The cost of intelligence

Most organizations did not decide to spend heavily on artificial intelligence. They discovered they already were.

Enterprise AI spread through the fastest adoption curve in modern technology. It came not through a procurement cycle or a business case, but through bundled licenses, embedded copilots, developer tools and employee initiative. Somewhere in that rush, a distinction was lost. AI is not a software purchase. It is a metered utility, and every prompt, retrieval, reasoning step and agent call carries a variable cost that accrues whether or not it produces anything of value.

The result is now measurable. In May, Gartner forecast that worldwide AI spending will reach $2.59 trillion in 2026, a 47% year-over-year increase. Yet a February 2026 report from Sapio Research and DoiT found that 79% of enterprises reported AI cost overruns in the preceding 12 months, and only 15% could calculate AI return on investment without significant bottlenecks. AI adoption is nearly universal. Financial control over it is not.

In addition, 2025 research from the Massachusetts Institute of Technology’s Networked AI Agents in Decentralized Architecture (MIT NANDA) initiative found that 95% of enterprise generative AI pilots produced no measurable impact on the profit and loss (P&L) statement.

This is not a case against AI investment. It is a case for proper sequence. Organizations that established visibility and governance before scaling consumption are converting AI spend into compounding returns. Those that scaled first are finding that unmanaged consumption compounds, heightening security, compliance and executive credibility risks along with it.

Companies must understand three key issues to achieve effective AI consumption:

• AI spend follows an infrastructure cost model, not a software fee model. AI spend is variable, usage-driven and largely invisible between invoices. Applying a software licensing mindset to a consumption-based cost structure is the root of most AI budget failures.
• The binding constraint is visibility, not price. Though token prices have fallen roughly 98% since late 2022, enterprise bills have risen anyway, based on industry analyses of production AI cost behavior. What an organization cannot see, it cannot allocate, forecast, govern or optimize, in that order.
• Security and financial governance are the same problem. Ungoverned AI usage produces an unmanaged cost and an unmanaged data flow. The missing controls that create budget surprises are now driving breach costs, insurance claim denials and regulatory exposure.

How adoption outran the controls

There is nothing irrational about how organizations got here. AI entered the enterprise through doors that governance does not usually watch, and each step along the way was reasonable.

The myth: “Our AI costs are a line item we can forecast from the pilot.”

The reality: A pilot measures feasibility, not consumption. Production AI scales with usage, and usage scales with tool quality. The more successful the deployment, the higher the bill—and the less accurately the pilot predicted it.

Where the money actually goes

Three dynamics separate AI from every prior category of enterprise technology spend. Together they explain why budgets set in good faith are often exceeded by wide margins.

Instrumentation has not kept pace with budget challenges. In a February 2026 report, The FinOps Foundation found that 98% of FinOps practitioners now manage AI spend, up from 31% two years earlier, yet 53.4% still struggle to see that spend and 40.1% cannot quantify its value. Further, Flexera’s 2026 State of the Cloud Report found that cloud waste has climbed to 29% of infrastructure and platform budgets—the first increase in five years, driven by AI workloads that existing commitment frameworks were never designed to handle.

Where control gaps become cost

Control gaps are rarely visible at the moment of AI adoption. They surface later as cost, exposure and failed expectations, and by then the symptom is usually blamed on AI itself. The chain is predictable:

Weak visibility → no attribution → no accountability → no forecast → budget surprise at the invoice stage

Weak governance → unsanctioned tools → ungoverned data flows → breach cost, denied coverage and regulatory exposure

The table below summarizes findings from multiple surveys, research reports and industry analyses that link specific AI control gaps to downstream business impacts.

The security dimension is not a footnote to the cost problem. It is the same problem seen from a different seat. In a recent survey, the Cloud Security Alliance (CSA) AI Safety Initiative found that 8 in 10 employees use AI tools their organization had not approved; only 37% of enterprises have an AI governance policy; and an estimated 89% of enterprise AI usage is invisible to security teams. In addition, generative AI is now the single largest vector for corporate-to-personal data movement, accounting for 32% of such transfers.

IBM’s 2025 Cost of a Data Breach Report recognized shadow AI as a formal breach category for the first time: 1 in 5 organizations reported a breach involving unauthorized (shadow) use, at $670,000 in additional cost; 97% of those suffering an AI-related breach lacked proper AI access controls. However, the CSA survey results indicated that where sanctioned tools are provisioned, unauthorized use drops 89%. The remedy is access controls, not prohibition.

The consequences of a data breach now extend beyond the incident itself. Insurance carriers began attaching AI-specific conditions to cyber policies in 2026; based on cyber insurance market analysis, more than 40% of cyber claims are being denied, with 82% of denials tied to controls carriers assumed were in place at underwriting. Coverage increasingly depends on demonstrable AI inventories, access controls and enforced usage policy—evidence most organizations cannot yet produce. In parallel, the EU Artificial Intelligence Act entered broad application in August 2026, with penalties for prohibited practices reaching 35 million euros or 7% of global annual turnover. A June 2026 amendment deferred the heaviest high-risk obligations to December 2027, but an incomplete AI inventory is a compliance problem regardless of the timeline.

The pattern: Ungoverned AI surfaces not as a governance problem but as an invoice, an incident or a denied claim. Organizations then respond by restricting tools, which drives usage further underground and makes the next surprise costlier.

The evidence

The pattern above is not anecdotal. It is consistent across every major body of research published in the last 18 months.

The AI economics readiness model

Acting on the evidence above requires a framework simple enough to survive a board conversation. The model below defines four layers an organization must establish, in order, before AI consumption produces compounding returns. Each layer is a prerequisite for the next.

What leading organizations do differently

The organizations converting AI spend into defensible returns are distinguished not by larger budgets or better models, but by thorough preparation and disciplined usage.

1. They instrument before they scale. Attribution tagging, usage telemetry and a spend baseline are established before a workload reaches production, not after the first surprising invoice.
2. They measure unit economics, not just spend. Cost per resolved case is measured along with per document processed and per engineering hour returned. A total that can be divided by an outcome can be managed.
3. They provision rather than prohibit. The CSA survey found that sanctioned, governed tools reduce unauthorized use by 89%. Bans simply move usage into channels the organization cannot see.
4. They treat model selection as a financial decision. Most workloads do not require frontier models. Deliberate routing to lower-cost tiers is consistently the highest-impact optimization available.
5. They enforce limits in the run time, not the policy document. Budget caps, retry ceilings and circuit breakers are implemented in code. Limits must live in the code that runs the AI, not in a policy PDF. Soft limits fail the moment multiple agents run at once or an agent gets stuck retrying.
6. They give AI spend a single owner. Accountability today is split almost evenly between technology and finance, but should be assigned to a single owner.

The bottom line: Average organizations ask, “How do we reduce our AI bill?” High-performing organizations ask, “What is a unit of AI value worth to us, and what should it cost to produce?” Those that will successfully defend their AI investment two years from now are establishing visibility and ownership today, while the spend is still small enough to shape.

How RSM can help

As AI consumption grows more complex, understanding its economics becomes critical. RSM delivers an effective first step with a comprehensive AI economics assessment: a focused engagement to establish what AI your organization is consuming, what it costs, who owns it, where the security and compliance gaps lie, and what to address first. Leadership gets an evidence-based baseline before rather than after the next budget cycle.

In addition, the RSM team provides targeted solutions through every layer of the AI economics readiness model: