Somewhere in your business right now, there's probably an AI doing a job you never signed off.
Maybe it's a Zap someone wired to ChatGPT. And maybe it's a bot that answers the contact form at 2am. Maybe it's a spreadsheet script a keen staff member built on a Sunday because the boss kept moaning about reporting. Nobody was sneaky about it. They saw a problem, they had a tool, they fixed it. Good on them.
But you're now running a system you don't know exists. And when it breaks, it's yours.
I'm not guessing about this. A new survey out this week put numbers on it, and the numbers are a proper pub conversation starter.
The survey
Pax8, a marketplace that sells software to small businesses, released its Q3 2026 SMB AI Pulse Report on 12 October. It surveyed 1,150 business leaders at companies with 5 to 499 staff across the US, UK, Germany and Sweden.
One thing first. Pax8 sells to IT partners, so it has a reason to say small businesses need help managing AI. Keep that in your back pocket. But the survey itself is still worth reading, because the findings match what I see on the ground.
So here's what stood out.
They're building, not just using. Of the businesses already using AI, 67% have built at least one AI solution that's now in regular use. Not bought. Built. Workflows that connect AI to other systems, agents that finish multi-step jobs alone, custom links into an AI provider's API.
Nobody's watching what they built. 35% found AI running in their business without approval in the past six months. One in three. Tools, workflows or agents that someone switched on and nobody signed off.
The bills are a surprise. Among the businesses that paid for AI in the past year, 49% got at least one bill higher than they expected. Usage-based charges are the nasty ones, because they grow every time you add another agent.
The owner is the safety net. 55% of decision-makers personally spend three or more hours a week reviewing, editing or fact-checking AI work. So the time AI saves you, you're partly spending on babysitting it.
And the UK number, since that's where I'm parked on a narrowboat: formal, documented review of homemade AI is as low as 23% in the United Kingdom, against 45% in Sweden. We're the sloppiest of the four.
Why this matters more than it sounds
So let's do the maths on what "nobody approved it" really means.
An unapproved tool has no owner. No owner means nobody checks the output. Nobody checking the output means a wrong price, a wrong email or a wrong promise can go out to a customer, and you find out when they ring you.
That's not theory. A German court recently held a company to what its chatbot told a customer, and an AI script I covered a few weeks back showed a customer list to strangers. Neither company set out to run a risky system. They had one they hadn't properly looked at.
I get this from the inside too. When I run my own setup, I've had automations that looked healthy and weren't, and the fix was never a smarter model. It was knowing what was running, who it talked to, and what it could touch. One week the watcher itself was the broken thing. You only catch that if you keep a list.
The fifteen minute fix: an AI register
Look, forget governance frameworks. You're not a bank. You need one page.
Open a spreadsheet. One row per AI thing in your business. Columns:
- What it is. "Reply bot on the website form", "Zap that summarises call notes", "Claude project for quotes".
- Who built it. A name, not a team.
- What it can touch. Customer data? Your invoicing? Your calendar? Can it send things outside the business?
- Who checks it, and how often. Be honest. "Nobody" is a valid answer for now. It's just a red cell.
- What it costs. Usage-based or flat. If it's usage-based, add the last bill.
Then do this:
- Ask your team. Not as a trap. Say "I'm not telling anyone off, I want to know what's running." If people think they'll be told off, they'll hide it, and hiding is how you end up with surprises.
- Check your card statements. Search for the AI vendors you know and a few you don't. Half of shadow AI shows up as a small monthly charge somebody expensed.
- Look at your automation tool's activity log. Zapier, Make, GoHighLevel, whatever you use. Anything that fires and mentions an AI step goes on the list.
- Flag every red cell. Anything that touches customers or money and has no checker gets an owner this week.
And that's it. Fifteen minutes for the first draft, and a quick monthly look as well.
The other half: give every system an owner
A list on its own is just a tidier way to feel guilty. And a tidy list that nobody owns goes stale inside a month. The point is the owner column.
I've seen this go one of two ways. Either someone owns the thing and it gets looked at, or "the team" owns it and it slowly rots. Group ownership is no ownership.
And if you read the survey and thought "we don't build AI, we only use ChatGPT", check again. Staff pasting customer details into a free tool counts. Data security and privacy came out as the top risk of employee-built AI in every market the survey covered.
Don't kill the keen ones
One warning. The wrong response to all this is to ban everything. The people building AI into your business are usually your best problem solvers. Shut them down and you've lost the initiative that made the thing in the first place.
So do the reverse. Make the register the price of admission. "Build whatever you like, put it on the list, name who checks it." And that's a rule people can live with, and it keeps the quick wins without the surprise at the end of the month.
The takeaway
But the real finding is simple. Small businesses are building AI faster than they're keeping track of it. It's not "AI is dangerous". It's "you can't manage what you can't see".
So this week: make the list. Find the red cells. Give each one an owner. You'll almost certainly find something you didn't know about, and I'd rather you found it before a customer did.
Want someone to go through your business and tell you which bits should be running themselves, and which bits are running with nobody watching? That's the AI Ops Audit. I look at how you actually operate, find the jobs a machine should be doing, and hand you the order to fix them in. Not a 40 page report nobody reads.
Brewed by Steven, poured by Viktor
About Steven Tann: Steven helps business owners build systems that run themselves using AI. After 10+ years helping 7,000+ businesses and building his own autonomous operations, he's the bloke who actually does it, not just talks about it. Find out more at steventann.com.