35%. In a new survey of 1,150 small business leaders across four countries, that's the share of businesses using AI that had found AI running in the last six months that nobody had approved. Almost half of those paying for AI had a bill bigger than they expected.
Four stories this week, one message. AI is already inside your business, in the tools you pay for and in the habits of your staff. The job now is knowing where it is, what it costs and what it can touch.
1. How common is shadow AI in small businesses?
More common than most owners think. On 12 October Pax8, a marketplace that sells cloud software through IT providers, published its latest SMB AI Pulse survey. It asked 1,150 leaders at firms with 5 to 499 staff in the US, UK, Germany and Sweden.
Of the businesses using AI, 35% had found shadow AI in the past six months. That's AI tools, workflows or agents running without anyone's approval. Two-thirds had built AI tools of their own, but formal, written review of those ranged from 23% in the UK to 45% in Sweden.
Of the businesses paying for AI, 49% had a bill higher than expected.
Why it matters: Pax8 sells to IT providers, so it has a reason to say you need help. The pattern will be familiar to anyone who has run IT for a small business. Staff find a tool that saves them an hour. Nobody asks what customer data goes into it. That's a gap in the process, not bad intent.
Practical takeaway:
- Ask before you ban. A short, no-blame question to each team about which AI tools they use often turns up tools an account check misses.
- Give people an approved option. Staff go around the rules when the approved route is slower than the workaround. Our guide to shadow AI and what to do about it has the full process.
- Write down who reviews anything built in-house. One name per tool. If you're an IT provider, your clients will be asking about this. Our AI for MSPs page shows where we fit.
2. Can you cap AI spending in HubSpot?
Yes, and it's now on by default. On 15 October HubSpot announced new controls for AI spend. Each account gets a credit limit of up to 50% above its monthly credits, so an agent has room to do more work but there's a ceiling if usage spikes. You can change it at any time.
Customers can also swap seats for credits themselves without waiting for their contract to renew. Credits can be bought in packs for a flat monthly rate or pay-as-you-go. HubSpot's Jon Dick said: "Nobody should have to miss out on getting the most out of AI because they don't know what the bill will be."
Why it matters: software is moving from a fixed price per person to paying for the work AI does. Microsoft is doing the same with Copilot, with pay-as-you-go on by default from 1 December. Usage pricing is fine if you can see it and cap it. HubSpot has made the cap the default. Not every vendor has.
Practical takeaway:
- Check where your cap is set. Up to 50% over is a ceiling, not a budget. Set it to a number you've agreed.
- Look for unused seats. If you're paying for seats nobody logs into, the swap is worth a conversation now rather than at renewal.
- Ask every vendor the same question. "Is there a hard cap on AI usage, and is it on by default?"
3. Can Gemini read your Xero accounts?
If you connect it, yes. On 14 October Xero launched a connected app for Google Gemini. You can ask Gemini for your profit and loss, overdue invoices, unpaid bills or cash position and get the answer from live Xero data, charted if you want. Xero already connects to Microsoft 365, Claude and ChatGPT.
Xero says anything that changes financial data, such as issuing an invoice or sending a payment reminder, needs your explicit confirmation first. It also says the data "is used solely for the user's session" and isn't used to train Google's Gemini models.
Why it matters: asking "who owes us money over 60 days?" in plain English beats running a report. It also means your finance data can now flow into whichever AI tool someone connects it to. That's exactly how shadow AI starts.
Practical takeaway:
- Decide who can connect your finance system to AI. One or two people, not anyone with a Xero login.
- Check what's already connected. Look at the connected apps in your Xero settings and remove anything nobody can explain.
- Agree it with your accountant. If they work in your Xero file, ask which AI tools they connect to it.
4. What is Google changing about links in AI Mode?
GoogleOn 15 October Google updated AI Mode and AI Overviews, the AI answers at the top of its search results. Inline links, the links inside the answer text, will appear higher up more often. Google is also testing a section at the top of some answers for the "one or two official places on the web to complete a specific task or get the exact info you need", with a note on why each link is useful.
Why it matters: it's a test, and Google hasn't said which searches it applies to. But the direction is clear. When someone asks Google how to book, pay, get a quote or find your opening hours, you want your own site to be the official place it points to. That depends on your site making those tasks easy to find.
Practical takeaway:
- List the five things customers come to do. Book, buy, get a quote, pay, find you. Each needs its own clear page.
- Make your details match everywhere. Name, address, hours and services, on your site and your Google Business Profile.
- Search for your own tasks in AI Mode. See who Google points to. If it isn't you, that's the gap to fix. Our website rebuild case study shows what that work looks like.
What this week means for your business
The AI is already in your business. Some you bought, some your staff found and some arrived in an update. Know where it is, what it can touch and what it costs each month.
That's the work we do. We build production AI around a specific problem with access and spend controls designed in, and we run it so it doesn't drift. The AI Readiness Diagnostic is free and no-obligation. You keep the statement of work, the wireframe and the ROI case whether or not we build anything.
Questions business owners are asking
How do I find out which AI tools my staff use?
Ask each team, without blame, which AI tools they use for work and what for. Then have your IT provider list the apps connected to staff accounts in Microsoft 365 or Google Workspace, check connected apps in your finance and CRM systems and look for AI subscriptions on card statements and expenses.
What is shadow AI?
Shadow AI is any AI tool, workflow or agent your staff use for work without the business approving it. In Pax8's October survey 35% of small businesses using AI had found some in the past six months.
How do I stop AI costs running over budget?
Set a hard cap in every tool that charges for AI usage and agree who can raise it. HubSpot now turns a cap on by default, at up to 50% above your monthly credits. Microsoft Copilot moves to pay-as-you-go by default on 1 December. Check each vendor's admin settings and ask whether a cap exists and whether it's on.
Is it safe to connect Xero to an AI assistant?
Xero says data shared with Gemini is used only for that session, isn't used to train Google's models and any change to your figures needs your confirmation. Before connecting it, decide who needs that access and what they should be able to see. Then check your connected apps regularly.