AI Has Three Cost Centers. CFOs Need One Operating Model.

At month-end, the AI question sounds simple: what did we spend, and what did we get for it. Then you go looking. Some of it sits in a provider console billed by the token. Some is a line on an expense report for a subscription a team bought on its own. Some is a productivity claim nobody can reconstruct. One of those arrives as an invoice. The other two arrive as a surprise.

Technology spending used to categorize itself. IT managed infrastructure, departments bought software, HR managed people costs. AI collapsed those lines. Every AI workflow now carries an infrastructure cost in tokens, compute, and storage. It carries a labor implication, because it can reduce, accelerate, or reshape people’s work. And it carries a governance cost, because someone has to know what data went in, what the system produced, where sensitive information went, and how we will explain the result later. Those are one operating model now, and making it legible is the CFO’s job.

The AI bill is now an operating expense

Traditional software budgets were predictable: licenses, renewals, implementation, a manageable number of seats. AI is metered and variable, tied directly to usage. Once the workflow becomes part of daily operations, usage compounds. Prompts, retrieval, agent actions, model calls, and retries all carry a cost, and a cheap experiment can become a real operating expense before anyone has connected the spend to a business result.

This is a documented pattern, not a worry. Flexera’s 2026 State of ITAM Report found that only 31 percent of organizations have accurate visibility into their AI software spend, and 59 percent said wasted AI spend rose year over year. Success compounds the problem. The more teams use it, the more they consume.

None of that is going to convince people to slow down. It illustrates that we should manage AI as a variable-cost operating capability. Cost per token is a vendor metric. It tells you what you paid, not whether it was worth paying. The number I want is cost per useful, verifiable outcome.

Tokens are not free, and neither is the work they change

AI gets framed as tokens versus headcount. That doesn’t quite capture the issue. Tokens are an operating input and so is human time. When AI can summarize documents, prepare first-pass analysis, research a policy question, or carry a repeatable workflow, it creates capacity without requiring labor to scale at the same rate. The goal is to cut low-value manual work, shorten cycle times, and redeploy capable people onto work that needs judgment, relationships, and accountability. My colleague Dave Berg has written about why redeployment, not replacement, is where the value shows up.

That value only holds if the AI work can be managed. If every output has to be reconstructed, reviewed, and defended because no one knows what happened, the productivity gain quietly leaks back out. The savings show up in one team’s story and the cost shows up in another team’s calendar.

The hidden cost of unmanaged AI

The visible AI bill is the smaller number. The larger cost is the manual effort created when AI use is fragmented and impossible to reconstruct. Employees use different tools, models, prompts, and data sources. Then an audit, a customer question, a security issue, or a business decision requires someone to trace what happened. Who used the model? What information was included? Which model produced the output? Was sensitive data exposed? Can we demonstrate any of it?

Six months after the fact, the honest answers are usually: unclear, unclear, one of four, hopefully not, and no. So someone spends a week rebuilding history. Work has not been eliminated. It moved downstream into review, remediation, compliance, and investigation, where it is harder to see and nobody budgeted for it. That is why governance belongs inside the productivity model rather than being treated as a tax on adoption.

What I ask for now

Four things, and none of them require buying a platform to start.

Usage by team and by model, not a total. A total tells you the bill is growing. The split tells you why.

Cost per workflow run, not cost per seat. Seats were the right unit when software was a license. They are the wrong unit when the meter runs on use.

Every AI tool in the company, with a named owner. This exercise is always more interesting than anyone expects it to be.

A record you can retrieve without asking the person who ran the prompt. If your evidence lives in someone’s memory, you do not have evidence.

Those four move AI from a line item you explain after the fact to a capability you can manage.

Owning the rails around the models

This is where a control layer earns its place. Organizations should be able to use the model that best fits the work. There will not be one universal model for every use case, and no one should have to standardize on a single provider to keep control. The real question is whether you own the rails around the models you use.

I should disclose the obvious bias here, since Constellation builds a gate that helps me meet my fiduciary requirements. Gate AI brings usage visibility, cost management, security controls, and verifiable evidence together across the AI activity routed through it, so finance, operations, and risk look at the same picture instead of three partial ones. It protects sensitive information, credentials, and personally identifiable data before that information leaves the organization on its way to a model, and its cache-aware prompt compression trims token use without changing the substance of a request. To be precise about scope, because this gets oversold across the category: it is control over what data is exposed to third-party models, not a claim to police how a model reasons. The financial result is the part I care about, which is fewer convenience purchases, less unauthorized tool use, fewer duplicate subscriptions, and less premium model usage disconnected from measurable value. We have written about why we built it.

Evidence by default, not reconstruction after the fact

Whatever you use, the standard worth designing for is evidence by default. This is also becoming a requirement rather than good practice. The EU AI Act’s Article 12 record-keeping obligation will require high-risk AI systems to automatically log events across their lifetime so their operation can be traced. That obligation was deferred to December 2027 for standalone high-risk systems, but the direction is set, and other regimes are already closer to the present. Colorado’s SB 189 takes effect on 1 January 2027 with a three-year recordkeeping requirement. The teams that start keeping a verifiable record now are the ones ready when the rule lands, not the ones retrofitting it after an incident.

Internally we anchor AI activity to Constellation’s Digital Evidence layer, which makes the records tamper-evident and independently verifiable. We hold our own numbers to the same standard: our engineering team published its detection performance with full methodology so a buyer can audit it instead of taking it on faith. Verifiable records cut time spent on reconciliation, internal review, audit preparation, and incident investigation, and they give leaders a firmer basis for deciding which AI workflows to trust, expand, or shut down.

AI fluency is a finance discipline

AI literacy is knowing what the tools can do. AI fluency is understanding where they create value, what they cost, what they risk, and how to manage them at scale. A CFO does not need to become a model engineer. We do need to understand the economics well enough to ask the right questions. What outcome are we buying with this spend? What is the cost per verified outcome? What human work is being improved, reduced, or redirected? What evidence exists if we have to explain the result later?

Scale does not make AI strategic on its own. AI becomes strategic when you can grow useful work without letting cost and risk grow at the same pace. That is the difference between an operating capability and a permanent experiment. Every unit of intelligence should be measurable by its cost, its outcome, and the evidence behind it. If you want to see what that looks like in practice, you can start free at constellationgate.ai.