Shadow AI is now a small business problem: 35% found AI running without approval

Pax8’s Q3 2026 SMB AI Pulse report, published October 12, 2026, found that 35% of AI-engaged small businesses discovered AI tools, workflows, or agents operating without approval in the past six months. Two-thirds of AI-engaged SMBs have built solutions now in regular use, yet formal, documented review of internally built AI tops out at 45%.

This article explains what shadow AI looks like in small businesses and how to bring it under control.

What did the research find?

The Pax8 survey covered 1,150 small business leaders across the United States, United Kingdom, Germany, and Sweden. Among AI-engaged businesses:

• 67% have built one or more AI solutions now in regular use
• 35% found AI running without approval in the past six months
• Formal, documented review of internally built AI tops out at 45% in the most rigorous market surveyed

Among businesses that are building AI, 52% are developing automated workflows connected to other systems, 46% are building or testing agents, and 39% have built custom integrations using an AI provider’s API.

What does shadow AI look like?

Shadow AI is any AI tool, workflow, or agent operating in your business without official approval or oversight. It often starts with good intentions.

A sales rep builds a lead scraper to find prospects faster. An office manager creates an invoice bot to speed up accounts payable. A technician sets up a photo-to-report tool to document job sites automatically.

Each of these solves a real problem. Each also introduces risk. The lead scraper may store customer data in an unapproved location. The invoice bot may have access to financial accounts. The photo tool may upload images to a third-party service without review.

Shadow AI differs from shadow IT in a key way: AI tools can take action, not just store or process data. An unapproved spreadsheet is a data risk. An unapproved agent that sends emails, creates documents, or accesses customer records is an operational risk.

What this means for your business

A staff member’s helpful automation can quietly hold customer data and credentials that you do not know about. The Pax8 data shows this is not theoretical. More than a third of AI-engaged businesses have already discovered unapproved AI in their operations.

The governance gap is real. Most businesses do not have formal, documented review of what their teams build. When AI can act on behalf of the business, unreviewed builds can affect customers, finances, and reputation.

A 30-minute shadow AI inventory

You do not need a formal audit to get started. This inventory takes about 30 minutes and gives you visibility into what is running.

Ask the team. In your next team meeting or via a short survey, ask: “What AI tools have you tried for work in the past six months? What workflows have you automated? What are you still doing manually that you wish AI could handle?”

Frame it as curiosity, not enforcement. People are more likely to share if they do not fear punishment.

Check connected apps. Review which third-party apps are connected to your email, calendar, CRM, and other core systems. Most platforms show connected apps in settings. Look for anything you do not recognize.

Check billing. Review credit card statements and subscription charges for AI services you did not approve. Someone on your team may have signed up for a tool using a company card.

Decide: keep, fix, or retire. For each AI tool or workflow you discover, decide whether to keep it (bring it under governance), fix it (add controls and oversight), or retire it (shut it down).

Frequently asked questions

Should I ban AI tools?

No. Banning AI drives it underground and creates worse shadow AI problems. The goal is to bring AI under a process: know what is running, ensure appropriate access and oversight, and make it easy for employees to request approval for new tools.

Who should own AI in a 15-person company?

Usually whoever handles IT or operations. In a small business, this may be the owner. The key is having one person responsible for maintaining the inventory, reviewing new requests, and ensuring basic controls are in place.

Is shadow AI the same as shadow IT?

Related but different. Shadow IT typically refers to unapproved hardware, software, or cloud services. Shadow AI adds the dimension of automation and action. An AI agent that sends emails or accesses customer data has different risks than an unapproved file-sharing service.

Start with what is already running

The Agent Opportunity Audit starts with an inventory of what is already running in your business. Before building new agents, we identify existing AI tools and workflows, assess their risks, and bring them under governance. This foundation makes future AI deployment safer and more effective.