How to Calculate the Hidden Costs of Ungoverned AI

Finance discovered the problem on a Thursday. Three departments had used generative AI to draft the quarterly forecast pack. Each model had been given slightly different assumptions. Marketing's version showed 18 percent growth. Product's showed 12 percent. The CFO's own assistant, working from a stale pricing sheet, landed at 14 percent. Nobody realised the models were working in parallel until the consolidated deck arrived with three conflicting growth numbers and no named owner for any of them.

The reconciliation took 14 hours. The rework — re-running each forecast against the correct baseline, documenting which version the CEO had already cited in the board pre-read, and writing the correction — took another nine. That is 23 hours on a job that should have been done once. The CFO, when asked, estimated the company had lost 127 hours that quarter to similar reconciliations. None of those hours appeared in the AI business case. They appeared in the calendar as "finance cleanup."

That is the hidden cost: not the compute, not the seat licence, but the operational drag that shows up after the demo has been praised. McKinsey's State of AI research found that 88 percent of organisations use AI in at least one function, but nearly two-thirds remain stuck in experimentation or piloting, unable to scale. The gap is not model capability. It is the absence of a framework to measure what ungoverned adoption actually costs, and the discipline to stop work that feels fast but produces rework downstream.

The following presents an operational cost framework: how to measure rework hours, exposure, and strategic drift when AI adoption moves faster than governance, and how to attribute those costs so finance can score the real ROI.

The rework cost you can measure today

Start by counting the hours spent reconciling AI outputs that should have been coordinated in the first place. Pick three jobs your organisation runs every month or quarter where more than one person uses an assistant. For each job, measure:

Time to first output. How long did each person spend with their assistant to produce the draft? Add those hours. If three people each spent 45 minutes, the total is 2.25 hours.

Time to reconcile. How long did it take to discover the outputs conflicted, identify which assumptions differed, and produce a single version the business could use? Include meetings. For the forecast example above, reconciliation was 14 hours; the correction memo was another nine.

Time to fix downstream. If the conflicting output had already travelled — into a board pack, a customer proposal, or an operational plan — how long did it take to issue the correction and brief the people who had relied on the wrong number? That is attribution cost. One pricing desk we spoke with spent six hours calling customers after a discount appeared in CRM that nobody on the commercial team had approved.

The named owner gap. If nobody can answer "who approved this number," the approval never happened. Measure how many times in the last quarter a manager was asked "which version is right" and the answer required a Slack archaeology or a meeting to reconstruct intent. Each instance is a governance void.

That table is the honest ROI denominator. If the business case showed "AI saves 3 hours per forecast," but reconciliation cost 23, the net is –20 hours. Most programmes never measure the denominator. They count the draft speed and stop before the rework arrives.

IBM's 2025 Cost of a Data Breach research is the exposure side of the same table. Among organisations that reported an AI-related breach, 97 percent lacked proper access controls. One in five incidents involved shadow AI — the personal tools outside the governance you thought you had — and those incidents were associated with roughly $670,000 in higher average breach costs. You do not need that number to justify measurement. You need one pricing line that travelled without a name, or one analyst who pasted customer PII into a personal account because the sanctioned tool could not finish the job.

Microsoft and LinkedIn's Work Trend Index found that 78 percent of AI users bring their own tools. The rework cost you measure on the sanctioned path is the lower bound. The unofficial path is also producing outputs. They just do not appear in the pilot tracker.

The exposure cost: what you pay when ungoverned AI speaks for you

Rework is a calendar problem. Exposure is a balance-sheet problem. When an AI output leaves the organisation — as a customer promise, a regulatory filing, or a price — the company owns it, whether a human reviewed it or not.

Air Canada learned this in 2024. The airline's chatbot contradicted the bereavement fare policy on the company's own website. A customer relied on the chatbot's promise. Air Canada argued the bot was a separate entity. The Civil Resolution Tribunal disagreed: "It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot."

The cost in that case was a refund and a tribunal ruling the company will cite for years. The broader cost is in every customer-facing channel where a model can draft a sentence and an employee can paste it before a second person sees the promise. Calculate that exposure as:

Channels where AI outputs can reach customers. Email templates, chat responses, pricing quotes, terms-and-conditions drafts, knowledge-base articles. List them.

For each channel, the value at risk if the output is wrong. A pricing quote might commit the company to a discount it never approved. A terms clause might waive a right the legal team would have defended. A support answer might promise a refund outside policy.

The number of outputs per month that leave without a second-approver review. If the workflow is draft-paste-send, and the sender is also the drafter, there is no second check. Count those outputs.

The cost to remediate one bad output. Customer calls, refunds, legal review, reputational work. For Air Canada, it was tribunal costs and press coverage. For a pricing desk, it might be margin lost on deals closed at the wrong rate, plus the hours spent identifying which customers received the bad quote.

One financial-services client measured this and found 340 customer-facing emails per month were being drafted by personal AI tools and sent without a compliance read. Each email carried risk. The firm could not name the risk per email — that is a coverage and underwriting question — but they could name the workflow gap. Compliance could not review what compliance could not see. The cost to fix was not "stop using AI." It was "route customer-facing drafts through a sanctioned path where compliance is on the roster before the send."

