What's running, what it costs, who approved it: a 3-question AI check for small business

Most small businesses didn't plan an "AI strategy". They picked up a chatbot here, a meeting-notes tool there, and an automation someone set up on a Friday afternoon. Each one made sense at the time. Put together, they can leave the owner unable to answer three basic questions:

1. What's running?
2. What does it cost?
3. Who approved it?

If you can answer all three for every AI tool and automation in your business, you're in good shape. If you can't, this post walks you through a simple check you can do this week, without buying anything new.

The gap: AI is easy to start and easy to lose track of

AI tools are easy to start. Most need only an email address and a credit card, and many connect to your inbox, files or CRM in a couple of clicks. That's the upside. The downside is that nobody has to sign off. A tool one person tried in the spring can still be reading email in the fall, and a usage-based plan can grow quietly every month. The problem usually isn't one bad tool. It's that no one has the full list.

What "shadow AI" means, in plain English

"Shadow AI" is any AI tool, workflow or agent that's running in your business without anyone formally approving it. It's rarely sneaky. It's usually a helpful team member solving a real problem:

• A browser extension that summarizes email.
• A free chatbot someone pastes client notes into.
• An automation that sends follow-ups from a shared inbox.
• An "agent" connected to your calendar, CRM or files.

None of these is automatically bad. The risk is what you don't know: what data it can see, what it can send, what it costs, and who'd notice if it went wrong.

Question 1: What's running?

Start with an inventory. Don't aim for perfect; aim for complete enough to make decisions. One shared spreadsheet is fine.

For each item, write down:

• Name and purpose. "Meeting notes tool, summarizes sales calls."
• Who uses it. One person, a team, or everyone?
• What it connects to. Email, calendar, files, CRM, accounting, client portal.
• What it can do. Read only, or can it send, edit or delete?
• Type. A tool someone uses directly, an automation that runs on a schedule, or an agent that acts on its own.

Where to look:

• Your email and Microsoft 365 or Google Workspace admin panel, for connected apps and third-party permissions.
• Card statements, for AI subscriptions.
• Your automation platform (Zapier, Make, SuiteDash automations, and similar).
• Your team. Ask: "What AI tools do you use, even occasionally?" Make it safe to answer honestly; the goal is a list, not blame.

Question 2: What does it cost?

AI pricing is often usage-based. That's fair, but it means the bill can climb without anyone changing a setting.

For each item on your list, add:

• Plan and billing model. Flat per seat, or based on usage?
• Who pays and on which card.
• Last three months of charges, so you can spot a trend.
• An owner who watches usage. Every tool needs a named person who'd notice a spike.

Then ask a blunt question: is this still earning its keep? Tools that seemed useful at sign-up are sometimes barely used now. Cancelling those is the quickest win in this whole exercise.

Question 3: Who approved it?

This is the question that matters most when something goes wrong. For each item, record who decided it was OK to use, and for what.

Then add a simple rule: anything that leaves the building needs an approval gate. That means anything that:

• Sends email, texts or messages to clients.
• Posts publicly.
• Changes client records, invoices or payments.
• Touches security settings.

An approval gate can be as simple as "the AI drafts it, a person reviews and clicks send." Internal, low-risk tasks, like summarizing your own notes, can run with lighter oversight. Anything client-facing or outbound gets a human sign-off.

How we run our own AI team

We hold ourselves to the same three questions. The owner runs WrightClick with a team of 13 AI agents built on Grok Bot. They handle things like email triage, scheduling, research and first drafts. A few rules keep that team answerable:

• Draft until approved. Every outbound message is a draft until a person approves it. Nothing ships without the owner's OK.
• Run logs. Every bot logs what it ran and when, so "what's running?" has a real answer.
• A weekly usage audit. We review scheduled routines and flag ones that rarely find anything. On Oct 9, a weekly audit cut our scheduled runs from about 1,100 to about 130–150 a week.

That last point matters for cost, too. Fewer pointless runs means lower usage and less noise for the person reviewing the output.

Your one-page AI check

Print this, or copy it into a doc, and work through it this week:

1. List every AI tool, automation and agent in the business.
2. Note what each one connects to and whether it can send, edit or delete.
3. Add the cost, the billing model and who pays.
4. Name an owner for each item who watches usage and results.
5. Record who approved it and for what.
6. Gate anything that leaves the building: AI drafts, a person approves.
7. Cancel anything nobody uses or nobody will own.
8. Repeat monthly. It gets faster every time.

Want a second set of eyes?

If your list turns up more questions than answers, that's normal. We can go through it with you, flag the risky connections, and help set up simple approval gates that fit how your team already works.

Book a free assessment