Ask a governance team how much AI the organisation runs and you get a register. Ask finance how much AI the organisation costs and you get a number that does not reconcile with the register, usually because it is larger and includes things nobody has heard of.
That gap is worth more than it looks. Discovery programmes spend months trying to build a complete picture of AI use from scans, surveys and endpoint agents. Meanwhile a complete picture already exists, attributed to named people and cost centres, reviewed every month by someone whose job is to question it. Nobody forgets to bill you. The invoice is an inventory that somebody else maintains for free.
This guide is about treating spend as a governance signal rather than a finance problem: where AI money actually leaves the building, what the financial record tells you that a scan does not, why agents broke the forecasting model that worked for chat assistants, and what a spend control looks like when it is built for governance rather than for savings. It sits alongside our guides on shadow AI and building an AI inventory, and it uses a source neither of them does.
Why spend is a governance signal
Three properties make financial data unusually good governance telemetry, and all three are properties that purpose-built discovery tooling struggles to achieve.
It is complete for anything that costs money. A scan sees what it recognises. A network control sees what crosses it. A billing system sees every transaction that settled, because the counterparty had a commercial interest in making sure it did. For paid AI, which is most enterprise AI, the financial record has no recognition problem.
It is already attributed. Every line carries a cardholder, a cost centre, an approver, or a cloud account with an owner. Governance teams spend a great deal of effort attaching ownership to discovered systems. Finance had that attached before the discovery happened.
It is already reviewed on a cycle. Someone reconciles it monthly and asks about anomalies. That is an existing control with an existing owner, which is a much easier thing to extend than a new process is to introduce.
The profession that owns this data has noticed. The FinOps Foundation's State of FinOps 2026, drawn from 1,192 respondents representing more than 83 billion dollars in annual cloud spend, reports that 98% of respondents now manage AI spend, up from 63% in 2025 and 31% in 2024. In two years it went from a minority activity to near universal.
The part that should concern a governance team. The same report lists visibility into AI costs first among the challenges of applying FinOps to AI, and finds that 78% of these teams report to a CTO or CIO, with only 8% reporting to a CFO. So the function that holds the most complete AI usage record sits inside technology, is struggling with visibility, and in most organisations has never been asked a governance question. The data and the people who need it are one conversation apart.
Four routes AI money leaves the building
AI spend is not one budget line. It arrives through four channels with different owners, different approval paths and different blind spots, and most organisations watch one of them closely and the rest not at all.
| Route | Typical owner | What it shows | Blind spot |
|---|---|---|---|
| Enterprise agreement | Procurement | Named vendor, contracted terms, seat count, renewal date | Seats bought and never used, and what the seats are used for |
| Cloud model APIs and inference | Platform or engineering | Consumption by account, model and region | Which application or team the consumption belongs to, unless tagging was set up first |
| Departmental cards and SaaS subscriptions | The department | Tool name on a statement line | Who uses it, what data it touches, whether it was ever reviewed |
| Personal cards and expense claims | The individual | A reimbursement line, often months after the fact | Almost everything. This is the route that turns into a governance finding |
The fourth route is the one worth building a habit around, because it is the financial trace of the problem that discovery tooling exists to solve. An expense claim for an AI subscription is a declaration that somebody needed a tool, did not get it through the sanctioned route, and paid for it themselves. That is useful information arriving through a channel governance rarely reads.
It matters because the risk is measurable. IBM's Cost of a Data Breach work found that one in five studied organisations experienced breaches linked to shadow AI, that shadow AI incidents added as much as 670,000 dollars to the average breach cost, and that 63% of the breached organisations studied had no AI governance policies at all. The expense line is cheap to read. The incident is not.
What the invoice knows that the inventory does not
A register records what was declared. A bill records what happened. Where they disagree, the bill is usually right, and the disagreements are the interesting part.
-
Tools that exist but were never declaredThe simplest and highest value reconciliation in AI governance is to put the register next to twelve months of AI-category spend and look at what appears on one side only. It takes an afternoon and it routinely finds more than a quarter's worth of scanning.
-
Systems that were declared but are not usedThe reverse case is just as useful and far less discussed. A system carrying governance obligations, assessments and a review cycle, with no consumption behind it, is cost and effort spent on a control surface nobody is standing on. Retiring it is the cheapest risk reduction available.
-
Real usage, not claimed usageSeat counts tell you procurement's intent. Consumption tells you adoption. The difference changes which systems deserve a deep assessment and which deserve a renewal conversation instead.
-
The renewal date, which is the only moment terms can changeContractual terms on data use, training opt-out, retention and audit rights are negotiable once a year and fixed the rest of the time. A governance calendar built from renewal dates acts when it can actually change something.
-
A step change that nobody announcedA line that triples month on month is a system whose use changed materially. That is the trigger condition for revisiting a risk classification, and it arrives automatically rather than waiting for someone to remember to tell you.
The reconciliation to run first. Export twelve months of spend filtered to AI vendors and cloud AI services. Put it beside the AI register. Three columns: in both, spend only, register only. The first column is your real coverage rate, and it is the number worth reporting upward, because it is the one an auditor can reproduce.
Why agents broke the forecast
For chat assistants, cost behaved. A seat cost roughly what a seat cost, usage varied inside a band, and a per-seat budget forecast the next quarter adequately. Agents do not behave that way, and the reason is not that they are more expensive. It is that their cost is a property of the task rather than of the user.
The clearest measurement of this comes from a study of agentic coding published in April 2026 and revised in October, How Do AI Agents Spend Your Money?, which analysed trajectories from eight frontier models on a standard software engineering benchmark. Four of its findings matter for anyone writing an AI budget.
