The money went out. Nobody counted what came back.

Four thousand years ago in southern Mesopotamia, someone counted the grain. Scribes in the cities of Ur kept receipts for single animals and daily rations, pressed into clay, sealed, filed. Tens of thousands of those tablets survive. We inherited them. We did not inherit the habit.

In Zylo's 2026 index, built on more than 40 million software licenses and US$75 billion of managed spend, organizations spent an average of US$1.2 million a year on AI-native applications, up 108 per cent in twelve months. Of 218 IT leaders surveyed, 78 per cent had encountered unexpected charges tied to AI or consumption-based pricing.[1] That dataset skews to large software portfolios. The direction of travel does not depend on company size. The spending is documented to the cent. The return, in most places, has never been written down at all.

Three numbers describe where this landed.
MIT's Project NANDA reviewed more than 300 publicly disclosed AI initiatives, interviewed representatives of 52 organizations and surveyed 153 senior leaders. Its preliminary report concluded that 95 per cent of organizations were seeing no measurable return from generative AI investment, and that 5 per cent of integrated pilots were extracting substantial value.[2]
The report is preliminary, was never peer reviewed, describes some of its own figures as directional, and the 95 has been stretched by people quoting it. Treat it as an indicator rather than a finding. The indicator points one way.

S&P Global Market Intelligence surveyed more than 1,000 enterprise respondents across North America and Europe. The share abandoning most of their AI initiatives went from 17 per cent to 42 per cent in a single year, and the average organization scrapped 46 per cent of its proofs of concept before production.[3]

Microsoft reported more than 30 million paid Copilot seats for the quarter ended 30 June, up from more than 20 million three months earlier.[4] Look at the other end of the same product. In June 2025, Gartner surveyed 187 IT and customer service leaders: among organizations that had completed a Copilot pilot, 5 per cent had moved to a larger deployment.[5] That figure is small-sample and more than a year old, and nobody has published a 2026 equivalent. Seats are being bought at speed. What happens to a pilot after it finishes is measured by almost nobody.

None of this is misconduct. It is what happens when adoption outruns measurement, and it happened at a speed nobody in the finance function was asked to keep up with.

The Australian layer
In September 2024 the government proposed ten mandatory guardrails for high-risk AI. In December 2025 it said it would not proceed with them at this time, and published a National AI Plan that relies on existing technology-neutral law instead.[6]

Read quickly, that sounds like relief. What it does is leave AI to be governed by the law already on the books: privacy, consumer, corporations, discrimination, workplace, sector rules. For a board, that lands on the duty of care and diligence it already holds, and ASIC has said directors are expected to understand technological developments and the risks that come with them.[7] No new obligation arrived. The existing one now has more to cover.

There is still a date. From 10 December 2026, entities covered by the Privacy Act must disclose in their privacy policy where a computer program uses personal information to make, or to do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests. That is APP 1.7, and it applies to decisions made from that date regardless of when the underlying system was built.[8]

Writing that disclosure requires knowing which systems in the organization make decisions about people. In practice, that means somebody has to go and find them.

A survey by the Diligent Institute with the Governance Institute of Australia found that 37 per cent of Australian boards had audited their organization's current AI usage. Thirteen per cent had appointed directors with AI expertise.[9] Sixty-three per cent, in a country with a hard disclosure date in December, have not looked.

The arrangement
Ask who could answer the question. The integrator who built it. The vendor who licensed it. The consultancy that wrote the strategy deck. Each of them is paid more when the answer is yes.

This is not corruption. It is an arrangement, and every industry eventually builds one. Restaurants do not grade their own hygiene. Companies do not audit their own accounts. Somewhere between 2023 and now, an entire category of spending got exempted from that principle because it was new and moved fast and nobody wanted to be the person slowing it down.

The exemption is expiring. Not because of a regulator. Because the first real budget review of the 2023 to 2025 pilot wave is arriving, and it is arriving in front of people who ask what things cost.

What I got wrong
I spent eighteen months telling other people to be clear about what they sell while running a website that offered five different things to three different audiences. Board sessions, proofs, builds, due diligence, an AI search product. Every one of them priced, published, defensible in isolation. Three engagements in that time, all small. Three sounds respectable until you divide it by eighteen, which my wife did, out loud, in a kitchen with not much in it.

I did not find the fault by measuring. My father found it, inside a minute. He is in his late seventies, he still runs a practice teaching commercialization, and he looked at the page and asked which of these he was supposed to want. Forty years of osmosis, and I failed the entry test he gives to strangers. I rebuilt it. Two offers now.

