AI spend is compounding faster than the governance around it. Here is how boards and risk functions can connect token consumption to business value.
ai-embed Insights · 29 October 2026
Most organisations still treat AI as a line in the technology budget. That framing is already out of date. Goldman Sachs projects that global AI-related spending will reach $800 billion this year, yet only 23 per cent of C-suite leaders report widespread, sustained business value from AI across their organisations. The distance between those two figures is not a failure of models or infrastructure. It is a failure of governance.
AI consumption now behaves like an emerging risk exposure: growing quickly, concentrated in a few places, poorly attributed and owned by no one in particular. Risk functions already have the disciplines to deal with that profile. The practical task for leaders is to bring them in before the exposure hardens into habit.
Risk practitioners will recognise the mechanism as the Jevons paradox. In the nineteenth century, more efficient steam engines did not reduce Britain's coal consumption. They expanded it, because applications that had been uneconomic suddenly made sense. Enterprise AI is following the same pattern. Token prices fall, deployment broadens, workloads that once looked prohibitively expensive become routine, and consumption compounds.
The scale of what follows is considerable. Recent modelling suggests token consumption could reach roughly 120 quadrillion tokens a month by 2030, around 24 times current levels. Any organisation that treats today's usage as its baseline is not planning for that future. It is building fragility into its cost structure.
The response is to forecast on consumption, not unit price. Budget scenarios should assume that cheaper tokens lead to more use, and should be stress-tested against growth in workloads, users and automated processes. A cost model that improves only when prices fall is a model that has not understood its own drivers.
The structural problem is one of distributed accountability. AI costs land in the technology budget, whilst the value accrues elsewhere: in customer service, in finance, in commercial operations. The CFO sees cost, the CIO sees utilisation and business leaders see outcomes. Nobody holds a view that connects the three at enterprise level.
That is precisely the kind of blind spot an enterprise risk framework exists to surface. It also explains why tokenomics matters. At its core, tokenomics means connecting what AI consumes to the value it returns. Tokens are the basic units of data that models process, and every prompt, response and step in an automated workflow uses them. They were once a billing detail. They are now a factor of production, and they deserve the discipline applied to capital allocation.
In practice, that means assigning a named owner for AI economics at executive level, agreeing a small set of shared metrics across technology, finance and the business, and tracking consumption against outcomes for each significant workflow. If a workflow cannot be tied to a result, that is itself a finding.
Consumption is rarely evenly spread. In large-scale deployments, fewer than ten per cent of users and workflows typically drive the vast majority of spend. That is a classic Pareto concentration risk, and it intensifies as AI moves deeper into operations. Chatbots become agents, agents become coordinated systems of agents, and text expands into multimodal generation. At the physical edge, autonomous systems draw on the same inference infrastructure at a token cost the business never planned for.
Each of these steps also widens the attack surface. Security costs seldom appear in the original business case, yet they grow with every new agent and connection. Left unmeasured, they compound silently alongside the visible spend.
The remedy begins with visibility. Identify the small number of workloads that dominate consumption and subject them to the scrutiny you would give any concentrated exposure. Classify work by complexity and risk before routing it, rather than defaulting to the most capable model because it is the path of least resistance. Then bring security and control costs into the same model, so that the full cost of a deployment is visible before it scales.
The organisations pulling ahead are not distinguished by better models. They have put genuine governance in place: shared metrics, clear decision rights and oversight structures that tie AI consumption to measurable business outcomes. They make AI economics visible to the executive team as a matter of routine, not only when the quarterly invoice arrives.
None of this is novel to anyone who has built a functioning ERM programme. Governance comes before scale hardens. Visibility is the precondition for control. The Pareto principle applies to concentration of exposure. These are established fundamentals that happen to fit a new class of enterprise risk with some precision.
A sensible starting point is modest. Add AI consumption and its dependencies to the risk register, give it an owner, define the metrics that link spend to value, and report on them to the executive committee and board on a regular cycle. Review decision rights for who may deploy new agents and workloads, and on what economic and security criteria.
AI economics will not stabilise without deliberate effort, and the bill will not wait for governance to catch up. The question for the board is not how much AI costs. It is whether the structures exist to show that those costs are defensible against what they actually return. If they do not, that is the risk to put on the register today.