Small businesses in the UK are no longer just using AI. More than half of those working with it have built something of their own: an automation, a custom assistant, an agent that handles part of a job. But according to new research from Pax8, fewer than a quarter have a written process for checking what they’ve built.
That gap is the strongest argument yet for a simple AI policy, and for making sure it covers more than which chatbot your staff are allowed to use.
What the survey found
The Q3 2026 Pax8 SMB AI Pulse Report, published on 12 October 2026, surveyed 1,150 leaders of businesses with between 5 and 499 staff in the US, UK, Germany and Sweden, including 350 in the UK. Among UK businesses already working with AI:
- 54% have built at least one AI tool, workflow or agent that is now in regular use. Another 25% are prototyping, and only 19% stick to off-the-shelf tools.
- Only 23% have a formal, documented review process for the AI they build. That is the lowest of the four countries surveyed.
- 24% discovered AI tools, workflows or agents running without approval in the last six months. A further 13% weren’t sure whether any were, the highest level of uncertainty in the study.
- 39% of UK businesses paying for AI received a bill higher than they expected, and only 12% have a dedicated budget line for AI.
- 44% of UK decision-makers spend three or more hours a week checking, editing or fact-checking work that AI has produced.
| UK | US | Germany | Sweden | |
|---|---|---|---|---|
| Built AI now in regular use | 54% | 81% | 52% | 76% |
| Formal, documented review of what’s built | 23% | 36% | 32% | 45% |
| Found AI running without approval | 24% | 42% | 19% | 55% |
| AI bill higher than expected | 39% | 57% | 33% | 65% |
The UK is building more cautiously than the US or Sweden, which is no bad thing. But it has the weakest checks on what it does build.
“Building AI” is less grand than it sounds
It’s easy to read “built their own AI” and picture a software team. In a small business it usually looks like this:
- an automation that sends every website enquiry to an AI service and drafts a reply;
- a custom assistant set up with your price list and terms so staff can ask it questions;
- a spreadsheet or finance tool connected to an AI service to sort transactions or summarise reports;
- an agent that reads a shared inbox and files or forwards messages on its own.
Pax8 found the most common builds are automated workflows that connect AI to other business systems, followed by standalone tools for a specific job and agents that complete several steps without a person.
Each of these is genuinely useful. Each also means your business has taken on a job a software supplier used to do: keeping it working, keeping it secure, deciding who can change it and paying for what it uses. Most small businesses have taken that on without putting any of the supplier’s checks in place.
Why the missing review matters
An unchecked tool that works well is still a risk, because nobody has asked what happens when it doesn’t.
- Data goes further than you think. Asked about the biggest risk from AI tools built by staff, businesses in every country put data security and privacy first. If an automation sends customer details to an AI service, UK GDPR applies, and your business is responsible, not the provider.
- Legal exposure comes next. In the UK, legal and compliance risk was the second most-cited concern about staff-built AI, at 17%.
- Costs creep. Usage-based AI charges grow as more automations run. In the UK, 52% of established AI builders were hit with an unexpected bill, compared with 17% of businesses using only ready-made tools.
- Knowledge walks out of the door. A workflow one person set up on their own account can stop working, or keep quietly running, after they leave. Nobody else knows how it works or where its data goes.
Pax8 also found that the most common approach in many countries is review that is consistent but undocumented. Someone does look things over, but nothing is written down, so there is no record of what was checked, by whom or against what.
Your AI policy probably doesn’t cover this
Many businesses have started on an AI policy. Across the four countries, 40% have a documented policy on how staff use AI, and another 35% have informal guidelines. That’s progress, and it’s what we recommend in Is Your Team Already Using AI? Why Your Small Business Needs a One-Page AI Policy.
But as the report points out, a policy about how people use AI tools doesn’t cover the agents and workflows the business has built for itself. That is where much of the new risk sits. The fix isn’t a second document. It’s a short extra section on the page you already have.
What to add: a “things we’ve built” section
- Keep a simple register. One line for every automation, assistant or agent: what it does, who built it, which AI service and account it uses, what data it touches, roughly what it costs each month, and who owns it now. A shared spreadsheet is fine.
- Ask five questions before anything goes live. What information goes into it? Where does that information end up? What happens if the AI gets it wrong? Who checks the output, and how often? Could someone else maintain it or switch it off?
- Give every tool a named owner. Not the person who happened to build it, but whoever is responsible for it working properly and for the bill it runs up.
- Set spending limits. Most AI services let you set monthly caps and email alerts. Turn them on for every account, especially pay-as-you-go ones.
- Review the register regularly. Every six months, and whenever the person who built something leaves the business.
Start with a no-blame amnesty
Almost one in four UK businesses found AI running that nobody had approved, and more than one in ten didn’t know either way. So the first step is simply finding out what’s already there. Ask your team what they’ve built, connected or automated with AI, and make it clear nobody is in trouble. You’re gathering facts, not looking for culprits.
Put what you find into the register, run each item through the five questions, and decide what to keep, fix or switch off. For most small businesses that is an afternoon’s work, and it puts you ahead of more than three-quarters of your peers.
As the report itself concludes, the businesses that pull ahead won’t be the ones that build the most AI, but the ones that know exactly what they’ve built.
Need a hand?
If you’d like help finding what AI is already running in your business, or writing a policy that covers it, get in touch.
Sources
- Only 23% of AI-engaged UK small businesses formally review the AI they build, Pax8 survey finds, Compare the Cloud, 13 October 2026.
- Pax8 Pulse SMB AI Report, Q3 2026 (PDF), Pax8, 12 October 2026. Online survey of 1,150 business leaders at companies with 5 to 499 staff in the US (400), UK (350), Germany (200) and Sweden (200). The margin of error for the UK sample is about ±5.2 percentage points.