Pax8 says 90% of small businesses use AI but only 23% have written rules for it, like a work ute everyone drives and nobody logs
By Brett Gavaghan, Founder of Adaptd ·
Cloud distributor Pax8 has launched 8os and 8bot so IT providers can run and cap AI for their small business clients. Its research shows most small businesses use AI without a written policy.
The short version
- Pax8 has launched 8os, a system for IT providers to manage AI tools for clients, and 8bot, a managed AI assistant for staff.
- Pax8's research found 90% of small businesses use or test AI, but only 23% have a documented AI use policy.
- Write a one-page AI policy now, and ask your IT provider how they plan to manage and cap AI costs.
Ask a room of small business owners whether their team uses AI and most hands go up. Ask who has written down the rules and the room goes quiet.
What are Pax8's 8os and 8bot?
Pax8's 8os is a platform that lets IT providers run AI agents, models and tools for their small business clients in one place, launched on 20 October 2026. It tracks usage and cost by user and by client, with hard caps to stop surprise bills.
8bot is the staff-facing part: a packaged AI assistant that an IT provider rolls out to a client's employees as a managed service. Pax8 sells through more than 47,000 IT providers serving 800,000 small and medium businesses worldwide, so you'd get it through your provider, if they offer it.
What did Pax8's research find?
Pax8's research found that 90% of small and medium businesses use or are testing AI, but only 23% have a documented AI use policy. Nearly half have found unapproved "shadow AI" in the business.
It also found that 71% of businesses using AI have built at least one AI tool of their own, and only 31% of those use a formal review or approval step. Pax8 is selling a product that fixes this problem, so read the numbers with that in mind. They still match what most of us see in real businesses.
What should your business do about it?
Your business should write a one-page AI policy before it buys anything new. Cover which tools are approved, what data never goes into them, and who checks AI work before it reaches a customer.
My advice: then ask your IT provider two questions. Can they see which AI tools your team uses, and can they cap what those tools cost? If the answer is a long pause, that's an answer too.
Rules written after the first incident are called an apology.
Wondering what this means for your business?
That's exactly what the discovery call is for.