.
- Consolidating before adding new tools. Review if existing systems can cover new use cases before buying point solutions. Underused tools and overlapping platforms increase cost, risk, and burnout.
ABOUT NEXOS.AI
nexos.ai is an all-in-one AI platform for business teams that brings model access, agent automation and governance together, so your entire organization and its teams can turn AI potential into business results. Through a unified workspace and no-code automation, nexos.ai connects leading AI models to enterprise systems, data sources and workflows while enforcing security, governance and compliance at scale. Headquartered in Vilnius, Lithuania, nexos.ai was founded by the creators of Nord Security and is backed by Index Ventures, Creandum, Evantic Capital, Dig Ventures and leading European angels.