Somebody in your business built something clever. Now orders, bookings or deliveries run through it, and they’re the only person who really knows how it works.
That person might be you, your son or daughter, a keen office manager or a freelancer you found online. They’ve probably done something remarkable. But between them and the system there’s a risk that doesn’t appear on any balance sheet.
What it looks like
Answer these honestly:
- If they were away for a fortnight with no phone, could the system keep running and could someone fix a problem?
- Does anybody else know how to sign in to every part of it?
- Is it in the company’s name, or theirs? Who pays the bills, and on whose card?
- Is any of it written down?
- Do people say “I’ll just ask them” several times a day?
If those answers make you uncomfortable, you have a key-person risk. Most small businesses with a home-grown system do.
This isn’t a rare problem
We know of no good figure for how many UK firms depend on one person for a system. But the closest evidence is telling. Research for HMRC, published in January 2026, interviewed 43 businesses about how they manage access to their tax accounts. Among smaller firms, one person tended to manage access, generally the founder or a director. Some shared logins. And it noted that relying on a single set of credentials could block access if the phone used for sign-in codes is lost, or “that person leaves the business”. That’s about tax accounts and not software, but it’s the same habit.
Key-person risk isn’t just a software matter either. In a 2019 Legal & General survey of over 700 SMEs, 26% of small businesses said they’d face immediate closure if a key person died or became seriously ill. L&G sells insurance for this, and those are owners’ own predictions about illness and death, but it shows how much firms know they depend on individuals.
The NCSC’s guide for small organisations also tells firms not to “leave the responsibility for cyber security with a single person”, and to review who has access every few months.
Why AI-built systems make it worse
A traditional software project at least leaves a trail: a supplier, a contract, some documents. AI tools remove nearly all that friction, which is why they’re so useful. It also means a system can reach the heart of your business with no paperwork at all, built on one person’s free email account, with the only record of how it works in a chat history on their login.
The builder may not fully know how every part works either. That’s no criticism, as the tool wrote much of it. But it means there may be nobody at all who could explain it from memory. The NCSC warns that a vibe-coded code base “could become complicated and confusing to understand”, and several of the tools make handing over harder than you’d expect.
What it can cost you
Lockout
The login is lost or the person leaves on bad terms. Now you can’t change or repair your own system, and getting back in depends on someone else’s support desk.
A slow, quiet failure
Something breaks while they’re away. Nobody knows how to tell, let alone how to fix it.
Lost value
A buyer or investor asks who owns your software and how it’s maintained. “Tom built it on his Gmail” isn’t a great answer.
An unfair burden
The person carrying it can never really switch off. Good people leave for less.
How to fix it
The good news is that most of this is organisation and not engineering. None of it requires rebuilding your system.
- Move everything into the company’s name. Create a company account and make it the owner of each service. Here’s how to find out what you really own.
- Get a second person in. Someone else needs to be able to sign in to every part, using a shared password vault and two-step sign-in.
- Write it down. A map of the system, a list of logins, and a short runbook of what to do when something goes wrong.
- Arrange cover. Decide who steps in, before you need them. That could be another employee, a local developer, or us.
- Consider handing it over. If running the system isn’t anyone’s real job, we can take it on.
How to raise it with the person who built it
This can feel awkward, particularly if it’s a family member or someone who has gone out of their way for the business. It doesn’t need to be. Start with what they’ve achieved, and make it about protecting them as well: right now, they can never take a proper holiday. Most builders are relieved when someone finally asks.
Questions
Is key-person insurance the answer?
It can pay out money if someone important dies or falls seriously ill, which is useful for some businesses. It won’t get you into a locked account or tell you how the system works. It deals with a different part of the problem.
We’re a very small business. Does this still apply?
More so, if anything. The fewer people you have, the more likely it is that one of them holds everything, and the less slack you have if they’re gone.
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