The same task costs wildly different amounts. Runs on the same task differed by up to 30 times in total tokens. Not different tasks, the same one. A budget built on an average per-task cost is averaging a distribution with a very long tail, and the tail is what blows the month.
Input tokens drive the cost, not output. This inverts the intuition most people bring from chat, where the long answer feels like the expensive part. In agentic work the context the agent reads and rereads dominates. That makes cost a function of how much the agent is allowed to look at, which is a scope decision and therefore a governance decision.
Agents cannot predict their own cost. Model self-predictions correlated with actual consumption at up to 0.39, and they systematically underestimated. Any control that relies on an agent declaring in advance what a task will cost is relying on a number the study shows to be unreliable in a known direction.
Spending more does not buy accuracy. The study found accuracy often peaks at intermediate cost and then flattens. The expensive runs are frequently the ones that went in circles, which means a cost spike is not merely a financial event. It is a signal that something went wrong.
Read that last point again, because it is the governance one. If high cost correlates with failure rather than with effort, then spend anomaly detection is not just budget hygiene. It is the cheapest available detector for agents looping, retrying, or working on something they should not be working on. Most organisations already have the alerting infrastructure. Very few have pointed it at this.
The unit that matters is not the seat
Per-seat accounting survives from the era when AI was a tool a person used. For anything that acts, the useful denominator is the unit of work: a ticket resolved, a document processed, a pull request opened, a case closed.
This is not an accounting preference. It changes what you can govern.
- It makes a threshold expressible. "No more than X per case" is a limit an engineer can implement and a reviewer can check. "Stay within budget" is not.
- It exposes the loop. A per-task cost that drifts upward while volume stays flat is the signature of growing context or multiplying retries, and it is invisible in a monthly total.
- It makes the build-versus-buy question answerable. Comparing an agent against the process it replaces requires both sides measured in the same unit, and the per-seat view cannot produce that comparison.
- It gives the approval tier something real to attach to. Approval tiers usually key on tool name or data class. Rate of spend is a better proxy for blast radius than either, because an agent that can spend quickly is an agent that can act quickly.
The prerequisite is attribution at the point of the call, which means tagging, headers or per-workload keys decided before the workload ships. Retrofitting attribution onto a consolidated bill is the single most common reason organisations can report total AI spend and nothing more useful than that.
Building a spend control that governs
A FinOps programme optimises cost. A governance programme uses cost to see and to limit. The mechanics overlap, the thresholds do not, and the difference shows up in what you do when a number moves.
-
Decide attribution before the next workload shipsEvery AI workload gets a tag, a key or an account that maps to an owner and a system in the register. This is cheap at the start and expensive to retrofit, and everything else in this list depends on it.
-
Run the reconciliation and make it quarterlyRegister against spend, both directions. Report the coverage rate rather than the count of systems. A coverage rate moves when reality moves; a count only moves when somebody declares something.
-
Set a per-task ceiling for anything agenticPick the unit of work, measure the current distribution rather than the average, and set the ceiling against the tail. Decide what happens at the ceiling: halt, escalate to a person, or fall back to a cheaper path. Deciding that in advance is the control.
-
Alert on rate of change, not on totalsMonthly totals find overspend after the month. A rate alert finds a looping agent the same day. Given that high cost tracks failure rather than effort, route the alert to whoever owns the system, not only to whoever owns the budget.
-
Make the expense feed a governance inputAsk finance for a standing filter on AI-category reimbursements and card lines. Treat each new vendor as an intake request rather than as a policy violation. Framed as enforcement it produces concealment; framed as a fast route to sanctioning something people clearly need, it produces a longer approved list and a shorter blind spot.
-
Put renewal dates on the governance calendarWork backwards ninety days from each renewal. That is when data use terms, retention, training opt-out and audit rights can still be changed, and it is the only point in the year when the vendor has a reason to agree.
What spend does not tell you
Spend is a good signal and a bad conclusion. Four limits are worth stating plainly, because each one has a failure mode attached.
Cost is not value. A system that costs little may be the one doing real work, and the expensive one may be looping. The study above found accuracy flattening while cost kept climbing, which should end the habit of reading high consumption as high engagement.
Spend is not risk. The highest risk AI in many organisations is a cheap classifier making consequential decisions about people. A spend-led view will rank it near the bottom. Use cost to find systems, then classify them on consequence, never on invoice size.
Free tools cost nothing and show up nowhere. This is the real limit of the method. Free tiers, open weights running locally and tools bundled inside something already purchased leave no financial trace at all. That is precisely where endpoint discovery earns its place, and it is why the invoice is a complement to discovery rather than a replacement for it.
The ROI question will arrive before you can answer it. Once governance starts quoting spend figures, someone senior will ask what the organisation got for the money. That is a fair question and usually unanswerable from the data at hand, because the denominator was never instrumented. Say so early. A governance function that oversells its cost data spends the following quarter defending a number it did not build.
Frequently asked questions
Where this leaves you
The useful reframing is that the finance function has been running an AI discovery programme for two years without being told that is what it was. The data is complete for anything paid, attributed to people, reviewed monthly, and currently used to answer one question when it could answer three.
It will not find the free tools, the local models or the features bundled into software you already own, and it says nothing about which systems are risky. It will tell you what exists, what changed, when you can renegotiate, and which agent spent four hours going in circles last Tuesday. For a function that usually has to build its own telemetry from scratch, that is a large amount of signal sitting in a system somebody else maintains.
Where a governance platform fits. A reconciliation is a spreadsheet exercise once. Keeping an inventory that stays aligned with what the organisation actually pays for, carries owners and risk classifications, and produces the evidence trail an auditor asks for is continuous work, and it is what a platform such as Holistic AI is built to carry. The bill tells you what exists. The register is what makes it governable.
