Pax8: Two-Thirds of Small Businesses Using AI Build Their Own Tools Without Auditing Them

Small and midsize businesses have stopped only buying off-the-shelf AI and started building it themselves. According to a Pax8 survey published on Monday, October 12, two-thirds of small companies that already use AI make their own tools. In every market studied, most of them do so without a formal, documented review. The survey included 1150 respondents in total.

Pax8 is a marketplace based in Denver. It sells cloud and AI software to small businesses through IT providers, known as MSPs. These contractors typically act as an outsourced IT department for small firms. That gives Pax8 an unusual view of the market: its numbers reflect not only the sentiment of business owners but also what is happening across its partners' client base.

What exactly they are building

The available portion of the material does not define what counts as a "custom tool." Studies like this usually use the term to cover several levels of complexity:

• custom assistants built on off-the-shelf models and tuned to a department's tasks;
• automations on no-code platforms that connect email, CRM, and documents;
• scripts and small applications that make calls to model APIs;
• simple agents that carry out chains of actions.

The barrier to entry is low. Building such a tool takes one enthusiast in the office and a subscription to a service. That explains the scale: moving from buying to building is easier today than it was a year or two ago.

Shadow AI without paperwork

The main finding lies elsewhere. In every market surveyed, most companies do not run a formal, documented review of their own AI projects. That does not happen in a large corporation, which has a security team, lawyers, and a risk committee. A company of 20–50 people usually has no such chain. The decision falls to whoever can put together a working prototype.

The risks are quite concrete:

• client data ends up in a homemade tool, and no one records where it goes;
• API keys and access rights are handed out on a "just make it work" basis;
• it is unclear who is responsible for the model's errors and for maintaining the tool if its author leaves;
• there is no change log, so a failure is hard to diagnose.

This set of problems is what people usually call shadow AI. It grows wherever a tool is useful and sign-off is seen as needless bureaucracy.

Key survey data

• Publisher: Pax8, Denver, a marketplace for AI and cloud software for small businesses.
• Sample: 1150 respondents.
• Share of small companies using AI that build their own AI tools: about two-thirds.
• Formal, documented review: absent at most companies in every market studied.
• Publication date: October 12, 2026.

There is a caveat when reading these results. Pax8 earns money by selling software and services through IT providers, and the topic of risk management fits squarely with its commercial interests. That does not invalidate the data, but it calls for caution in drawing conclusions about scale. The available excerpt has no breakdown by country or company size and no question wording, and the two-thirds figure depends on all of them.

What business owners and MSPs should do

For the owner of a small firm, a minimal set of measures does not require a security department. It is enough to keep a register: which AI tools have been built, by whom, on what data, and with what access. One page per tool will do. Next, define the categories of data that must not be passed to models, and assign an owner to each tool.

For MSPs, this is a chance to offer clients an inventory and basic audit service for homemade solutions before they turn into critical infrastructure. For those who build on their own, the rule is simple: if a tool works with client data or makes decisions without a human in the loop, it deserves at least a short written review before launch.