57% of U.S. small firms got a surprise AI bill. What that means for your office

What's new

On Oct. 12, Pax8, a company that sells cloud software through IT service providers, released its SMB AI Pulse Report. It surveyed 1,150 owners, executives and managers at companies with 5 to 499 employees in the U.S., U.K., Germany and Sweden. 400 of them were in the U.S. That size band is close to the companies we work with.

The headline finding: small companies are no longer just using AI. They're building it. Across all four markets, 67% of firms using AI had built at least one AI tool now in regular use. 52% of builders were making automated workflows that connect AI to other business systems, and 46% were building or testing AI agents. Only 13% relied on off-the-shelf tools alone.

The catch is in the report's title: firms are building AI faster than they can govern it.

The U.S. numbers

U.S. small firms build fast and check slowly

U.S. companies with 5 to 499 employees (400 surveyed). Survey answers; margin of error about ±4.9 points.

1. Use AIall U.S. firms86%
2. Built AI tools now in useof firms using AI81%
3. Decision-makers checking AI work 3+ hours a week68%
4. Got an unexpectedly high AI billof firms paying for AI57%
5. Found AI running that nobody approvedpast six months42%
6. Have a dedicated AI budget line37%
7. Have formal, written review of AI they built36%

Source: Pax8 SMB AI Pulse Report, Q3 2026, released Oct. 12, 2026.

Pax8 points to the gap between 81% building and 36% reviewing, 45 points, as the widest of the four countries. The most common approach in many markets, the report says, is a consistent review that isn't written down, so there's no record.

Three problems, in plain terms

AI nobody approved. 42% of U.S. firms using AI found tools, workflows or agents running without approval in the past six months. Asked about the biggest risk from AI built by employees, firms in every market put data security or privacy first. The report also names a quieter one: tools that become hard to maintain once the person who built them leaves.

Bills nobody expected. 57% of U.S. firms paying for AI got at least one bill higher than they expected, and 25% got more than one. U.S. firms pay through a mix of usage-based pricing (46%), fixed subscriptions (41%) and per-seat pricing (40%). Usage-based charges are the hardest to forecast, and they grow as you add workflows and agents.

Time spent checking. 75% of U.S. respondents said AI has freed up time. But 68% spend three or more hours a week reviewing, editing or fact-checking AI work, the heaviest load of the four countries. Across all markets, 7% spend ten hours or more.

The time AI saves on writing is partly spent on checking. Plan for that, or you won't see the savings.

What the other side has right

• It's vendor research. Pax8 sells through IT service providers, and its president, Nick Heddy, says the findings show why small firms need "trusted partners." A survey that finds risk is good for a company that sells help with risk. We sell help too, so weigh our read the same way.
• "Built" is a loose word. The Federal Reserve's survey of small employer firms found only 7% of AI users had fully integrated AI into their business. Both can be true if many "built" tools are small: a saved prompt, a custom GPT, a two-step automation.
• Some unapproved AI is how good ideas start. An employee who wires up a fix on their own has found a real problem. Shutting it down without asking what it solves wastes that.
• Checking is not wasted time. A manager reading AI drafts is doing quality control. The question is whether the checking is aimed well, not whether it happens.

The report doesn't give fieldwork dates, and it says results aren't comparable with Pax8's earlier U.S.-only editions.

Our take for a 40-400 person company

None of this is new to anyone who lived through the spreadsheet years. Somebody builds a macro that the whole AP desk depends on, then leaves, and nobody knows how it works. AI speeds that up, and adds a meter that runs while it works.

The checking burden is the number we'd look at hardest. If a manager spends three hours a week rereading AI output, that's often a sign the AI is doing open-ended work where every result needs a full read. A built process should do the opposite: the same steps every time, rules checked at each step, and only the doubtful fields flagged for a person. Checking an order with two highlighted fields takes seconds. Rereading a whole draft takes minutes. We covered the difference in ChatGPT vs. custom AI for business processes.

What to do this month

1. Make the list. Every AI tool, automation and agent in use, including free ones and personal accounts used for work. For each: who owns it, what data goes in, what it touches.
2. Give every tool an owner. If the person who built it left tomorrow, who could fix it?
3. Put AI on its own budget line. Pull the last three months of AI charges from card statements and invoices. Set a monthly cap or alert on anything usage-based.
4. Write down the review step. One line per tool: who checks the output, and when. Anything that reaches a customer or your ERP needs a person approving it.
5. Time the checking. Ask managers how long they spend reviewing AI work. Where it's hours, that workflow probably needs fixed steps instead of a chat. For more on agents and approvals, see when AI agents went off script.