Two CFO surveys published in October say the same thing from different directions: AI usage costs are running over, and most companies learn about it from the vendor bill. A bigger budget won't fix that. Deciding who may turn the meter down, and how fast, will.
Deloitte's third-quarter CFO Signals survey, published October 21, put an operational question to 200 finance chiefs at North American companies with at least $1 billion in revenue: when AI usage costs run over, how quickly does anyone stop them? Seventy-four percent said their organization typically pauses or shuts down the related usage "within several business days to several weeks." Nineteen percent act the same business day. Seven percent have it happen automatically.
Two weeks earlier, Pigment's Q3 CFO Index, drawn from 2,000 finance leaders in the US, UK, France and Germany, found 83% saying consumption-based AI costs had pushed spending above expectations, and more than a third running over by more than 25%. Pigment sells planning software, so treat that as a vendor's survey. It still lines up with Futurum's September poll of 1,636 technology buyers, in which 46.9% said AI spend was above plan.
The overrun is the less interesting finding. The lag is the one that matters. Cloud taught companies to meter infrastructure that a few hundred engineers provisioned. AI puts a meter in front of every employee, and most companies still govern it at the speed of an invoice.
Finance owns the approval. Nobody owns the meter.
Finance is hardly absent from AI. Nearly 80% of Deloitte's respondents say finance has a formal role in AI decisions: 41% are required approvers and 38% run the evaluation framework. That is governance of the decision to spend, the same muscle finance has used on software for two decades. Approve the business case, sign the contract, review the bill.
Seat licenses suited that rhythm because the cost was fixed the day the contract was signed. Metered AI isn't. The money is committed later, at runtime, every time someone runs a long prompt against a frontier model or a developer leaves a coding assistant iterating on a large repository overnight. Deloitte's respondents are candid about where they stand: 53% say their primary practice is to review AI usage costs after the fact, through vendor bills, periodic reports, dashboards or manual analysis. Only 20% use what Deloitte calls advanced AI-specific controls, such as token- or workload-level attribution, AI gateways or caching.
Futurum's numbers show what happens next. Of the organizations running over plan, 47.6% asked for more budget and 43.3% said they absorb the overrun and reconcile later. Just 17.2% paused or reduced the initiative. When the bill is the first signal, the budget is the only lever left to pull.
A default model is a price list chosen on behalf of every employee. A per-user cap is a spending limit. Most companies have never treated either as one.
The controls that matter look like configuration
The settings that actually determine AI spend look like engineering housekeeping, which is why they rarely reach a finance review. Which model does a new user get by default? Is there a ceiling per person, per tool or per workflow? Does a runaway job hit a limit, or keep running until someone happens to open a dashboard? Is anything cached?
Each of those is a spending authority in disguise. In most companies they are owned by a platform team that has never been told they carry budget weight, and checked by a finance team that sees only the total, weeks later.
The companies that have acted did it at the meter. Uber set a $1,500 monthly cap on token spending per employee for each agentic coding tool after it "blew through its AI budget earlier this year," Bloomberg reported on June 2. It's a blunt instrument, but it works at the moment of use. Xero's approach, which CFO Claire Bramley described to TechTarget in an October 12 report, is subtler. The company centralized AI decisions early in 2026, runs companywide platforms, and defaults non-engineers to less complex, cheaper models, while functional teams stay accountable for the value of what they use. Bramley, who also oversees Xero's enterprise technology group, framed it as shared ground: "I'm not of the opinion that the CFO or the CIO gets to decide on their own."
Figure 1
Control point | Usually held by | When it acts | What it can stop | What it misses |
|---|---|---|---|---|
Business case approval | Finance, with the sponsoring function | Before launch; annual or quarterly | Projects that should never start | Usage growth after launch |
Default model and routing | Platform or IT team | At provisioning | Paying frontier-model prices for routine work | Users who switch models, and tools bought outside the platform |
Runtime limits (caps, gateway budgets, rate limits) | Platform team, rarely with finance sign-off | Per request, per hour or per day | Runaway jobs and spikes before they compound | Slow, legitimate growth that stays under every cap |
Invoice and dashboard review | Finance and procurement | Monthly, after the fact | Next month's mistake | This month's |
Four places AI spend can be stopped, and who usually holds the switch. Editorial assessment of common practice, not survey data. Deloitte's Q3 2026 figures suggest most large companies rely mainly on the first and last rows.
