What a Reported $500 Million AI Bill Tells Us About the Need for AI Governance

A $500 million AI bill. It’s an eye-catching number. 

However, it raises an important question: how did that level of AI spending become possible? 

Recently, an AI consultant claimed one client spent half a billion dollars in a single month after failing to put usage limits on Claude licenses for employees, according to an Axios report. 

While the figure is striking, it is not an isolated incident. Additional reports include: 

• How Microsoft ended internal Claude Code licenses, in part due to costs, after usage reportedly exceeded the company’s AI budget (source: Forbes). 
• Uber exhausted its 2026 AI budget in just four months after Claude Code spread rapidly across roughly 5,000 engineers (source: Forbes). 
• Amazon shut down an internal AI usage leaderboard after employees were said to be generating low-value prompts that increased infrastructure costs (source: Yahoo Finance). 

It can be tempting to dismiss these as AI horror stories, but the reporting points to broader governance concerns. 

This is a governance problem—not a technology problem. 

These examples appear to be less about the tools themselves and more about whether the use was subject to appropriate oversight, and control—for example, failing to set usage limits. 

These governance concerns can be relevant where organizations deploy AI systems that can take actions or trigger tasks with limited human intervention, without management system controls proportionate to that use.  

While spending spikes may be the most visible warning sign, poor AI oversight could also increase risk exposure around: 

• Data handling 
• Output quality 
• Compliance  
• Reputation 

As AI continues to become more common in everyday business operations, it is crucial organizations use it in a way that is controlled, responsible, and trusted. ISO/IEC 42001 is an international standard for managing how an organization uses AI. It can help businesses control, oversee, and manage AI use responsibly within a defined scope, including relevant policies, processes, and controls. 

It is the first internationally recognized standard for managing AI systems responsibly, so its relevance is not limited to technology companies. In fact, ISO/IEC 42001 could be useful for any organization deploying and using AI across its operations—not just those developing AI-based products or services. 

ISO 42001 aligns with other major ISO management system standards through the Harmonized Structure, which reduces duplication and can streamline implementation for organizations adopting multiple standards. This may make it more accessible to organizations already working with standards such as ISO 27001 (information security) or ISO 9001 (quality). For organizations already certified to ISO 27001, ISO 42001 may be a complementary next step, extending management system discipline from information security into AI governance.  

With appropriate AI governance in place, situations such as those reported may have been avoidable. The idea being that organizations can demonstrate, through audit evidence, they have controls and monitoring defined and applied in a way that is proportionate to the scope and risk of AI use. 

That could include: 

• Defined roles, responsibilities, and authorities: Who is accountable for AI deployment decisions, usage policies, and spending oversight. 
• Risk assessment: AI usage requires controls proportionate to that risk. For example, there is a different level of risk posed by a chatbot used for ideas versus relying on AI for decision-making. 
• Access and conditions of use: How access, permitted use, limits, and monitoring are addressed within the management system. 
• Monitoring and measurement: How the organization obtains visibility into AI usage, performance, and, where relevant, spend. 

Organizations seeking certification would need to demonstrate through an independent audit that their AI Management System conforms to the applicable requirements of the standard within the defined scope. 

ISO 42001 certification may be most relevant for organizations with higher AI exposure, including those: 

• Deploying AI at scale. 
• Using AI in regulated or high-risk functions such as finance, operations, or data management. 
• Relying on AI systems that can trigger consequential automated actions. 

But AI governance is relevant for any business using AI. And, more than anything, it will become increasingly relevant as clients, procurement teams, and supply chain partners start to ask for demonstrable governance. 

In our recent webinar, Gareth Parker, Head of Operational Compliance at Amtivo, explained why businesses leaders should be thinking about AI governance: 

“A lot of businesses have assumed they had [AI] under control; assumed we know where AI was in use. But there are new tools arriving daily, new AI parts of products that are already in use…and it’s spiralling out of control. It’s just getting your hands around that to truly understand and govern it before it runs away from you because you’ll be chasing your tail otherwise.” 

ISO 42001 provides a management framework that can help organizations: 

• Manage risks related to AI 
• Demonstrate responsible AI governance 
• Meet compliance obligations more effectively 
• Increase trust with customers, partners and regulators 

The US does not currently have a single federal AI law equivalent to the EU AI Act, but existing federal laws and regulators still apply to AI-related conduct and claims. 

Executive Order 14110, an AI executive order, was revoked in January 2025 and replaced by Executive Order 14179, highlighting how federal AI policy can shift over time. In practice, organizations should focus on current agency guidance, enforcement activity, and sector-specific obligations. 

The Federal Trade Commission (FTC) has taken action against deceptive AI claims and AI-enabled unfair or deceptive conduct. The Securities and Exchange Commission (SEC) has also brought enforcement actions against investment advisers for false and misleading AI claims. 

State-level requirements are also developing. Colorado has revised its AI legislation, with updated obligations scheduled to take effect on January 1, 2027. Other states, including California and Texas, are also introducing AI-related requirements, although scope, effective dates, and obligations differ significantly. 

In this environment, ISO 42001 does not replace laws or regulations. Instead, it can provide a structured, auditable approach to demonstrating governance and control. While this can help organizations meet compliance obligations more effectively, they will still be required to identify and address applicable legal, regulatory, and contractual obligations. 

It is also widely viewed as complementary to the NIST AI Risk Management Framework, particularly in its focus on accountability, transparency, and risk management.

The reported examples are useful warnings about what can happen when AI adoption outpaces governance. Organizations that address AI governance early may be better placed to demonstrate control, accountability, and assurance to clients, regulators, and supply chain partners. 

Learn more about ISO 42001 and get in touch with Amtivo.