Two in three small firms run custom AI tools while governance lags

Small and medium businesses have shifted from simply typing questions into off-the-shelf chatbots to creating custom automated workflows. However, company oversight has failed to keep pace with the speed of implementation.

Cloud marketplace provider Pax8 published findings on Monday from its survey of 1,150 small and midsize business leaders across the United States and Europe. The study revealed that two-thirds of AI-active smaller firms regularly use internally developed AI systems, such as automated workflows and software agents. At the same time, 35 per cent of respondents discovered unapproved AI applications operating within their business over the past six months.

Formal evaluation processes remain scarce. Only 36 per cent of surveyed businesses conduct documented reviews before deploying internally built AI software. Across all surveyed regions, formal reviews peaked at 45 per cent. Nick Heddy, president and chief commerce officer at Pax8, noted that smaller companies are embedding machine systems directly into core business operations, creating fresh requirements around data protection, spending oversight and operational responsibility.

The issue often stems from non-technical staff connecting software tools together using no-code platforms and AI plugins without consulting IT managers. While these setups save hours on routine work, they frequently handle customer data, internal records and accounting software without central monitoring or security guardrails.

What this means for Australian businesses

Australian operators face the same temptations and risks as their overseas peers. The findings offer direct lessons for managing automation in smaller teams.

• Take inventory of all active tools. Conduct a short internal review to ask staff what AI plugins, browser extensions and automated workflows they use to handle weekly duties.
• Establish a clear internal approval rule. Team members should obtain sign-off before connecting AI services to customer records, bank feeds or company email boxes.
• Limit data exposure. Check that staff do not paste sensitive personal details or confidential client contracts into free accounts that retain prompts for training purposes.
• Monitor recurring software expenses. Automated tasks that draw on paid developer credits can build up hidden overheads across multiple unmanaged accounts. Centralise billing under a primary company account so usage stays visible.