35% of SMBs Have Unapproved AI Running Right Now

Why Are SMBs Building AI Faster Than They Can Control It?

Because the tools are frictionless and the guardrails aren't. Any employee with a credit card and a browser can spin up an AI agent, connect it to a business tool, and have it processing customer data before IT or leadership even knows it exists. That's the core problem the Pax8 research puts numbers to: 35% of AI-engaged SMBs have already discovered unapproved tools, workflows, or agents running in their operations.

Two-thirds of AI-engaged small businesses have built solutions now actively in use. That's a fast adoption curve. The governance infrastructure to match it? Mostly absent.

"Two-thirds of AI-engaged SMBs have built solutions now in use, while 35% discovered unapproved tools, workflows, or agents running in their operations." , Pax8 Research, 2026

This isn't an IT problem. It's an operator problem.

What Does "Unapproved AI" Actually Look Like in a Small Business?

It's not a rogue data scientist running experiments. In SMB environments, unapproved AI usually looks like this:

• A sales rep using ChatGPT to draft proposals, pasting in client pricing data and deal terms
• An ops coordinator who built a Zapier workflow with an AI step that auto-responds to vendor emails
• A customer service hire who connected an AI chatbot to your support inbox without telling anyone
• A bookkeeper using an AI tool to categorize expenses, feeding it bank statement exports

None of these people think they're doing something wrong. They're trying to move faster. The problem is the data flowing through tools that haven't been vetted, the outputs that haven't been reviewed for accuracy, and the liability that accrues quietly in the background.

What's the Actual Risk If You Don't Govern This?

Three categories of exposure come up consistently across clients we work with.

Data leakage. Unvetted AI tools often train on inputs or log conversations. If an employee is pasting customer PII, contract terms, or financial data into a consumer-grade AI tool, that data may be leaving your environment in ways your privacy policy and client agreements don't account for.

Output liability. AI gets things wrong. If an unapproved workflow is generating customer-facing content, financial summaries, or compliance-adjacent documents without human review, errors go out under your brand and your signature.

Vendor and compliance exposure. Regulated industries (healthcare, financial services, legal-adjacent) have specific requirements about data handling. An employee using an AI tool that doesn't meet those requirements isn't just bending an internal rule, they may be creating an actual compliance violation.

The Pax8 data makes clear this is already happening at scale. Finding unapproved tools running in your business isn't a sign of a bad culture. It's a sign that your people are motivated and your governance hasn't kept pace.

How Do You Figure Out What's Already Running?

Before you can govern anything, you need a picture of what exists. Most SMBs don't have one. Here's a practical starting point:

Run an AI audit

This doesn't require a consultant. It requires a few targeted questions asked across your team:

1. What AI tools or features are you currently using to do your job?
2. Are any of them connected to company data, accounts, or systems?
3. Have you built any automations or workflows that include an AI step?

Anonymize if you need to. People are more honest when they're not worried about getting in trouble. The goal is inventory, not punishment.

Check your SaaS stack

Many tools your team already uses have added AI features that are enabled by default. Microsoft 365 Copilot, Salesforce Einstein, HubSpot's AI features, Notion AI. If your team has access to these platforms, they likely have access to the AI features whether you've thought about it or not.

Review expense reports and company card charges

Look for charges from OpenAI, Anthropic, Perplexity, and similar vendors. Employees paying out of pocket for AI tools are a sign that demand exists and that the business hasn't provided a sanctioned path.

What Does a Governance Baseline Actually Look Like for an SMB?

Enterprise AI governance frameworks are largely overkill for a 20-person business. But no governance is clearly insufficient. Here's the minimum viable version:

| Governance Component | What It Means in Practice | |---|---| | Approved tool list | A short list of AI tools the business has vetted and permits | | Data handling rules | Which data categories can and cannot flow into AI tools | | Output review policy | Which AI outputs require human review before use | | Reporting mechanism | How employees flag new tools they want to use | | Owner | One person accountable for maintaining this |

This doesn't need to be a 40-page policy document. A one-page internal guide and a simple intake process for new tool requests goes a long way. The point is to create a channel so that motivated employees have a sanctioned path to bring new tools in rather than going around you.

Is Shadow AI Always a Problem, or Sometimes Just Innovation?

Honestly, sometimes it's both. Some of the most effective AI implementations we've seen inside client businesses started as something an employee built on their own. The problem isn't the initiative. It's the lack of visibility and review.

A governance framework isn't designed to stop people from experimenting. It's designed to surface what's happening so you can evaluate it, bless what works, fix what's risky, and retire what's neither.

The 35% of SMBs who have already found unapproved tools in their operations have a choice: treat it as a disciplinary issue (wrong move) or treat it as a signal that AI adoption is happening faster than their processes anticipated (right move). The second framing leads somewhere useful.

What We'd Actually Do

• Run a 15-minute team survey this week. Ask every department lead what AI tools their people are using. No judgment, just inventory. You cannot govern what you cannot see.
• Build a one-page AI acceptable use policy. Cover what data can go into AI tools, which tools are approved, and how to request approval for new ones. Keep it short enough that people will actually read it.
• Join the community at skool.com/aiforbusiness. We work through governance frameworks, tool audits, and real implementation questions with SMB operators every week. The Pax8 research describes exactly what we're helping businesses get ahead of.