That table does not require a lawyer. It requires a manager willing to open the workflow and ask who saw the output before it left. If the answer is "the person who asked the model," the second check does not exist. AI or not, that is a control gap. Ungoverned AI makes the gap faster.

The strategic drift cost: when outputs diverge and nobody notices until the board meeting

Rework is hours. Exposure is incidents. Strategic drift is the cost of moving in three directions because each department used a different assistant on what should have been one decision.

Strategic drift appears when outputs that feed the same downstream artefact — the quarterly business review, the annual plan, the pricing strategy — are produced independently, with different assumptions, and nobody discovers the divergence until the artefacts are already in circulation.

The forecast reconciliation at the start of this essay is one example. Here are three others observed in mid-market and enterprise clients:

Product roadmap commitments. Product used an AI assistant to draft feature priorities based on one set of customer interviews. Sales used a different assistant to draft a capabilities deck based on a different customer set. Both were working from memory of what "the customer wants," not from a shared job with a shared brief. The two outputs conflicted on which features were committed for Q3. The conflict surfaced in a customer call when an account executive promised a feature the product team had not scoped. Reconciliation required a three-way meeting, a revised roadmap, and customer expectation management. Total measurable cost: 11 hours, plus relationship risk that is harder to quantify.

Pricing strategy incoherence. Commercial operations drafted a new pricing model using one assistant. Finance ran margin scenarios using another. Neither saw the other's assumptions. When the pricing model launched, the margin targets were unmet because finance had modelled a 15 percent uplift that commercial had not included in customer quotes. The fix required re-running both models, re-aligning on a single set of assumptions, and issuing revised guidance to regional sales teams. Total measurable cost: 34 hours, plus margin shortfall in the first month.

Compliance policy divergence. Legal updated a data-retention policy and used an AI assistant to draft the internal guidance. HR updated the employee handbook using a different assistant and a stale version of the policy. The handbook contradicted the guidance. An auditor noticed. The company had to issue a correction, re-train staff, and provide the auditor with evidence that the live policy was the correct one. Total measurable cost: 19 hours, plus audit friction.

None of those incidents involved a bad model. They involved a workflow where the model was helping individuals move faster on tasks that should have been coordinated at the start. The cost is not compute. It is the meeting, the correction, and the downstream confusion when three people thought they were working on the same strategy but were actually drafting three versions of it.

McKinsey's research found that nearly two-thirds of organisations implementing AI are still in experimentation or piloting, unable to scale. This is why. Pilots that produce speed at the individual level without coordination at the job level create the illusion of progress while operational drag accumulates in calendars labelled "alignment," "reconciliation," and "cleanup."

How to attribute cost so finance can score the real ROI

The hidden costs are not hidden because they are hard to measure. They are hidden because most programmes never try to measure them. The AI business case counts draft speed — "this assistant saved 45 minutes per forecast" — and stops before the rework, exposure, and strategic drift show up in other people's calendars.

To attribute cost properly, track these four numbers every month for the first quarter after an AI pilot goes live:

1. Rework hours attributable to ungoverned AI outputs. Include reconciliation meetings, corrections, and downstream fixes. Tag them explicitly in calendars and ticket systems so they can be separated from other coordination work. One operations leader we worked with created a Slack channel called #ai-rework where managers posted reconciliation time. The channel had 47 posts in its first month. That is 47 measurable cost events the original business case never included.

2. Outputs that left the organisation without a second approver. Count customer-facing emails, quotes, terms, and commitments drafted by AI and sent without review. For each channel, estimate the value at risk if one output is wrong. Even if no incident has occurred yet, the exposure exists. Finance can model it the same way they model other operational risks.

3. Strategic drift incidents per quarter. Count the number of times in the last 90 days that two departments discovered they had produced conflicting outputs on what should have been a coordinated decision. Include the hours spent reconciling, the downstream confusion, and any revenue or margin impact. The product-roadmap and pricing-margin examples earlier in this essay are templates. Your version will have different nouns but the same structure: two assistants, different assumptions, one downstream mess.

4. Shadow AI tool usage. List every tool employees are using that IT has not sanctioned. Ask managers to ask their teams, anonymously if needed. Do not punish disclosure. The goal is visibility. Microsoft and LinkedIn's research found that 78 percent of AI users bring their own tools. If your sanctioned-tool adoption tracker shows 50 seats and you discover 180 people are using personal accounts, the governance perimeter you thought you had is an illusion.

When you show finance those four rows, they can score the real ROI. A pilot that saves 12 hours per month at the individual level but costs 42 hours per month in rework at the organisational level is a net-negative programme. It feels fast because the people doing the drafting are not the people doing the cleanup. Finance's job is to count both sides. Give them the data to do it.

What to do this quarter: measure first, then govern

Most governance programmes fail because they start with the policy and end with the measurement. Reverse that. Measure the cost for one month, show finance the numbers, then write the policy that closes the three biggest gaps.

