To many enterprises, AI costs – from compute to tokens, licenses, integration, and data – are now a familiar part of company expenditures, as we approach four years since OpenAI released ChatGPT, kickstarting the explosion of generative AI.

Just below the surface, however, is a less visible layer of costs: approvals, testing, audit trails, human review, and documentation all take time and resources, while weak or late governance can lead to rework, additional tooling, and delays to production.

The rise of capable AI models and, in recent times, AI agents that can carry out increasingly complex tasks with less human intervention means that, as pilots move into production, AI governance is now an extra workload spanning IT, security, legal, risk, and data teams.

AI governance is not the highest cost for companies – tokens and licenses are likely to rank higher – but it is an increasingly important part of AI’s total cost of ownership (TCO), and is naturally spread across a variety of teams and processes.

To make sense of the hidden costs associated with the latest AI wave, spoke to Enza Iannopollo, VP and principal analyst at Forrester, and David Menninger, executive director of software research and distinguished analyst at ISG.

The two analysts share a similar argument: governance is necessary, but the actual costs can vary significantly depending on how and when it is introduced. Controls that are added too late can mean months of additional work, while manual governance can itself become a bottleneck.

How governance gets expensive

As is so often the case in both life and in business, foresight is key, and many of the biggest AI governance costs – monetary, staff time, and otherwise – stem from adding controls too late in the process.

“Unfortunately, in many enterprises, the biggest cost has been retrofitting governance into AI deployments,” says ISG’s Menninger.

“When AI governance is not built into the project from the start, it can add months to the project rollout.”

“Our research of 1,200 AI use cases shows that about one third have made it into production,” Menninger continues. “The good news is that’s double what it was a year ago. The bad news is that two-thirds are still not in production.”

That gap between experimentation and production is where hidden costs can start to pile up.

“The same study indicates that, on average, it will cost twice as much as has been spent already and will take more than a year to complete,” he says.

“These figures suggest that much [of the] cost is not anticipated and that enterprises are learning as they go.”

Governance is only one part of that extra spend, but retrofitting it after the fact adds another speed bump just as companies are trying to move beyond the pilot stage.

Forrester’s Iannopollo argues that the answer is not so much to govern less, but to govern earlier: “Failing to scale an AI pilot is one of the most common costs organizations pay for not building the right governance from the start.”

“Relying on solid AI governance from the start means ensuring the appropriate controls and guardrails are in place,” she says.

“Pilots are the right moment to test them, adjust them, and prepare them to enable scale.”

Having a “human-in-the-loop” comes at a price

AI-driven automation is perhaps the hot trend in 2026, with companies increasingly experimenting with ‘swarms’ of powerful AI agents able to carry out work that until recently would have required human input – but people are still heavily involved in checking the eventual outputs.

In other words, automation does not necessarily remove labour; in many cases, it simply shifts where that labour sits.

“ISG Market Lens research indicates that 90% of AI-enabled work still involves humans, either with AI providing assistance or with humans reviewing and approving the outputs,” says Menninger. The bill for supporting all this human oversight naturally lands on people and the manual processes they perform.

The irony is that AI is often best at automating the most mundane tasks, leaving the hardest work for humans. “The manual review process is typically only needed for the most complex scenarios, so it’s no surprise that those would take more time and effort,” he says.

In effect, the easier work can disappear while the expensive judgement calls remain.

“Human review thresholds seem to be one of the most successful techniques for managing cost and risk,” says Menninger.

“It enables enterprises to focus their resources on the areas with the most exposure.”

The aim, then, is to concentrate their attention where the potential consequences are greatest, not to remove humans from oversight entirely.

“As AI-enabled processes become more accurate and more refined, the percentage of AI-related decisions requiring review will decrease, but our research suggests it will take time. By year-end 2027, only 13% of AI-enabled work will be fully autonomous.”

Iannopollo likewise says human oversight must be targeted: “Humans must focus on reviewing and approving high-risk use-cases, responding timely in situations where AI performance and/or behavior drift, and acting with full authority to ensure the business keeps running, even if they have to ‘kill’ an LLM, an agent, or an entire agentic workflow.”

Manual governance can be a bottleneck

Operating at a small scale, ideas like central boards or manual checks can work well; the problems emerge when companies try to scale them across the organisation. A model that works for, say, ten AI projects can quickly break at 100.

“AI governance that relies only on manual checks and processes becomes a bottleneck,” says Iannopollo.

“Governing AI requires [the] implementation of technical controls, automation, and careful distribution of human-led activities.”

It’s at this point that AI governance moves beyond policy documents and (human) committees and becomes something operational and technical – embedded in the systems used to manage approvals, enforce data and access controls, maintain auditability, and monitor AI in production.

“Our research suggests that enterprises need to supplement the governance provided by AI software platforms and tools,” says Menninger

“For example, only one-third of more than two dozen vendors evaluated fully met our criteria for agent evaluation tools. Less than one-fifth met our criteria for A/B testing and less than half met our criteria for human-in-the-loop reviews.”

“As a result, we recommend that enterprises anticipate they will need to incorporate additional tools and processes to complete their governance over AI,” he says.

Dedicated governance tooling is already becoming a sizable market in its own right: Gartner forecasts spending on AI governance platforms will rise from $275 million in 2026 to $462 million in 2027.

“The other common misunderstanding is that governance always means a lot of processes, controls, and documentation,” says Iannopollo.

“This is certainly true for some use-cases, but not for most. Assessing risks of AI use-cases early means that the measures can be implemented in a proportionate manner.”

“Starting from low-risk use cases increases the likelihood of success, further strengthening the confidence of the organization in AI,” she says.

The scalable option, then, is a risk-tiered governance model that uses automation to reduce the routine burden while concentrating human oversight and heavier controls on higher-risk use cases.

Governance should be an enabler

The costs of AI governance – labour, delayed rollouts, more tooling, oversight – are now clear; the answer for companies is not to minimise governance at all costs.

“Too often [organizations] embrace the rhetoric about governance as a road blocker and an inhibitor of innovation,” says Iannopollo.

“The truth is that in most cases lack of governance is the road blocker.”

Just as companies price in the costs of compute, data, integration, licenses, and so on, governance should be priced into AI projects from the outset.

Making governance proportionate and repeatable is the key, and the later companies leave it in the process, the greater the risk of costly rework and delays. A repeatable, scalable governance model is the dream – one that can grow with AI adoption without requiring the same increase in manual oversight.