A cap is not a strategy
The tempting response is to cap everything. That would be a mistake, and the same surveys suggest why. Pigment found confidence in AI's business value averaging 8.2 out of 10 among the very people reporting overruns. An overrun on a tool that's paying off is a forecasting error. An overrun on a tool nobody can tie to an outcome is waste. Most companies can't tell the two apart: 38% of Deloitte's CFOs cite limited timely insight into token usage and unit costs. Without attribution, a cap hits the team getting value and the team burning money equally hard.
Attribution has to come before limits. Spend you can map to a team and a workflow can be argued on its merits. Spend that arrives as one line on a vendor invoice can only be cut. Freshworks CIO Ashwin Ballal, quoted in the same TechTarget piece, had the principle right: "distributed adoption can't mean distributed accountability."
The contracts deserve a look as well. Twenty-seven percent of Deloitte's respondents say terms such as pricing, commitments or data egress limit their flexibility. Under a committed-spend deal, cutting usage saves little, because the commitment is owed either way. Know which of your AI agreements work like that before anyone tells a team to stop.
Five questions for the next AI spend review
Time to throttle. From the moment usage spikes, how many hours pass before someone with authority can slow it, and who is that person?
The default. Which model does a new user get without asking, and who chose it?
Attribution. Can last month's AI bill be split by team and by workflow, or only by vendor?
Thresholds. Which runtime limits exist today, and has finance ever signed off on the numbers in them?
Commitments. Which AI contracts carry committed spend or overage rates, and what does an unused commitment cost?
What this means for CIOs and CFOs
Track time to throttle as a control metric, the way security teams track time to contain. If the honest answer is "a few weeks," the AI budget is a guess, because the real number is being set by whoever runs the heaviest workload that month.
Give runtime settings a budget owner. The CIO's team should keep the gateway, the routing rules and the limits; that is architecture, and it belongs with them. The numbers inside those settings are spending decisions, though, and they belong in the delegation-of-authority policy next to purchase approvals. Writing them there costs almost nothing and forces a conversation most CIOs and CFOs haven't had.
Then stop treating the overrun as the story. This quarter's surveys find AI spending above plan and, in the same breath, leaders who want more of it. When 2027 budgets are set, the teams that keep their AI money will be the ones that can show, workflow by workflow, what the extra spend bought. Everyone else will be told to cut, without knowing where the money went.
Sources and notes. Deloitte, "North American CFOs cite AI cost-governance gaps in third-quarter 2026 survey," CFO Signals (October 21, 2026): 200 CFOs at North American organizations with revenue of $1 billion or more; finance roles in AI decisions (38% evaluation framework, 41% required approvers, 20% guidance only); 53% review costs retrospectively; 20% use advanced AI-specific controls; 74% / 19% / 7% response speed; barriers (40%, 38%, 36%, 27%). Pigment, Q3 2026 CFO Index, press release of October 7, 2026, and Steph Brown, FM magazine (October 21, 2026): 2,000 finance leaders in the US, UK, France and Germany, surveyed August 19 to September 21, 2026; 83% above expectations, 13% within budget; confidence in AI value 8.2/10. Futurum Research, 2H 2026 CIO & Technology Buyers Decision Maker Survey, press release of September 10, 2026: 1,636 respondents; 46.9% over plan; responses among over-plan organizations (47.6%, 43.3%, 17.2%). Natalie Lung, Bloomberg News, "Uber Caps Usage of AI Tools Like Claude Code to Manage Costs" (June 2, 2026). Mary K. Pratt, TechTarget, "AI spending shifts beyond IT, testing CIO-CFO decision rights" (October 12, 2026): Xero and Freshworks quotes and practices. The Pigment and Futurum surveys are vendor-run and their releases do not describe sampling or margins of error. Figure 1 is editorial assessment, not survey data. Journalism, not procurement or legal advice. Corrections welcome.
