Only 23% of UK small businesses that build their own AI tools have a formal, documented process for reviewing them. That is the lowest figure of the four countries in a new survey from software distributor Pax8, published on 12 October, and it is the number we would put in front of any owner who has let a team member "just set something up in ChatGPT".
What the survey actually found
Pax8's Q3 2026 SMB AI Pulse questioned 1,150 leaders of businesses with 5 to 499 staff across the US, the UK, Germany and Sweden, 350 of them in the UK. The headline, in Pax8's own release, is that small businesses are building AI faster than they can govern it.
"Building" here does not mean hiring developers. It means the custom GPTs, automations and little agents that someone in the business wires up to save an hour a week. Coverage in Comms Business reports that among UK firms already engaged with AI, 54% have at least one self-built solution in regular use. Only 23% of UK firms formally review what they have built. Sweden, the best of the four, manages 45%.
The UK also had the lowest share of leaders who describe themselves as very confident in how their AI is governed, at 16%. The same coverage says 52% of established UK builders have received an unexpected bill, against 17% of firms that only use ready-made tools. Treat that last pair with a little care: the sample is small (the UK margin of error is about 5 percentage points) and we have only seen it in coverage of the report, not the full data.
Why a self-built tool is different from a bought one
When you buy a tool, someone else has already made decisions about security, uptime and what happens to your data. When a member of staff builds one, nobody has. That is not a criticism of the person building it, who is usually doing exactly what you hoped they would do. It is a gap in the process around them.
The pattern is a familiar one with first automations. The tool works, so everyone relaxes. Then it keeps working in the background for months while the person who built it moves roles, the prompt drifts, a connected account changes, and nobody can say what it is allowed to touch.
The survey's bill figure hints at a second problem. Self-built tools often call a paid AI service in the background. If nobody is watching usage, a loop that runs more often than intended turns into a surprise invoice. That is a tool cost, not a Kaizen price, but it lands on your card all the same.
There is one more reason the review matters, and it is easy to miss. AI services change underneath you. A model gets updated, a provider alters its pricing or a connected app changes how it shares data, and a tool that gave good answers in March can quietly give worse ones in October. Nothing breaks and no error appears, so unless someone checks the output against a few known cases, the first sign of trouble is usually a customer pointing it out.
Four checks that take an afternoon
You do not need a governance framework. Here is what we would do first, in order.
- List what exists. Ask everyone, with no blame attached, which AI tools, custom GPTs and automations they have built or connected. A shared spreadsheet is enough: name, owner, what it does, which accounts it can reach.
- Name an owner for each one. If the builder leaves, the tool needs a home. If nobody wants it, that tells you something.
- Set a spending alert. Most AI providers let you cap monthly usage or send a warning at a threshold. Switch it on today, on every account that has a card attached.
- Put a review date in the diary. Quarterly is plenty. At each review, someone other than the builder runs five realistic test cases and writes down whether the answers are still right.
That last step is the one the 23% are doing. It is also the cheapest.
The trade-offs are real
A review process costs time, and for a three-person firm a quarterly check can feel like paperwork for its own sake. If a tool only drafts internal notes and never touches customer data or money, a light touch is reasonable. The more a tool can send, publish, pay or read from your customers, the more it deserves a proper look.
It is also worth being clear about what a review does not do. It will not make a tool compliant with UK GDPR on its own. If a tool handles personal data, the questions to ask are the ones the Information Commissioner's Office sets out for AI, including what data goes in, where it is processed and how long it is kept.
What we would tell a client
Do not stop people building. The 54% of UK firms with a self-built tool are not wrong to have one, and the speed is the whole point. The mistake is treating a tool that works on Tuesday as a tool that is safe on every day after.
If you only do one thing this week, do the first check: write down what has been built. Owners are often surprised by the length of the list, and a list you can see is a list you can manage.
One caveat on the evidence: this is a vendor survey, self-reported, with a modest UK sample. The direction is consistent with other UK findings, but we would not hang a business decision on the exact percentages. We would hang one on the question: if the person who built your AI tool left tomorrow, would you know what it does?
