Guide for helping businesses assess AI compliance, IP protection, and risks: Self-assessment

Copyright © 2026 International Chamber of Commerce (ICC)ICC holds all copyright and other intellectual property rights in this collective work, and ICC must be cited as the source and copyright holder mentioning the title of the document, •Express written permission must be obtained for any modification,adaptationor translation,for any commercial use, and for use in any manner that implies that anotherorganisationor person is the source of, or is associated with, the work.•The work may not be reproduced or made available on websites except through a link tothe relevant ICC web page (not to the document itself). Permission can be requested fromICC throughipmanagement@iccwbo.org. Table of contents Introduction.......................................................................................................................................................................4About this guide...........................................................................................................................................................4Instructions........................................................................................................................................................................5Start: What is your role regarding AI tools?............................................................................................................6Section U–For AI users.............................................................................................................................................6Section D–For AI developers..................................................................................................................................6Section B–For AI users and developers..............................................................................................................7Additional guidance.......................................................................................................................................................9Guidance on basic IP coverage.............................................................................................................................9Commercial use of AI-generated outputs–What good looks like................................................................11Confidential business information and AI systems–Why this matters.......................................................11Data protection and privacy–What you need to know..................................................................................12 Introduction Artificial intelligence (AI) has the potential to significantly improve productivity, efficiency andaccelerateinnovation forbusinessesof all sizes. From automating routine tasks to supporting YetAI adoption amongsmall-and medium-sized enterprises (SMEs)remains uneven and below itspotential.Studiesacross G7and OECDcountrieshave shownthat,while large companies arerapidly integrating AI, SMEs continue to lag behind,both in adoption rates and in the strategic use AI readiness is closely linked with digital readiness,furtherwidening theproductivity and competitiveness gaps betweenSMEs and large companies.1In many countries,the share of largecompanies using AI isthree times higherthan SMEs,withfewer thanone in five SMEsreportinguseofAI, and adoption is often limited to isolated, informalor experimental use cases rather than Where SMEs do adopt AI, it is frequently without a clear internal strategy or governanceframework. AI tools may be introduced attheteamor individuallevel (e.g.,marketing, sales, HR orIT) without shared visibility across the organisation, clear rules on acceptable use, or safeguardsfor intellectual property, confidential business information and personal data. Studies consistently At the same time, the regulatory landscape for AI is evolving rapidly.For example, the EU AI Actintroduces a horizontal, risk-based framework for AI systems, while many other jurisdictions aredeveloping or updating rules on AI, data protection and digital governance. For SMEs, navigating About this guide Thisguideis designed to respond to these realities. Its objective is not to discourage AI adoption orto provide a legal compliance checklist. Rather, it aims to help SMEs ask the right questions,understand where risks may arise and take practical, proportionatesteps to use AI responsibly and In the absence of a global framework for AI, the regulatory landscaperemainsfragmented.The EUAI Act is referenced in several questionsbecauseitprovidesthe most comprehensive andhorizontal regulations on data and AI, making it a usefulbenchmark forgood practice.Many other By combining a question-based self-assessment with guidancein plain language, theguidesupports SMEs in embedding AIintheir business operations in a way that protects core assets, Please note:This questionnaire is intended as an initial self-assessment tool to help raiseawareness of key AI compliance and intellectual p