- A new study has found that small businesses are building their own AI, but they are failing to govern them effectively
- Small businesses have faced increasing pressure to adopt AI or risk being left behind
- AI that is ungoverned poses security risks including data breaches and cyber attacks
New research suggests that small businesses have started to build their own AI in order to go above and beyond existing AI tools. However, they’re failing to govern and manage the technology to remain secure.
Ever since AI started to make waves, the message for small businesses has been to adopt it, and adopt it fast. The study suggests SMBs might be feeling this pressure and governance may be lacking as a result.
Improperly governed AI systems provide significant security risks for businesses. Sensitive and confidential data could be leaked, and leaders could lose control of their systems altogether.
Small Businesses Are Building AI Fast
A new study from global AI and cloud marketplace Pax8 found two-thirds of AI-engaged SMBs have built AI solutions now in use. Similarly, 67% of AI-engaged businesses have built one or more AI solutions now in regular use, and another 19% are prototyping.
This just in! View the top business tech deals for 2026 👨💻
This suggests SMBs are moving beyond existing tools, and are coming up with their own.
According to Nick Heddy, president and chief commerce officer at Pax8, the opportunity for small businesses is “significant.” But, so are the demands that come with it, including those around governance, security, cost, and accountability.
Governance Is Lagging Behind AI Developments
SMBs are moving forward with their AI developments. Of those surveyed, 52% are developing automated workflows that connect AI to other systems, and 46% are building or testing AI agents. In the US, 81% of AI-engaged businesses have built solutions now in use.
Despite this positive progress, governance isn’t moving at the same pace. Of the 81% of businesses using their AI solutions, only 36% have formal review, and 41% rely on consistent but undocumented review.
Overall, 35% of AI-engaged SMBs discovered unapproved AI running in their business over the past six months, which is known as shadow AI. Ultimately, businesses are building and using AI, without understanding the governance that needs to be built around it.
Small businesses will have no doubt felt the pressure to adopt AI in order to stay competitive. The research confirms how SMBs feel about the technology, with 66% saying their business will not remain competitive without AI in the next three years, and 65% say they need to move immediately or within six months.
This adapt-or-get-left-behind mindset could be influencing how leaders are approaching their AI investments, with speed being prioritized over proper governance and safety.
The Danger of Ungoverned AI Systems
The dangers of AI are well-documented. Speed of development has also been acknowledged by many AI leaders as a potential catalyst to destruction, with many now calling for a slow-down.
On the one hand, ungoverned AI can lead to data leaks and detrimental cyber attacks, particularly if businesses aren’t always aware of the data being processed.
Moreover, unsanctioned AI tools pose a significant security risk if workers are using them to process sensitive or confidential information. Not only could this lead to a data leak, but it’s possible this information is being fed back into the AI tool for training purposes, especially if you’re using a free tool.
Businesses should aim to have a clear, up-to-date AI policy that aligns with business responsibilities. Workers should understand what tools are permitted and how they should be used, and leaders should aim to refresh their knowledge of the industry often to understand when is time to adapt and respond to new developments.
