Cybersecurity is no longer just an IT issue. For small and midsized businesses, a cyber incident can quickly become a legal, financial, operational, and insurance problem—all at the same time.
In this episode of the Cyber Brisket Podcast, Chris Engler sits down with attorney Gary Elmer to discuss the legal risks business owners may overlook until something goes wrong. From what to do immediately after a cyberattack to the growing risks surrounding artificial intelligence, contracts, and corporate structure, the conversation highlights an important reality: protecting a business requires more than good technology.
It requires preparation.
What Should a Business Do After a Cyberattack?
One of the biggest mistakes a company can make after discovering a cybersecurity incident is reacting too quickly without understanding what needs to be preserved.
The natural instinct may be to delete suspicious files, reset systems, restore backups, or immediately start making changes. But those actions can potentially destroy information that may be important to a forensic investigation.
Instead, businesses should already know who is responsible for coordinating their response.
That often includes:
- An experienced managed IT provider or internal IT team
- Legal counsel familiar with cybersecurity and data privacy
- The company’s cyber insurance carrier
- Cybersecurity or forensic specialists when required
The goal is not simply to get systems running again. Businesses also need to understand what happened, what information may have been affected, what contractual obligations exist, and whether customers, vendors, insurers, or government authorities must be notified.
That is why an incident response plan should be created before an incident happens.
Cyber Insurance Only Helps If You Follow the Policy
Having cyber insurance is an important layer of protection, but purchasing a policy does not automatically mean every incident will be covered.
One point emphasized in the conversation is the importance of notifying the insurance carrier quickly when a potential cyber incident occurs.
Policies can contain specific notification requirements, and waiting too long could jeopardize coverage. Even if a company does not yet know the full extent of an incident, notifying the carrier that a potential claim exists can be an important early step.
Once notified, the insurance company may also provide access to attorneys, forensic investigators, and other specialists who can help manage the response.
For business owners, the lesson is simple: do not wait until a cyberattack to learn how your cyber insurance policy works.
Understand the notification requirements, contacts, coverage, and response procedures ahead of time.
Your Contracts Could Create Cybersecurity Obligations Too
Insurance policies are not the only documents that matter after a breach.
Customer and vendor contracts may contain requirements stating that the other party must be notified if certain systems or information are compromised.
Businesses may also face notification obligations under applicable state or federal privacy laws.
This creates several overlapping responsibilities during an incident. A company may need to consider its insurance requirements, contracts, privacy laws, and operational recovery at the same time.
An effective incident response plan should account for all of them.
The Contract Clause Business Owners Often Overlook
Contracts can feel like pages of legal language that business owners sign and move past. But one provision can have a major impact on financial exposure: the limitation of liability clause.
A limitation of liability establishes how much one party may potentially be responsible for if something goes wrong.
For example, a contract could cap liability at:
- One month of fees
- Three or six months of payments
- One year of contract revenue
- The total amount paid during the contract
The appropriate amount depends on the agreement and the parties involved.
Business owners should understand that number before signing because it helps define the financial risk associated with the relationship.
The question becomes: If the worst-case scenario happened, could the business absorb the exposure created by this agreement?
Insurance can provide another layer of protection, but the contract itself should still be reviewed carefully.
Every Business Using AI Needs Rules
Artificial intelligence has moved into the workplace extremely quickly.
Employees are using tools such as ChatGPT, Gemini, Copilot, Claude, and other AI platforms to write emails, analyze information, create documents, summarize material, and solve everyday problems.
The challenge is that employees may also enter confidential business information into those systems without realizing the potential consequences.
That is why businesses should consider establishing an AI acceptable use policy.
A strong AI policy can define what employees may and may not enter into AI tools, particularly when dealing with:
- Customer information
- Confidential company information
- Financial data
- Personal information
- Health information
- Proprietary processes
- Intellectual property
- Sensitive contracts or business documents
Employees need clear boundaries because consumer AI tools may not provide the same privacy, security, or data controls as company-approved business systems.
Technology adoption without governance can create unnecessary risk.
AI Is a Tool. It Is Not Your Lawyer.
There is another growing AI risk that has nothing to do with cybersecurity: relying on AI-generated information without verifying it.
The podcast discusses businesses using AI platforms to review contracts and determine whether agreements are favorable.
