35% found AI nobody approved. 49% got a bill they did not expect.

Pax8 released its Q3 2026 SMB AI Pulse on October 12. It surveyed 1,150 leaders at companies with 5 to 499 employees in the US, UK, Germany and Sweden. Pax8 sells AI and cloud tools to small businesses through IT partners, so treat this as a vendor survey. The numbers are still worth reading.

Pax8 reports:

  • 67% of AI-engaged businesses have built at least one AI solution now in regular use. In the US, the figure is 81%.
  • 35% found tools, workflows or agents running without approval in the past six months.
  • 49% of those that paid for AI got at least one bill or usage charge higher than expected. In the US, 57%.
  • 55% of decision makers personally spend three or more hours a week checking AI’s work.

My call: shadow AI is not a security story first. It is a spend and ownership story. If nobody approved the agent, nobody owns its bill.

The bill is the early warning

Pax8 says usage based charges are the hardest to forecast, and they grow as businesses build more agents and workflows. That matches what I see in a monthly close. A seat license shows up the same every month. A usage charge shows up when someone’s workflow ran all weekend.

When a software line jumps without a matching approval, that is your shadow AI detector. It works better than any policy memo, because the card statement does not lie.

Pax8’s own framing is that building AI means taking on work that used to belong to software vendors: maintaining it, securing it and paying for the compute. Most small companies took on that work without deciding to.

Big vendors are selling control towers. You need one page.

The same week, the large vendors shipped governance products. On October 21, ServiceNow made Arc, its personal enterprise agent, generally available, governed by what it calls the Super Intelligence Control Tower and enforced with NVIDIA OpenShell. Oracle and others announced their own agent tooling.

That tells you agents are already loose inside large companies. It does not mean a 40 person business should buy a control tower. You need an inventory you can read in five minutes.

A blank aluminum clipboard with empty ruled rows and a pen with a blue cap on a paper-white studio sweep
One page, one row per tool, owned by a named person.

The one page AI inventory

One row per tool, workflow or agent. Six columns:

  1. Name and what it does. One sentence.
  2. Owner. A person, not a department. If nobody will own it, turn it off.
  3. What it can touch. Email, files, the CRM, the bank, the books. Write it down.
  4. How it is billed. Seat, usage or both, and which card or account pays.
  5. Monthly cap. A hard limit set in the vendor account, not a hope.
  6. Who reviews its output. And roughly how many hours a week that takes.

Build it from three places: the card and AP ledger, your SSO or admin consoles, and a short question to every manager asking what they built or connected this year. Pax8’s 35% says you will find something. For a fuller pass, use how to audit your AI tool stack.

Then put the inventory on the monthly close agenda. Any new AI charge without a row gets a row or gets cancelled. If agents can spend or touch production data, read our piece on the coding agent control plane.

Count the review hours too

The number I would not skip is the review time. Pax8 says 55% of decision makers spend three or more hours a week checking AI output, and 7% spend ten or more. That is owner and manager time, the most expensive hours in the company.

If a workflow saves a junior person five hours and costs a manager three hours of review, the math is thinner than the demo suggested. Put both on the page.

My analysis

Shadow AI is a finance problem before it is a security problem. Pax8 found it at 35% of AI-engaged businesses and surprise bills at 49%, 57% in the US. Those two numbers come from the same root cause: tools running without an owner. Fix ownership and the bill gets fixed with it.

Pax8 sells governance help through IT partners and calls its smaller subgroup results directional, so I weigh the exact percentages lightly. The direction does not need a survey. Your card statement will confirm it. Run the one page inventory at this month’s close, assign an owner to every row, and set a hard cap on every usage based charge. Thoughts?

FAQ

What is shadow AI? Shadow AI is any AI tool, workflow or agent running in a business without official approval. Pax8’s Q3 2026 survey found 35% of AI-engaged small businesses discovered it in the past six months.

How common are surprise AI bills for small businesses? In Pax8’s Q3 2026 survey, 49% of small businesses that paid for AI received at least one bill or usage charge higher than expected, rising to 57% in the US.

How should a small business govern AI without a security team? Keep a one page inventory listing each AI tool, its owner, what it can access, how it is billed, a hard monthly cap and who reviews its output. Review it at every monthly close.

Do small businesses need an enterprise AI control tower? Usually not. Large vendor governance platforms are built for big enterprises. A small business gets most of the value from an owner per tool, hard spending caps and a monthly review of AI charges.

Sources

Written by

Ken Koo

Partner at Force Scaling

Partner at Force Scaling, helping CEOs and leadership teams turn ambition into operating discipline and results.

ADVERTISEMENT