Pax8 Survey Finds Two-Thirds of SMBs Building Custom AI Tools

A new report reveals most small firms are developing in-house AI solutions, often without formal security reviews or documented governance policies.

Threat Times Systems DeskOctober 13, 20262 min read

Share LinkedIn Reddit

Illustration: A small office desk holds a messy stack of blank papers and a single laptop with a glowing screen. — AI-generated illustration: Threat Times

Key points

% of AI-using SMBs have built at least one custom solution in regular use.
Only 13% rely solely on off-the-shelf tools, with most builders lacking formal review.
Data security and privacy exposure are the top cited risks for these internal builds.

Small and mid-sized businesses are increasingly shifting from purchasing commercial AI software to constructing their own artificial intelligence tools, according to a survey published on Monday. Pax8, a Denver-based software marketplace, found that two-thirds of firms using AI have already deployed at least one homegrown solution into regular operations.

The findings come from Pax8’s Q3 2026 SMB AI Pulse Report, which polled 1,150 business leaders across the US, UK, Germany, and Sweden. This marks the first time the quarterly series has included European markets. The data indicates a significant move away from off-the-shelf products, with only 13% of respondents relying exclusively on pre-built tools. Another 19% are currently prototyping custom AI applications.

Governance and Shadow AI Risks

A major concern identified in the report is the lack of formal oversight for these internal developments. In every market surveyed, the majority of firms building AI tools do so without a formal, documented review process. Formal review rates range from 23% in the UK to 45% in Sweden, with the US at 36%. Another 41% of US builders use consistent but undocumented review methods.

Shadow AI, defined by Pax8 as tools or agents running without official approval, was discovered by 35% of AI-using businesses in the past six months. Sweden reported the highest incidence of shadow AI at 55%, followed by the US at 42%. The UK and Germany reported lower rates of 24% and 19% respectively.

Regional Adoption and Technical Scope

The United States leads in custom AI adoption, with 81% of AI-using businesses running self-built solutions. Sweden follows at 76%, while the UK and Germany trail at 54% and 52% respectively. Sweden also has the highest proportion of builders working on AI agents, at 55%.

Among those building custom tools, 52% are developing automated workflows connecting AI to other business systems. Close to half (46%) are creating or testing AI agents capable of completing multi-step tasks autonomously. Additionally, 39% have built custom integrations using provider APIs, and a third are fine-tuning models.

What should you do?

Organizations should audit their current AI usage to identify any shadow AI tools operating outside official channels. Leaders need to establish clear, documented governance policies that specifically address in-house built agents and workflows, not just purchased software. Security teams should prioritize data privacy assessments for all custom integrations and API connections.

What to do and how to stay safe: Pax8

Conduct an inventory of all AI tools and workflows currently in use to identify unapproved shadow AI.
Develop and enforce documented review processes for any in-house AI development before deployment.
Implement specific governance policies that cover custom-built agents and automated workflows.
Regularly assess data security and privacy risks associated with custom API integrations and model fine-tuning.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.