Most leadership teams approve AI the way they approve any other software: pick a vendor, buy seats, write a policy. That approach assumes the cost and the risk are both known at the point of purchase. With AI, neither is. Usage is billed by the token. The tools now connect to mail, files, and business systems, and any employee can widen that access in an afternoon. Sprawl comes from everyone trying every tool on the market, each with its own account, data access, and bill.
We measured the cost on a recent project. One person spent two weeks building a small application with AI tools, and the token bill came to about $200. At that pace, one heavy user costs around $5,200 a year in usage. Across 150 people, that is roughly $780,000 a year before seat fees, and close to $80,000 even at a tenth of that intensity. Heavy use shows up outside software too: drafting documents and building slide decks has hit the limit of a $100-a-month AI subscription more than once, with no code involved. At least one major provider caps its team plan at 150 seats. Above that, its enterprise plan charges a seat fee for access and bills all usage separately at API rates. That usage figure is the number to plan for, and the seat price hides it.
The risk moved just as fast. During the same two weeks, AI review found confidential information appearing in the application's exports. The first fix passed its checks and still leaked under one condition. It was caught because someone tested again. In an organization where staff connect AI tools to the CRM or shared drives without review, nobody tests again.
A policy written once a year cannot govern a tool that changes every week. AI governance has to cover what a tool may connect to, who owns its output, and what it is allowed to cost, and it has to be reviewed as often as the tools change.
The controls themselves are straightforward. Inventory the AI tools and connections already in use. Decide what data and actions each may have before it is connected. Model cost on expected usage rather than seat price, and set a spending threshold that triggers review. Assign an owner to every AI-driven process that touches business data. The AI tools your staff are already using covers the policy layer these controls build on.
We help organizations put these controls in place ahead of a rollout, or catch up when adoption is already ahead of them. The aim is AI use that grows at the pace the business wants, with a cost the CFO can forecast and risks that someone has decided to accept.
Figures are taken from the project record.