You built the AI. Now somebody has to run it.

A year ago the question was whether small businesses should try AI. That question is closed. Now the awkward one is the mess it left behind: nobody is quite sure how many AI tools are running in the business, what they cost, or who is allowed to change them.

Pax8, a Denver-based marketplace that sells cloud and AI software through IT providers, published its Q3 2026 SMB AI Pulse Report on October 12. It surveyed 1,150 business leaders in the US, the UK, Germany and Sweden, at companies with 5 to 499 employees. The headline is not that they adopted AI. It is that they started building it — and that almost nobody built the controls a software vendor would have built alongside.

Two-thirds of the AI-engaged businesses (67%) have built one or more AI tools that are now in regular use. Another 19% are still building them. Only 13% get by on off-the-shelf tools alone. That means the majority of small businesses have taken on work that used to belong to a vendor: maintaining what was built, securing it, deciding who can change it, and paying for the compute it burns. Most of them did that without adding any of the paperwork a vendor would have.

What 1,150 small businesses actually reported

Strip out the enthusiasm and the survey describes three gaps, all of them familiar to anyone who has run a small team.

The first is visibility. In the past six months, 35% of AI-engaged businesses found AI running without approval — a tool, a workflow or an agent nobody had signed off. Sweden was highest at 55%, the US at 42%, the UK at 24%, Germany at 19%. Formal, documented review of the AI built in-house tops out at 45% across all four markets, and sits at 36% in the US.

The second is money. Of the businesses that paid for AI in the past year, 49% got a bill or a usage charge higher than they expected — 57% in the US, 65% in Sweden. Usage-based pricing does that. It is cheap until the agent you left running at night discovers the internet.

The third is time. More than half of decision-makers (55%) personally spend three or more hours a week reviewing, editing or fact-checking AI-generated work. In the US it is 68%. That is not a small number for an owner who is also the sales team. It is roughly a fifth of a working week, spent checking a machine.

None of this says the building was a mistake. Sixty-nine percent said AI freed up capacity, and 66% said their business would not stay competitive in the next three years without it. The point is narrower: the capability arrived faster than the housekeeping, and the housekeeping is now the bottleneck.

Why this is harder for a ten-person business than for a big one

Large companies have a department whose whole job is to keep software from spreading. They have a person who notices a new subscription on the card statement, and another who knows which systems hold customer data. A small business has the owner, and the owner is busy.

That is the real reason the gap opens. Not carelessness — arithmetic. When the same person who decides to try an AI tool is also the one who has to remember it exists three months later, things slip. The tool still works, which is exactly why nobody notices it is unmanaged.

And the incentives all point the same way. Building is fast and feels productive. Writing down what you built feels like admin, so it gets postponed — until a bill arrives that does not match expectations, or two tools quietly touch the same customer list in different ways.

Here is the thing I would say to any owner reading this: you do not need governance in the corporate sense. You need a page. One page, written by you, kept somewhere you will actually look. Everything below fits on it.

The one page: four columns, one line per tool

List every AI tool, workflow or agent your business depends on. Not the ones you meant to buy — the ones that are actually running, including the free account somebody's cousin set up. Four columns, and be honest about the last one.

Four columns is enough to catch every problem in the Pax8 data. No owner? That is the shadow AI. No cost? That is where the surprise bill hides. "What it touches" is the one that protects you when a customer asks where their data went.

Write it once, then re-read it every quarter. A page like this takes twenty minutes and catches things that cost far more than twenty minutes to fix later. If a line has no owner, either you own it or it goes.

Put a ceiling on the bill before it finds you

Half the surveyed businesses that paid for AI got a bill they did not expect. Almost none of them did anything wrong. They bought a subscription and did not realise how much of it was metered.

The fix is not to avoid usage-based tools. Some of them are the best value you will get. The fix is to know which of your tools has no ceiling, and to set one.

Three things actually work, and none of them need a finance background:

• Separate the card. Give AI subscriptions their own card or their own line in your accounting so a spike stands out instead of dissolving into your general expenses.
• Turn on spend alerts. Most platforms will email you at 50%, 80% and 100% of a limit you set. Set the limit on day one, not after the first bad month.
• Know which tool is metered. A flat seat price cannot surprise you. An agent that runs all night can. When you have a choice, pick the flat price for the always-on work and reserve metered usage for the bursty work.

That last point is the one owners miss. An always-on agent re-reads its context on every step, which is why it is the most expensive kind of AI to run — and why it deserves a ceiling before it goes live, not after. The survey's 49% is what happens when it does not get one.

The hidden hour nobody budgets for

More than half of decision-makers spend three or more hours a week checking what AI produced. That time is real, it is not on any invoice, and it is the reason some businesses quietly conclude that AI "did not save us anything". It did. They just spent the saving.

You cannot remove the checking entirely — somebody has to catch the confident wrong answer. But you can decide where it happens, instead of reviewing everything out of habit.

Sort the outputs of each tool into two piles: the ones where a mistake is embarrassing, and the ones where it is expensive or irreversible. Money, contracts and anything a customer receives go in the second pile at full review. Internal drafts, summaries and first-pass research go in the first — spot-check them, do not read every word.

Then measure it. Time yourself for one week. If the checking is eating five hours, and the tool saves you three, the tool is not the problem — the place you put it is. Move it earlier in the process, where a wrong answer is cheap to catch, or take it off that task altogether.

What to do about it this week

You will not do all of this in one sitting, and you do not need to. Pick the order that hurts least.

1. Open a note and start the four-column list. Anything you can already name goes in now. Anything you find later gets added as you stumble on it.
2. Search your card statement for AI and software charges for the last three months. Every recurring charge should have a line. Any line you cannot match to a charge is either free or forgotten.
3. Set a spend limit or alert on every tool that charges by usage. Five minutes each, and it is the cheapest insurance in this whole article.
4. Give every line an owner, starting with yourself. A tool with no owner is a tool with no reviews.
5. Pick the one tool that costs you the most checking time, and either move it earlier in the process or take it off that job.

And here is the thing you should stop doing: writing a long AI policy nobody will read. A ten-page document that describes acceptable use in the abstract does not tell you that three tools are pulling from the same customer list. The page with four columns does. Keep it boring, keep it current, and keep it somewhere you will actually open.

Frequently asked questions

Do I really need AI governance if I only have three or four tools?

That is exactly when it is easy. The four-column page takes twenty minutes with four tools and an afternoon with twenty. Starting now also means you never have to untangle the moment when two tools turn out to be pulling from the same customer list.

What is the difference between shadow AI and an employee just using ChatGPT?

Shadow AI is anything running in the business without formal approval — a personal account handling work data, a script someone built, an agent left on. The survey found it in 35% of AI-engaged businesses. The answer is not a ban; a ban drives it further underground. Make it visible, give it an owner, and decide case by case whether it stays.

How often should I review the page?

Once a quarter, plus any time a bill looks strange. Fifteen minutes a quarter beats a two-day audit every couple of years, and it keeps the list close enough to reality that you trust it.

Does this apply outside the US and Europe?

The management problem does. Every market has its own data rules, so the "what it touches" column is where you check your local requirements — but the visibility, cost and review gaps showed up in all four countries Pax8 surveyed, from 19% to 55%. The pattern travels.