Foreword
A year that moved faster
than most people expected
I write this at the end of a year that moved faster than most people expected. AI went from being a buzzword in boardrooms to something people were actually using every day — in their businesses, on their phones, in their workflows.
But not everyone kept up. And that gap — between businesses that moved and businesses that didn’t — is now very visible.
This report is my honest take on what happened in 2025, what it means for UK businesses, and what I think is coming in 2026. I have spent over 20 years working with businesses across the UK on their technology. I have seen the patterns. I know what works and what doesn’t.
This is not a technical document. It is a practical one.
Section 1
The AI Acceleration —
what actually happened in 2025
At the start of 2025, most UK business owners were in one of three places:
- Curious but cautious — “We’re watching it, not ready yet.”
- Experimenting — Using ChatGPT or Copilot for a few tasks, nothing structured.
- Already behind — Still running the same systems they had in 2022.
By mid-2025, something shifted. AI tools stopped being experiments and started becoming business infrastructure. Microsoft Copilot rolled out properly across Microsoft 365. Google followed with Gemini embedded into Workspace. Suddenly, AI wasn’t something you opted into — it was sitting inside the tools your team already used every day.
The businesses that had already cleaned up their data, organised their cloud storage, and trained their teams — they benefited immediately. The ones that hadn’t got very little value from tools that needed good data to work well.
“AI only works well when the basics are already in place.”
Businesses with messy file structures, no clear IT policies, and staff doing everything by habit rather than process — they found that AI either gave them poor results or created new problems on top of old ones.
The other big story of 2025 was cost. Cloud spending continued to rise. Many businesses that had moved everything to the cloud in 2022 and 2023 were now looking at bills they didn’t fully understand. Microsoft Azure, Google Cloud, and AWS all saw strong growth — but so did the number of businesses paying for services they weren’t fully using.
Section 2
Cloud Maturity in UK Businesses —
where are we now?
If I had to give UK SMEs an honest score on cloud maturity at the end of 2025, I would say most are at a 5 or 6 out of 10.
The foundation is there. Most businesses have moved away from on-site servers. Most are using cloud-based email, file storage, and some form of collaboration tool. That part is done.
What’s missing is the layer above that — using the cloud intelligently, securely, and efficiently. Here is what I see most often:
What’s working:
- Microsoft 365 and Google Workspace adoption is high
- Remote and hybrid working is now well supported
- Cloud backups are more common than they were two years ago
What’s still broken:
- Security settings are left on default — which is not good enough
- Staff are sharing files in ways that create data risk without realising it
- No one is reviewing who has access to what
- Cloud costs are not being tracked or optimised
- There is no IT strategy — just a collection of tools
This is not a criticism. It reflects how fast everything moved. Businesses adopted tools quickly to survive — during COVID, during remote working, during rapid growth. The strategy part got left behind.
2025 was the year many business owners started to feel that. 2026 is when it needs to be fixed.
Section 3
The Risks That Emerged
in 2025
Three risks stood out this year more than anything else.
Cybersecurity became unavoidable. Phishing attacks got significantly more sophisticated in 2025. AI-generated emails — perfectly written, personalised, believable — started arriving in inboxes. Staff who were trained to spot badly written scam emails were suddenly much more vulnerable.
The businesses that had multi-factor authentication, staff training, and email filtering in place were largely protected. The ones that didn’t faced real consequences — data breaches, ransomware, financial loss.
The UK government continued to push Cyber Essentials certification but uptake among SMEs remained lower than it should be. Many business owners still see it as optional. It is not.
Data compliance quietly became a bigger problem. GDPR didn’t go away. AI tools started processing business data — customer information, financial records, internal communications — and many businesses had no clear policy on what was acceptable. Using a free AI tool to summarise a client email might feel harmless. But if that email contains personal data, you may have just created a compliance issue. Most business owners I spoke to in 2025 had not thought about this at all.
Overspending on technology quietly increased. The average UK SME is now paying for more software subscriptions than ever before. Many of them overlap. Many are barely used. In 2025, as budgets came under pressure, technology spend started to get scrutinised — often for the first time. The businesses that had a clear picture of what they were paying for and why were able to make smart decisions quickly. Everyone else was guessing.
Section 4
What Will and Could Change
in 2026
AI will move from tools to agents. In 2025, most people used AI as a tool — you ask it something, it gives you an answer. In 2026, AI agents will start to become mainstream. These are AI systems that don’t just answer questions — they take actions. They book meetings, send emails, update records, and run processes on your behalf. For businesses that are ready, this is a huge productivity opportunity. For businesses that aren’t, it introduces new risks around data, errors, and accountability.
Cybersecurity pressure will intensify. Attacks will continue to get more sophisticated. AI is being used by attackers just as much as it is being used by defenders. In 2026, I expect more targeted attacks on SMEs — particularly professional services firms, law firms, accountants, and financial advisers — who hold sensitive client data but often have weaker security than larger organisations.
Cloud cost optimisation will become a priority. As economic pressure continues, business owners will look much harder at what their technology is actually costing them — and what it is actually delivering. I expect a significant number of UK businesses to rationalise their tech stack — cutting what they don’t need, consolidating where they can, and actually measuring ROI on technology for the first time.
Regulation will catch up with AI. The EU AI Act came into force and its effects will be felt in UK businesses that work with European clients or partners. Even for businesses that don’t, the UK government is actively developing its own AI governance framework. In 2026, businesses using AI in client-facing processes — particularly in financial services, legal, and healthcare — should expect increased scrutiny.
Section 5
Recommendations
- Get your security basics in place — now, not later. Multi-factor authentication, email filtering, and staff awareness training are the minimum. Cyber Essentials certification is the benchmark.
- Do a technology audit. List every tool, every subscription, where your data lives, and who has access. Once you have that picture, you can make sensible decisions.
- Create an AI policy for your business. Decide which AI tools are approved, what data can be processed by them, and who is responsible for oversight. This protects you commercially and legally.
- Think about 2026 now. The businesses that are planning their AI and cloud strategy today will be significantly ahead of those who wait until they feel the pressure.
- Get proper advice — from someone with no financial interest in what you choose. Independent technology guidance is worth far more than vendor-led advice.
Closing Thoughts
The gap has never
been wider — or more fixable
2025 was a year of acceleration. The gap between businesses that are using technology well and businesses that are not has never been wider. The good news is that it is still very fixable.
The steps are not complicated. They do not require a large budget. They require clarity, prioritisation, and the willingness to treat technology as a strategic asset rather than an operational afterthought.
If you would like to talk through where your business stands, I offer a complimentary 30-minute review. No obligation, no agenda. Just an honest conversation.