Protecting training data from data poisoning attacks: practical guidance for UK SMEs

This guidance explains how UK small and medium-sized enterprises can reduce the risk of data poisoning in AI training pipelines by applying practical controls: tracking data provenance, restricting access and change control, validating and sampling datasets, monitoring model drift, and seeking supplier assurance. It emphasizes proportionate, lightweight governance (clear dataset ownership, simple approval workflows, and concise documentation), outlines business impacts and response steps (containment, investigation, retraining or rollback), and provides questions and evidence SMEs should request from third-party data or model suppliers.