Small businesses are building AI faster than they can govern it: Pax8 finds two-thirds now build, a third found shadow AI
Small businesses aren't just using AI anymore — they're building it. Pax8's Q3 2026 SMB AI Pulse Report, released today, finds two-thirds of AI-engaged SMBs have built AI solutions now in regular use, while 35% discovered shadow AI running in their operations without approval.
Small businesses have crossed a line: they are no longer just buying AI tools, they are building them. The Q3 2026 Pax8 SMB AI Pulse Report, released today by Pax8, surveyed 1,150 business leaders across the United States, United Kingdom, Germany, and Sweden — and found that 67% of AI-engaged businesses have built one or more AI solutions now in regular use, with another 19% prototyping. Only 13% rely exclusively on off-the-shelf tools. The pressure is real: 66% say their business will not stay competitive without AI in the next three years, and 65% say they need to move immediately or within six months. (GlobeNewswire)
What they are building looks familiar to anyone in enterprise IT: 52% are developing automated workflows that connect AI to other business systems, 46% are building or testing AI agents that complete multi-step tasks on their own, and 39% have built custom integrations using an AI provider's API. As the report notes, a business that deploys an agent or wires AI into its finance system takes on work that used to belong to software vendors — maintaining what it built, securing it, and paying for the compute it consumes.
Building faster than they can govern
Governance has not kept pace with the building. 35% of AI-engaged businesses discovered shadow AI — tools, workflows, or agents operating without official approval — in the past six months alone. Formal, documented review of internally built AI is still the exception: it ranges from 23% in the UK to 45% in Sweden. In the US, where 81% of AI-engaged businesses have built solutions now in use, only 36% of builders have formal documented review; another 41% rely on consistent but undocumented review. (GlobeNewswire, DRJ)
“SMBs are moving from using AI tools to building AI into the way their businesses operate,” said Nick Heddy, Pax8's President and Chief Commerce Officer — a shift that brings “new demands around governance, security, cost, and accountability.” The report argues this is exactly where the IT channel steps in: SMBs need partners that can help them inventory, secure, govern, and manage the economics of the AI they are now building.
The bill shock
Cost is biting too. Among businesses that paid for AI in the past year, 49% received at least one bill or usage charge higher than they expected — 57% in the US and 65% in Sweden. Usage-based charges are the hardest to forecast, and they grow as businesses deploy more agents and workflows.
And the much-touted time savings come with a caveat: 69% of AI-engaged businesses say AI has freed up at least some capacity, but 55% of decision-makers personally spend three or more hours per week reviewing, editing, or fact-checking AI-generated work, and 7% spend ten hours or more. Trust has a price: data security or privacy exposure is the top-cited risk of employee-built AI in every market (30–35%), and 70% of SMBs would pay at least 6% more for greater control over how their data is stored and used.
Why it matters
The report's bottom line is a competitive split. In all four markets, businesses that use AI extensively are more likely to feel ahead of competitors than those still experimenting — 63% vs. 40% in the US, and 80% vs. 24% in Sweden. The US is the only market where fear of falling behind outweighs fear of making costly AI mistakes. For the SMB segment — companies of 5 to 499 employees — the message is blunt: the AI era is not coming to small business; small business is already building it, with or without the paperwork.