Shadow AI spend: the subscriptions on corporate cards nobody tracks

The AI spend a company reports is the spend it bought on purpose: the enterprise contract, the API account with the invoice. The AI spend it does not report is on employee cards. A Claude Max plan here, a ChatGPT Pro seat there, a coding assistant, a transcription tool, a research service, each a small monthly charge that an individual expensed, each approved by a manager who approved forty other things that day.

Individually these are rounding errors. Together they are frequently the second largest AI line at a company that thinks it has one, and they carry a different kind of cost than money.

Why it happens

People buy their own AI for the same reason they always bought their own software: the tool they want is not the one they were given, and the friction of asking is higher than the price.

Three specifics make AI worse than the usual shadow IT.

The personal plans are good. A Max or Pro plan gives an individual more capacity and newer models than many enterprise seats do. The person buying it is not being difficult; they are buying the better tool.

The company plan is often not there yet. Enterprise AI contracts have minimum seat counts and procurement cycles. A team of twelve that wants access today will have it on cards by the end of the week.

The tools multiply. It is not one vendor. It is the model provider, plus the coding tool, plus the meeting notes tool, plus the writing tool, each with its own monthly charge and its own card.

Why it matters beyond the money

The dollars are the least of it.

Data. A personal plan is a personal account. Whatever an employee puts into it sits under terms the company did not negotiate and cannot audit. The enterprise contract exists partly to fix that, and every personal plan is a place the fix does not reach.

Attribution. Spend on a card is spend nobody sees next to output. The rep on a Pro plan who is closing more is invisible in any analysis that reads the contract alone, and so is the one who is not.

Budgets. A team budget that covers the contract and not the cards is a budget with a hole in it exactly where the discretionary spend is.

Churn. Personal subscriptions outlive the need. Someone tries a tool, leaves it on the card, and it renews for a year.

Finding it

There are three sources, in ascending order of effort and completeness.

The card program. Ramp, Brex and their peers expose transactions with a merchant and a cardholder through an API. Match merchants against a list of known AI vendors, and every charge becomes a row: this person, this vendor, this amount, this month. This is the fastest route and it catches the recurring plans well.

Receipts. Vendors email receipts. Forward the finance inbox, or an alias employees are told to use, to something that parses them: vendor, product, amount, period, payer. This catches what the card program misses, including plans on personal cards that were reimbursed.

Asking. A one-question survey, "which AI tools do you pay for?", is embarrassing to send and informative to read. Do it once, to calibrate the other two.

Whatever the source, the output should be the same shape: one row per plan, with a vendor, a product, an amount, a billing period, a start date, and the person it belongs to when it belongs to one.

Counting it properly

A subscription is a commitment, not a usage fact. It should not be mixed into the token-level ledger as if it were a day of API calls. The right treatment is to spread each plan evenly across the days of its billing period and add that to the person's daily figure, marked as a license. A monthly plan contributes a thirtieth of its price to each day; an annual plan a three-hundred-and-sixty-fifth.

That gives the spend page one honest number per person per day, with the API figure, the seat figure and the license figure summed and each still visible on its own. It also means a person's ratio of spend to output includes their Pro plan, which is where it belongs.

Watch for the plan that stopped. A monthly charge that does not recur is a cancelled plan; end it in the ledger rather than carrying it forward.

Deciding what to do

Once it is counted, the decision is usually one of three.

Bring it under the contract. If twenty people are on personal plans from the same vendor, that is a seat count, and a contract will be cheaper per seat and better on terms. The count is the argument procurement needed.

Set a policy and keep the cards. For the long tail of specialist tools, a policy that names what is allowed and requires the company email may be enough. The point is to know, not to prohibit.

End what nobody uses. The card program will show plans with no matching usage anywhere. Those are the easy wins, and they are more common than people expect.

The wrong decision is to see the number and reach for a card block. That returns the spend to invisibility without removing the need.

The principle

Every AI dollar the company pays should be attributable to a person or a team, on the same page, in the same units, whether it arrived by invoice, by credit or by card. The contract is the part that is easy to see. The cards are the part that needs finding, and finding it is a one-time setup rather than an ongoing chore once the card program and the receipts feed a ledger directly.

Arbitir reads card charges from Ramp and Brex and receipts by email, turns each AI charge into a license row with the person attached, spreads it by day, and shows it beside API and seat spend on the same pages, so a personal plan counts in a team's budget and in a rep's ratio like any other dollar.