Shadow AI spend and corporate cards
Updated: September 27, 2026
Most AI cost reporting starts from the vendor invoice, which means it reports what was bought through the approved route. The line that never arrives is the one bought with a corporate card, a personal API key, or a free trial credit that quietly became a production dependency. For a finance function, an unmeasured cost base is not a governance problem, it is a forecasting problem: you cannot forecast spend you cannot see, and you cannot control a base you have not sized.
Three hiding places, in order of how much they cost
- Flat subscriptions on corporate cards. A seat plan at $100 to $500 a month, bought once by one person, appearing for months. The problem is not the amount, it is that it is invisible to the team that owns the budget and permanent until someone notices.
- Personal or team API keys. A single leaked key with no project tag produces an unattributable line that looks like noise on the vendor report, which is exactly how it stays alive.
- Trial and free-tier credits that became load-bearing. A workload that depends on a promotional rate is a workload whose cost is unknown and whose exit is a production incident rather than a procurement decision.
The sizing exercise, which is the whole point
You do not need to eliminate this to manage it. You need to size it, and sizing it is cheap:
- Run card spend against a keyword list for the vendors, plus any recurring charge above a threshold that no department has claimed.
- Ask for a list, not a policy. A short survey of who has an AI tool on a company card produces the denominator within a day. A policy document produces nothing.
- Look for repeat card payments to the same AI vendor across multiple cards. Two people paying the same flat plan independently is a duplicate seat, and it is the most common avoidable line in this category.
Then decide what is a real cost
Not all of it belongs in the budget. Interactive tooling genuinely used by engineers is a legitimate fixed cost, and it belongs as a named line with an owner rather than being swept into a token budget that cannot absorb it. The distinction that matters is whether the cost is visible, owned and reviewed — not whether it is large. An invisible $4,000 a month is a bigger forecasting problem than a visible $40,000.
Bottom line
The invoice only tells you what was bought through the approved route. A day of card analysis and a one-question survey sizes the rest, and until that base is sized, every AI budget number is a floor rather than an estimate.