Month one: install the measurement

Pick three jobs that involve AI and that cross more than one person or department. For each job, start tracking:

• Rework hours. Ask the people who reconcile, correct, or fix AI outputs to tag that time explicitly. A Slack channel, a calendar code, or a ticket tag. The goal is visibility, not punishment.
• Outputs without second check. For one channel where AI drafts customer-facing content, count how many outputs leave per week without a second human seeing them. Do not change the workflow yet. Just count.
• Shadow AI tools. Ask three managers to ask their teams (anonymously if needed): which AI tools are you using that IT did not provide? List the tools and the use cases. Do not ban them. Learn why the sanctioned path is not meeting the need.

By the end of month one, you will have three numbers finance can work with: rework hours for three jobs, exposure on one channel, and the real usage footprint. That is the denominator the business case omitted.

Month two: close the three biggest gaps

Rework hours are calendar evidence. If one job produced 19 hours of reconciliation last month, that job needs coordination, not just speed. The fix is not "stop using AI." The fix is "make this a shared job with a shared brief so two people do not draft conflicting versions in parallel." See what is collaborative AI and what is an AI workstream for the operational pattern.

Outputs without a second check are a control gap. If 47 pricing quotes per month go out without compliance eyes, route the draft through a sanctioned workflow where compliance is on the roster before the send. If the workflow does not exist, that is the project. See what is write-back governance for the approval model.

Shadow AI exists because the sanctioned path is too slow, too restrictive, or missing a capability people need. Do not ban the unofficial tools until you have built a sanctioned alternative that can finish the same jobs. Otherwise you move the work to phones and lose visibility entirely. IBM's research found that organisations with high shadow-AI use faced roughly $670,000 in higher breach costs. The answer is a usable sanctioned path, not a memo.

Month three: report the net ROI

By month three, you will have one month of baseline cost (month one) and one month of governed cost (month two). Show finance both. A pilot that saved 12 hours in draft speed but cost 64 hours in rework is a programme that should be narrowed or stopped. A job where coordination reduced rework from 19 hours to 4 hours is a programme that should be promoted. Finance cannot make that call if you only report the draft speed. Give them the full table.

A call to CFOs and COOs: demand the denominator

The AI business case finance reviewed last quarter probably showed savings. Draft speed, research time, summarisation hours. Those numbers are real. They are also incomplete.

The denominator — rework, exposure, strategic drift — is where the cost hides. It hides because it shows up in other people's calendars. The analyst who drafted the forecast in 45 minutes does not see the 14 hours the CFO's team spent reconciling three conflicting forecasts. The sales rep who used a personal AI to draft a quote does not see the six hours pricing operations spent fixing quotes that never cleared compliance. The product manager who used an assistant to draft roadmap priorities does not attend the meeting where sales and product discover they committed different features to the same customer.

Finance's job is to see both sides. Demand the measurement framework in this essay before approving the next pilot. Four numbers per month for three months:

1. Rework hours — tagged, counted, attributed to AI coordination gaps
2. Outputs without second approver — by channel, with value at risk modelled
3. Strategic drift incidents — counted, with reconciliation hours measured
4. Shadow AI usage — real footprint vs sanctioned seats

A pilot that saves 12 hours per month but costs 42 hours per month in rework is a pilot finance should stop or narrow. A job where coordination cuts rework from 19 hours to 4 hours is a job finance should fund. You cannot make that call if the business case only reports the numerator.

McKinsey's research found that 88 percent of organisations use AI, but nearly two-thirds are stuck in experimentation, unable to scale. The gap is not model capability. It is the absence of a cost framework that counts what happens after the draft is done. Programmes that measure speed without measuring coordination are programmes that scale chaos, not capability.

How Nimbus measures and governs the work

Nimbus is a Collaborative AI operating system built around the framework in this essay. Work lives on workstreams — shared jobs with a brief, a roster, and connectors — so two people drafting the same artefact see the same context and produce one output, not two conflicting versions.

Connectors default to read-only. Writes require a named approver. Write-back governance is the checklist: who can sign, what they see before they sign, and where the signed record lives.

Decision History logs actor, tier, and timestamp for every approval, refusal, and output. It is not the statutory ledger. It is how you walk one decision — who approved this pricing change, which connectors were in scope, which version of the policy was active — without reconstructing a chat.

Hugh Woods Ballard at Day Webster wanted specialists and humans coordinating in one room, with visibility into who approved what. Andy at Digby Fine English wanted to keep humans in the loop before anything commits. That is governance as a daily habit, not a policy PDF. It starts with measurement: rework hours, outputs without a second check, strategic drift incidents. Then it moves to coordination: one job, one brief, one output. See what is collaborative AI for the operational pattern.

Get started for free. Talk to sales. Or read RBAC for enterprise AI and what auditors are asking for for the evidence pack finance and compliance will need when they ask how you govern AI work.

References

• McKinsey, The State of AI: Global Survey 2025
• Microsoft and LinkedIn, 2024 Work Trend Index
• IBM newsroom, Cost of a Data Breach findings on AI, 30 July 2025
• CBC News, Air Canada found liable for chatbot's bad advice
• Civil Resolution Tribunal, Moffatt v. Air Canada, 2024 BCCRT 149