The thing worth taking from that is not that I fixed it. It is that I had the data the whole time. Eighteen months, three small engagements, an analytics dashboard I looked at weekly. Measurement loses to the calendar in everyone, including in people who sell measurement for a living.

What an audit actually is
Every AI contract, license and system in one register, built from the documents rather than from what people remember buying. Then three columns and one decision per line: keep, fix, or kill. Each line carrying its dollar figure, the evidence behind it, and the action that turns the decision into money.

No new technology. No transformation. Bookkeeping, done by someone with no stake in the answer. A scribe in Ur would recognize the whole procedure, and would probably want to know why it took us this long.

The spending has a number. The return will get one eventually. The only open question is whether it is calculated by the organization, or by whoever reads its privacy policy in December.

Lumen & Lever runs an independent AI audit called The AI Verdict: fifteen working days, fixed fee, keep, fix or kill on every AI line with evidence cited to page and clause, and a two-page paper written to be read by a board. We take no vendor commissions and we do not sell the fixes we find. If the ledger does not identify at least twice the fee in recoverable cost and priced exposure, the fee is refunded in full. Details and the fee are on the site, lumenandlever.com.

Disclosure: I sell the thing this article says is missing. Lumen & Lever runs an independent AI audit called The AI Verdict: fifteen working days, fixed fee, keep, fix or kill on every AI line with evidence cited to page and clause, and a two-page paper written to be read by a board. We take no vendor commissions and we do not sell the fixes we find. If the ledger does not identify at least twice the fee in recoverable cost and priced exposure, the fee is refunded in full. Details and the fee are at lumenandlever.com.

Sources
1. Zylo, 2026 SaaS Management Index, January 2026. Built on analysis of more than 40 million SaaS licenses and US$75 billion in spend under management. Average annual spend on AI-native applications of US$1.2 million, up 108 per cent year over year. Of 218 IT leaders surveyed, 78 per cent had encountered unexpected charges tied to AI or consumption-based pricing. Dataset skews to large software portfolios, with average total SaaS spend of US$55.7 million. zylo.com/2026-saas-management-index
2. MIT Project NANDA, The GenAI Divide: State of AI in Business 2025, July 2025. Based on review of more than 300 publicly disclosed AI initiatives, interviews with representatives of 52 organizations and survey responses from 153 senior leaders. Preliminary findings, not peer reviewed, and the report describes some of its deployment figures as directionally accurate rather than drawn from official company reporting. The widely quoted 95 per cent figure compresses several distinct claims made in the report.
3. S&P Global Market Intelligence, Voice of the Enterprise: AI & Machine Learning, 2025. Survey of more than 1,000 respondents across North America and Europe. Reported by CIO Dive, March 2025.
4. Microsoft, FY26 Q4 earnings press release and earnings call, 29 July 2026, covering the quarter ended 30 June 2026. More than 30 million paid Microsoft 365 Copilot seats, up from more than 20 million reported for Q3 FY26. microsoft.com/en-us/investor/earnings/fy-2026-q4
5. Gartner, 2025 Microsoft 365 and Copilot Survey, published 2 June 2025. Survey of 187 IT and customer service leaders. Of organizations that had completed a Copilot pilot, 5 per cent reported moving to a larger-scale deployment. Gartner's public abstract does not expose the underlying figures, which are consistently reported by secondary sources. Small sample, more than a year old, and not a current conversion rate.
6. National AI Plan, released 2 December 2025, following the Productivity Commission's August 2025 recommendation to pause work on economy-wide AI regulation. The ten mandatory guardrails proposed in September 2024 were not proceeded with at that time. Reported by ABC News, 2 December 2025.
7. ASIC guidance on directors' obligations regarding technological developments and emerging risks, read alongside the duty of care and diligence under section 180 of the Corporations Act 2001 (Cth). asic.gov.au
8. Privacy and Other Legislation Amendment Act 2024 (Cth), inserting APP 1.7 to 1.9 into Schedule 1 of the Privacy Act 1988 (Cth), commencing 10 December 2026. Applies to decisions made on or after that date irrespective of when the underlying arrangement began. See OAIC, APP Guidelines, Chapter 1. oaic.gov.au
9. Diligent Institute, with the Governance Institute of Australia and the Singapore Institute of Directors, APAC Governance Outlook 2026, November 2025. Thirty-seven per cent of Australian boards had audited current AI usage; 13 per cent had appointed directors with AI expertise; 61 per cent had restricted or defined employee AI use.