That can be dangerous.
AI can be incredibly useful for organizing information or helping users understand complex language, but the output is not guaranteed to be accurate. The answer can also change depending on how a question is asked or what information the system receives.
This problem has already surfaced in the legal profession, where attorneys have faced consequences after AI systems generated nonexistent cases or inaccurate information.
The takeaway for business owners is straightforward:
Use AI to assist decision-making—not replace qualified professional advice.
Growing Businesses Need a Strong Legal Foundation
Cybersecurity was only one piece of the conversation.
As companies grow, basic corporate housekeeping becomes increasingly important.
That starts with having the appropriate business entity and maintaining clear separation between the business and its owners.
Business owners should maintain proper corporate records, separate business and personal finances, keep required licenses current, maintain accurate financial records, and follow applicable state and federal requirements.
If intellectual property or other assets are transferred into the business, ownership should also be clearly documented.
This becomes particularly important if the business is ever sold.
A potential buyer wants to know that the company actually owns the intellectual property, technology, real estate, customer relationships, or other assets creating its value.
Poor documentation today can become a major problem during a future transaction.
Contracts, Corporate Structure, and Insurance Work Together
Toward the end of the conversation, three recurring areas emerge as foundational protections for businesses:
Corporate structure protects the owner.
Maintaining the business properly helps preserve separation between the company and personal assets.
Contracts protect business relationships.
Written agreements define responsibilities, expectations, liability, ownership, and what happens when something goes wrong.
Insurance provides a financial backstop.
If an incident occurs despite those protections, appropriate insurance coverage may help reduce the financial impact.
None of these protections should operate independently. Together, they create layers of protection around the organization.
The Legal Side of AI Is Still Evolving
Perhaps the biggest uncertainty facing businesses is what comes next.
Artificial intelligence is developing faster than laws, court decisions, and business practices can fully adapt.
New disputes will eventually force courts to address questions they have never handled before. Businesses will also continue determining how AI should be used internally, what information employees can share with AI systems, and what responsibilities organizations have when those systems produce inaccurate or harmful results.
There may not be a perfect roadmap yet.
That makes good fundamentals even more important.
Businesses should continue strengthening cybersecurity, updating policies, maintaining contracts, protecting corporate records, and reviewing insurance coverage while the technology and legal landscape evolve.
Key Takeaways
- Create a cybersecurity incident response plan before an attack happens.
- Avoid making major system changes after a breach without considering forensic evidence.
- Understand your cyber insurance notification requirements.
- Review customer and vendor contracts for breach notification obligations.
- Pay close attention to limitation of liability clauses before signing agreements.
- Establish an AI acceptable use policy for employees.
- Do not enter sensitive company information into unapproved AI platforms.
- Treat AI as a tool—not a replacement for qualified legal advice.
- Maintain proper corporate records and separation between business and personal finances.
- Make sure the company clearly owns its intellectual property and other important assets.
- Keep contracts current and monitor expiration or renewal dates.
- Regularly review insurance coverage as the company grows.
For small and midsized businesses, managing legal and cybersecurity risk does not require predicting every problem that could happen. It means putting the right protections in place before those problems arrive.
Because when an incident happens, the companies that prepared ahead of time have far more options than the ones trying to figure everything out in the middle of a crisis.
Meta Description
Cybersecurity, AI, contracts, and insurance create growing legal risks for small businesses. Learn how SMBs can better protect their operations and future.
Suggested Primary Keywords
small business cybersecurity, cybersecurity legal risks, cyber risk for small businesses
Secondary Keywords
cyber insurance, AI policy for business, cybersecurity incident response plan, small business legal risk, limitation of liability, business contracts, AI security risks, data privacy, SMB cybersecurity
Suggested Tags
Cybersecurity, Small Business, Artificial Intelligence, AI Security, Cyber Insurance, Data Privacy, Business Law, Risk Management, Incident Response, Business Contracts
Suggested Internal Links
- Engler IT cybersecurity services
- Cybersecurity assessments and risk management
- Previous Cyber Brisket podcast episodes
- Articles about cyber insurance and ransomware
- Articles about AI security and Shadow AI
Suggested External Links
When publishing, consider linking to authoritative resources covering cybersecurity and data privacy, such as CISA, the FTC, or relevant state privacy and breach-notification guidance.