From Shadow IT to Shadow AI

Shadow IT was a procurement problem. Employees bought software their IT department hadn't approved, and the solution was governance: approval workflows, vendor lists, centralised licensing. It was containable because the unit cost was fixed. A SaaS subscription cost what it cost.

Shadow AI is different in a way that matters to Finance. The unit cost is variable, it scales with usage, and the usage is invisible by default. Every prompt is a spend event. Every model call is a transaction that doesn't appear on a purchase order. And unlike a SaaS subscription, there is no ceiling.

What shadow AI actually looks like

It's not rogue deployments or unsanctioned tools. Most shadow AI in large enterprises is entirely legitimate — engineers using API access they're entitled to, product teams integrating AI features into roadmap items that were approved, analysts using AI tools that came bundled with software the organisation already pays for.

The shadow isn't in the authorisation. It's in the accounting. Nobody mapped it. Nobody owns the cost. Nobody can tell the CFO what the organisation is getting for what it's spending.

Why the old playbook doesn't work

The Shadow IT response — tighter procurement controls, approved vendor lists, centralised purchasing — doesn't translate cleanly to AI infrastructure. Inference spend doesn't happen at procurement time. It happens at runtime, continuously, at scale. By the time a purchase order process would catch it, the spend has already occurred.

What's needed isn't a procurement fix. It's an operational layer that sits between every AI application and every model provider, attributing spend in real time to the workflow, team, or product that generated it.

Visibility first, then control

Attribution is the precondition for everything else. You cannot govern what you cannot see. You cannot optimise spend you haven't mapped. You cannot report on efficiency you haven't measured.

cortave makes every model call visible, attributed, and accountable — without slowing down the teams that depend on AI to do their work. Shadow AI doesn't have to stay in the dark.