Writing · · 8 min read
Your Team Is Already Using AI. Who Checked It?
AI can enter a small business without a formal rollout. Someone tries a writing assistant. A team member adds an AI feature to a tool they already use. A workflow starts passing information between systems. Before long, AI is part of daily work, but nobody has a clear picture of what is running, who approved it, or what information it handles.
That is the shadow AI problem: AI tools, workflows, or agents operating without official approval.
Pax8's Q3 2026 SMB AI Pulse Report describes a gap between adoption and oversight. Two-thirds of AI-engaged small businesses have AI in regular use. At the same time, 35% found unapproved AI tools, workflows, or agents in use. Only 45% formally document reviews of internally built AI.
Those figures do not mean every unapproved tool is causing harm. They do point to a practical question for owners: could you name the AI your team uses, and explain how it was checked?
AI use can be hard to see
When people think of AI, they often picture a chatbot or a separate app. But AI may also be built into software your business already uses, or added to a workflow that connects more than one tool. The visible product is only part of the picture.
A team member might use an AI assistant to draft customer messages. Another might use a tool to summarize documents. Someone else could connect a service to a business system to automate a task. Each use may seem small on its own. Taken together, they can leave an owner unsure about what information is being shared or who is responsible for checking the result.
That uncertainty is the issue. A list of approved apps is useful, but it may not capture the whole process. You also need to know what the tool is being used to do and what information it can access.
Start with an inventory, not a ban
A blanket ban may sound simple, but it does not tell you what is already in use. An inventory gives you a more useful starting point. It helps you separate approved uses from unknown ones, then decide what needs a closer look.
Ask your team to list AI tools and features they use for work. Include tools they access directly and AI features inside other services. Ask about workflows or agents that take actions across systems, too.
For each item, record:
| What to record | What it helps clarify |
|---|---|
| Tool or feature | What service, product, or AI capability is involved? |
| Work purpose | What task does it support? |
| Person or team responsible | Who uses it and who can answer questions about it? |
| Approval status | Who agreed to its use, if anyone? |
| Information it touches | Does it receive customer, staff, financial, or other business data? |
| Review record | Has anyone checked how it works and documented the decision? |
Keep the first pass simple. If a team member is unsure whether a feature uses AI, mark it for follow-up rather than guessing. The goal is a working map of actual use, not a perfect technical catalog on day one.
Ask what data each tool touches
Once you know which tools are in use, trace the information that goes into them. A writing assistant might receive a draft with customer details. A summarization tool might process internal documents. An automated workflow might pass information from one business service to another.
The question is not just whether a tool is "safe." It is what data the tool receives, what the business permits it to receive, and who has checked the relevant terms and settings.
For each use, ask:
- What information is entered, uploaded, or passed along?
- Is that information needed for the task?
- Could the task work with less information, or with identifying details removed?
- Who can check the tool's data handling and settings?
- What should the team do if the tool or workflow changes?
These questions help you make a specific decision. You might approve a tool for one task, restrict the information it can receive, or hold off until someone has reviewed it. Approval does not have to mean unrestricted use.
Make review a documented process
A review is more useful when the decision can be understood later by someone who was not in the room. Keep a short record of what was checked, who made the decision, and what conditions apply.
A practical review record can include:
- The tool or workflow and its intended use.
- The person responsible for it.
- The approval decision and who made it.
- The kinds of data it may handle.
- Any limits on use, such as tasks or information that are out of bounds.
- The date of review and what should trigger another one.
This does not need to become a large policy document. A shared list and a repeatable review step may be enough to make responsibilities clear. The important part is that a decision is not just passed along verbally and then forgotten.
Set a point for reviewing a tool again. That could be when its purpose changes, when it gains access to new information, or when someone connects it to another system. The right trigger depends on how your business uses the tool. What matters is that the team knows when to bring it back for review.
Keep a person responsible for the result
AI output can be useful and still need checking. Decide who reviews the result before it reaches a customer, becomes part of a business decision, or triggers another action. The person using the tool may be the right reviewer, but make that responsibility explicit.
Be clear about where AI can assist and where a person must make the call. If a workflow acts on information or sends something on behalf of the business, identify who can pause it, correct it, or turn it off. A process with no clear owner is difficult to improve when something changes.
This is also why approval and review are different. Approval answers whether a use is allowed. Review asks whether the use still fits its purpose, data limits, and responsibilities.
What an AI governance audit can cover
A focused audit can help you turn informal use into a clearer record. TresPies' AI governance audits cover four practical questions:
- What AI tools, features, workflows, or agents are in use? Build an inventory that reflects how the team actually works.
- Who approved each use? Record the decision-maker and make gaps visible.
- What data does each use touch? Trace information into and through the tools, so you can set appropriate limits.
- What is the documented review process? Define how a use is checked, recorded, and brought back for review when it changes.
The result is a clearer picture of current use and the next decisions to make. An audit is not a claim that every tool is risk-free, and an inventory alone does not settle every data or security question. It gives you a grounded place to decide what should continue, what needs conditions, and what should stop.
TresPies also writes about practical AI implementation in AI Integration Without the Hype. The same principle applies here: start with the work and the system you have, then make the next step specific.
A useful first step
Ask your team to name the AI tools and features they use for work, including ones built into existing software. Then pick one use and write down who approved it, what information it touches, and who reviews the result.
If those answers are hard to find, that is a place to begin, not a reason to assume the worst. TresPies can help you create an inventory and a documented review process through an AI governance audit. Bring the tools your team uses and the questions you cannot yet answer. The next step is a direct conversation about scope and what needs checking.