Shadow AI spend gets discussed as a governance concern. It is easier to act on as an arithmetic one, so this is an attempt to put a figure on it.
Where it accumulates
Untracked AI spend is not one thing. It arrives through five routes, and they compound.
Personal API keys. An engineer signs up with a work email and a corporate card to try something. It works, gets embedded, and never migrates to the organisation account.
Trials that converted. A fourteen-day trial that quietly became a monthly subscription nobody cancelled.
Team-level tools. A product team buys an AI writing tool, a design team buys an image generator. Each is small; neither appears in engineering's number.
Departed employees' accounts. Keys created by people who have left, still billing.
Idle infrastructure. Dedicated inference endpoints and GPU instances billing for uptime rather than requests. This is usually the single largest line, because the cost is continuous and the usage is not.
A worked figure
For a fifty-person company with meaningful AI usage, the direct waste typically looks something like:
- Two or three orphaned or duplicate subscriptions: $200–600 a month
- One idle inference endpoint or GPU instance: $300–1,500 a month
- Forgotten experiments still running: $100–500 a month
- Team-purchased AI tools outside the engineering budget: $300–1,000 a month
That lands somewhere between $900 and $3,600 a month, or roughly $11,000 to $43,000 a year.
As a rule of thumb, budget direct waste at a tenth to a fifth of your known AI spend, on the basis that untracked spend tends to scale with tracked spend.
Those numbers are estimates and your mix will differ. The point is the order of magnitude: real money, but not usually the dominant cost.
The indirect costs are larger
No baseline means no detection. This is the important one. Spend you are not tracking has nothing to deviate from, so an incident inside it — a retry loop, a compromised key, a job that stopped terminating — runs until someone reads an invoice. Detection latency inside untracked spend is not measured in days; it is the full billing cycle by definition.
A single incident of that kind can exceed a year of the direct waste above. It is the same arithmetic as any cost incident: burn rate multiplied by duration, and duration here is the maximum possible value.
Every forecast is wrong. If a meaningful share of AI spend is invisible, your total is wrong by that share and so is every projection built on it. The error is not random either — untracked spend grows faster than tracked spend, by virtue of having no owner.
Model comparison becomes impossible. You cannot evaluate whether to consolidate providers or switch models when a portion of usage is unaccounted for. Optimisation work is built on a number you know to be incomplete.
Security exposure. Credentials nobody rotates, in accounts nobody audits, held by people who may have left.
Finding it
Reconcile card and expense statements against your list of known providers. Twelve months, filtered for anything resembling a developer tool. This is the only method that reliably finds what you do not already know about, and it takes about an hour.
Audit key ownership inside the providers you do know about. Look for keys created by departed employees and keys with no recent usage.
Check outbound traffic to provider API endpoints, if you have egress logging. This catches accounts paid for personally and expensed as something else.
Ask your main providers whether other accounts exist on your email domain. Several will tell you.
Consolidating
Discovery is the easy half. Without consolidation the same accounts reappear within a year, because the conditions that created them have not changed.
Move accounts to organisation ownership rather than recreating them, so usage history survives.
Make the sanctioned path faster than a corporate card. These accounts exist because procurement was slower than signing up. If getting onto the org account takes a day, people use it.
Connect every provider to one view so the total is complete and each provider has a baseline. A provider you have connected is a provider that can be monitored; one you have merely found is not.
StackSpend connects providers with read-only access, so consolidating an estate is an afternoon rather than a project — and once connected, the spend you just discovered gets the same anomaly detection as everything else, which is what stops the next incident being invisible.
FAQ
How much does shadow AI spend typically cost?
As a rough guide, a tenth to a fifth of known AI spend. For a fifty-person company with meaningful AI usage that is often $900–$3,600 a month in direct waste, before counting incident exposure.
What is the biggest component of untracked AI spend?
Usually idle infrastructure — dedicated inference endpoints and GPU instances that bill for uptime regardless of requests. It is continuous, whereas the usage that justified it is not.
Why is untracked spend riskier than it is expensive?
Because it has no baseline and therefore no detection. An incident inside untracked spend runs until the invoice arrives, which makes the duration term in the loss calculation as large as it can be.
How do I find AI spend I do not know about?
Reconcile twelve months of card and expense statements against your known provider list. Audits inside providers you already track will not find accounts you have never heard of.
