£24m was approved across eighteen months against a case built on pilot volumes. Consumption was not in the case because, at pilot scale, it was rounding. By month fourteen, inference and orchestration ran at £6.1m annualised against a £1.4m forecast, split across three cost centres, none of which owned the total.

A fixed approval against a variable cost removes the re-approval point. Nothing breached a threshold, because no threshold was written in the units the spend was incurred in.

What is our AI run-rate this month, and which single person is accountable for that number?

Created in January 2026, reporting to the COO, with convening rights and no decision rights. In six months, it chaired eleven meetings and took no decision a business unit could not overturn. Asked who owned AI, four functions named the Chief AI Officer; the Chief AI Officer named the business units.

An owner without authority absorbs the question without resolving it. The appointment closed the item on the board tracker, removing the pressure that would have surfaced the gap a year earlier.

What can our AI owner decide alone, and when did they last decide it?

A discovery exercise in June returned 412 agents across four platforms. Thirty-seven had an identifiable owner. Ninety-one ran on credentials of people who had left or changed roles. Fourteen had no purpose anyone could describe.

A discovery tool bought eight months earlier had produced the list. Nobody was accountable for it, so it circulated and went unacted on until an external question forced action.

How many of our agents run on the credentials of someone who has left?

An internal survey found 58% of knowledge staff using tools outside the sanctioned list. The reason was not preference but latency: the approved assistant took a manager request, a security review, and a licence allocation, averaging six weeks. Staff used consumer tools in the interim.

This was a provisioning failure, not a culture failure. Three awareness campaigns ran; the six weeks did not shorten. The behaviour persisted, and the campaigns became evidence that staff had been told.

How long does it take an employee to get the approved tool, and how long does the alternative take?

A review of the four largest suppliers found three held platform-modification rights broad enough to swap an underlying model with no change request and no notification duty. One already had: a document-classification component became model-driven in a routine release, and the firm read about it in a release note eleven weeks later.

Third-party assessments were re-performed annually against the original service description. The service changed materially inside the cycle, and nothing was designed to notice.

Which of our tier-one contracts oblige the supplier to tell us when a model changes?

A senior claims handler built an agent that triaged the complaints queue and drafted responses. It was measurably better than the process it replaced. It also held her access: full complaints history and the ability to send externally. After four months it was, by the firm's own assessment, its best AI deployment.

It could not be switched off without service impact and could not be defended as built. That is the position to avoid: a choice between an unacceptable control gap and an unacceptable operational one, because no gate sat on her path.

If we found a valuable agent we could not defend tomorrow, what would we do with it?