A 1-10 person team in 2026 has approved-tool unapproved-capability shadow AI running inside its already-approved SaaS estate (Notion AI agents, Slack AI, Microsoft 365 Copilot, Atlassian Intelligence, Google Workspace Gemini, Salesforce Einstein) at near-universal incidence, because the vendors have shipped these capabilities as on-by-default or low-friction add-ons inside the existing licence path. The three discovery signs (SaaS bill line items the founder does not remember approving; team-member mentions of new features inside existing tools; vendor admin console notifications advertising auto-enabled AI capabilities) are reliable triggers for a 60-minute audit (SaaS bill review, vendor admin console walk, team check-in) that produces a one-page inventory mapping each AI capability to the tool, activation date, current users, data scope, and team's explicit posture. The inventory is the artefact that answers client procurement questions about AI tool exposure and the basis for any disable-or-restrict decisions.

Re-review 10 Jun 2026: incidence leg confirmed current. Notion 3.3 shipped Custom Agents inside the existing licence path (release notes 24 Feb 2026) and extended them to private Slack channels (1 May 2026); Slack AI enabled at workspace level grants every paid seat access; 2026 admin guidance for Copilot, Gemini and Apple Intelligence describes embedded AI as arriving by default with disabling as the admin task. Notion restricts agent-creation controls to Business and Enterprise admins - a partial control, not default-off or per-workspace re-consent, so trigger (1) has not fired; triggers (2)-(4) silent on search. Audit instrument unchanged. Claim is scoped to the small-team operational layer of the intra-vendor shadow-AI problem covered for enterprise at AM-168. Asserts near-universal incidence for teams using mainstream SaaS tools in 2026 — does not assert every team is exposed to a harmful degree, only that the audit will find something in every team that has not run it. 30-day review cadence calibrated to vendor feature-release cycles. Trigger conditions: (1) a major SaaS vendor (Notion, Slack, Microsoft, Google, Atlassian, Salesforce) ships clearer default-off settings for new AI capabilities or per-workspace re-consent flows — would move toward Partial because the gap is closing structurally; (2) a small-business cyber-incident report or insurance bulletin traceable to an intra-vendor agent capability the team did not authorise — would confirm the operational exposure and harden the case-for-action; (3) a published change in the small-business AI compliance regime (EU AI Act guidance for SMB GPAI deployers, Colorado AI Act small-business provisions) requiring explicit consent for vendor-side AI capability changes — would change the operator's legal map; (4) emergence of an SMB-targeted shadow-AI discovery tool with intra-vendor capability coverage as a default feature — would change the discovery-instrument landscape.