What a $500 Million AI Bill Tells Us About the Need for AI Governance

A $500 million bill for AI usage. That’s roughly £370.5 million. 

Unsurprisingly, that number hit a few headlines and raised an important question: how did that level of spending become possible? 

In May 2026, Axios reported that an AI consultant described a client spending around $500 million in a single month after failing to put usage limits on Claude licences for employees. It was one of several recent signs that enterprise AI spending is coming under greater scrutiny. Around the same time:  

• Fortune reported that Microsoft had begun cancelling most of its Claude Code licences – a decision reportedly driven partially because of costs. 
• Business Insider quoted Uber COO Andrew MacDonald, who said AI spending was becoming “harder to justify”. 
• The Financial Times reported that Amazon had shut down an internal leaderboard of employees’ use of AI tools after some workers reportedly tried to boost their scores by engaging in unnecessary activity that increased computing costs. 

AI adoption is moving quickly, while the controls around usage, spend, and accountability are not always keeping pace. When asked ‘how visible are the operating costs of your AI systems today?’, KPMG’s Global AI Pulse Q2 2026 found most organisations lack full visibility into costs: 

• 42% of organisations reported their AI operating costs are ‘somewhat visible’ 
• 35% said costs are fully visible and actively monitored  
• 13% said visible only after billing 
• 8% said largely invisible  
• 3% weren’t sure 

The issue is not the technology itself, but whether its use is subject to clear organisational oversight. When there’s a lack of governance, the implications can extend beyond cost.  

AI systems may process sensitive information, support decision-making, or enable increasingly autonomous workflows. Where oversight does not keep pace with adoption, organisations may face uncontrolled spending, weaker accountability, regulatory non-compliance, and reputational damage. Other consequences may be less immediate, but still significant, including: 

• Unintended disclosure of sensitive information
• Unreliable or biased outputs being used in decision-making
• Weak accountability when an AI-enabled process fails
• Regulatory exposure involving personal data

In practice, organisations may need controls that support monitoring, restricted use, and accountability. In our recent ‘What Does Good AI Governance Look Like?’ webinar, experts discussed how effective AI governance can support organisational oversight, stakeholder confidence, and responsible AI adoption. 

ISO/IEC 42001 is the first internationally recognised standard for managing AI systems responsibly. As part of the standard, you will hear systems called AI Management Systems or AIMS. ISO 42001 specifies requirements for organisations to establish, implement, maintain, and continually improve AI use within a defined scope. To achieve certification, you must have an AI Management System (or AIMS) that meets ISO 42001 requirements, with documented processes and evidence of how it works. 

ISO 42001 provides a structured and auditable approach to AI governance, including requirements such as: 

• Defined roles, responsibilities, and authorities: These help establish who is accountable for AI deployment decisions, usage policies, and spend oversight. 
• Risk assessment and planning: Organisations are expected to consider plausible AI risk scenarios, including uncontrolled or unrestricted usage, complete AI system impact assessments, and to identify controls proportionate to those risks. 
• Operational controls and policies: These would typically address how AI tools are accessed, by whom, under what conditions, and within what limits. 
• Monitoring and measurement: These processes can provide visibility of AI system usage, performance, and, where relevant, spend, helping organisations detect and respond to anomalies. 

The standard is relevant to organisations developing AI-based products or services as well as to those deploying or using AI across their operations, including third-party tools. In many cases, the early driver is not regulation but procurement, assurance, and the need to show control. 

The UK’s AI approach is widely described as principles-based and pro-innovation. 

The 2023 UK AI Regulation White Paper set out an approach in which existing regulators apply their powers to AI within their sectors, rather than creating a single binding AI law in the near term. 

For UK organisations, this can create a specific governance challenge. 

Unlike the EU AI Act, there is no single compliance target for AI across all industries. Expectations can evolve through sector-specific regulation and guidance, including from bodies such as the ICO, FCA, and CQC. 

In that environment, ISO 42001 can provide a structured, auditable approach to demonstrate governance and control over AI systems, regardless of how sector expectations evolve. Under UK GDPR, organisations that use AI to process personal data must demonstrate accountability, transparency, and appropriate human oversight. These are enforceable expectations of GDPR, not simply good practice.  

The NCSC has also published guidance on secure AI deployment, including considerations such as understanding what AI systems can access, what actions they can take, and who is accountable for their behaviour. These considerations align closely with the types of governance and control considerations relevant to effective oversight. 

For organisations already certified to ISO 27001, ISO 42001 may be a natural complementary next step, extending management system discipline from information security into AI governance. 

Read more about the EU AI Act and what it means for UK businesses.  

These examples may be early indicators of what can happen when AI adoption outpaces governance. Organisations that address AI governance early may be better placed to demonstrate control, accountability, and assurance to clients, regulators, and supply-chain partners. 

Get in touch with our team to speak about ISO 42001.