Organizations are writing AI spend policies but still getting surprise bills. Learn why governance alone fails without real policies.
Most organizations have a policy for managing AI spend. Almost none of them have the visibility to know if it's actually working.
Six months ago, "we don't have a policy for AI spend" was the problem everyone was trying to solve. A lot of that has genuinely gotten better.
- Governance policies exist now.
- Spend thresholds are written down.
- Finance has a document to point to that didn't exist a year ago.
So even with a policy in place, organizations are still getting blindsided by AI bills anyway.
It turns out writing a policy and actually being able to see your AI spend are two different problems, and most companies solved the first one without ever touching the second.
The same curve, on fast-forward
Cloud spend took the better part of a decade to go from “someone should really look at this” to “this needs its own governance function.” AI is running that same arc in a fraction of the time.
Worldwide AI spending is projected to hit $2.67 trillion in 2026, and Gartner's latest forecast puts the total at $5.95 trillion by 2030. At that scale, AI isn't a tool cost anymore. It's a capital decision, and it's being made without the infrastructure cloud eventually had to build.
|
25%
of cloud & AI spend is wasted
|
>50%
of orgs don’t track unit economics metrics
|
1 in 5
orgs spend over $1M/month on AI
|
The gap that actually matters: policy vs. visibility
In the 2026 State of AI in FinOps Report, there was a finding that cuts to the center of it: 73% of organizations have AI cost policies in place. Only 47% say they fully enforce them. And just 13% have basic visibility into their AI costs at all. That’s not a small gap. It's the distance between writing a rule, enforcing it, and knowing whether it's actually working.
A policy tells you what should happen. It doesn't tell you what actually did.
An AI spend policy doesn't catch the team that spun up an oversized model for a task that didn't need it. It doesn't catch a retry loop that quietly tripled a bill overnight. It doesn't know a budget was crossed until the invoice says so, by which point the money is already spent.
The limit was written down. Nobody could see if it held.
Talk to any FinOps or engineering leader living through this and the pattern repeats. 72% of organizations have hit a surprise AI bill in the past year, and a third of them have been caught off guard more than once.
Some of this is structural: 52% of organizations say there’s no clear owner of AI cost at all, split across engineering, FinOps, finance, and IT, with each function holding a piece of the picture and nobody holding the whole thing.
Some of it is cultural. More than half of organizations actively encourage employees to maximize AI usage, called tokenmaxxing, regardless of whether that usage produces value. That’s a habit that made sense while everyone was still trying to get people to adopt AI in the first place, and never got recalibrated once the adoption phase ended.
And when something does go wrong, finding out why takes significant time: 79% of organizations need a full day or more to trace the source of a cost spike, and 32% need a full week. At $1M a month in spend, a week is an expensive place to get stuck.
The cost of a policy you can't see
None of this makes the policy a bad investment. Governance is necessary. It was just never going to be sufficient on its own, because a policy can only tell you what's supposed to happen, not what actually did. It can't catch the team that's already over the line. It can't confirm a threshold held instead of quietly slipping. It can set the rule. It can't watch the meter.
That's the problem organizations are actually sitting with heading into next year: not "do we have a policy for AI spend," but "now that we've written the policy, why can't we see whether anyone's actually following it?"
What comes after policy?
In our next post, we'll look at what it actually takes to see whether your AI cost policy is holding, in real time, not just another document everyone signed once and forgot.
Get the full data: 2026 State of AI in FinOps Report
Worried about tokenmaxxing on your own team? The AI ROI Playbook: From Token Spend to Business Outcomes
