Your Billing Account Knows Your AI Estate Better Than Your Register Does

An AI register drifts because the only checks run against it compare documents to documents. The fix is not a better document. It is a comparison against evidence the register's authors did not write, and most institutions already own that evidence. It sits in systems that record AI use as a side effect of doing their job: the billing account, the gateway that routes model calls, the identity provider. None of them was built to govern anything. All of them are more complete than the register.

I have argued that every governance control attaches to a description of a system rather than the system itself, and that records go wrong when nobody does anything wrong. This piece is about where to look instead.

Some systems cannot help recording the truth

A register is written by people, for a purpose, after the fact. It contains what someone remembered to enter. That is its weakness, and no amount of diligence removes it, because the people entering it cannot record what they do not know about.

Other systems work differently. They record activity because recording it is how they function. Nobody asks them to, and there is no form to fill in. The evidence is a by-product of doing the job. Their records are not more honest than the register because their owners are more careful. They are more honest because nobody had to decide to make them.

That is the property the register lacks, and it is why comparing the register against these systems tells you something that a review against policy never can.

Billing is complete by construction

Start with the least glamorous one. Nobody uses a paid model without it appearing on an invoice. Every call to a commercial provider is metered, because the provider wants to be paid, and the metering happens whether or not anyone in the institution has heard of the use case behind it.

That makes the billing record complete in a way no register can be. It may be badly labeled. Costs may be pooled under a cost center that tells you nothing. But it is complete, and completeness is exactly what the register cannot promise. A register is accurate only for what it lists. A billing account lists everything that costs money.

The same holds one layer down for the corporate card. A team that buys an AI subscription on a card to get its work done does not file a register entry. It files an expense claim, because it wants the money back. The expense system ends up holding a list of AI capability the institution never declared, put there by the people least likely to think of themselves as running AI.

The gateway and the identity provider already know

The second is the gateway, wherever an institution routes model calls through a single point. A gateway sees which model was actually called, by which application, how often. It is the place where the fallback route in the earlier piece would have been visible on the day it was configured: one application, two providers, the second rising week by week.

The third is the identity provider. Every agent that acts in the institution's systems has to act as someone. It gets a service account, a token, a registered application. The identity provider holds that list, and it holds it because access does not work otherwise. An agent nobody declared still had to be issued an identity to do anything at all.

None of these three was designed for governance. Finance owns one, technology owns another, security owns the third. That is precisely why they are useful: they were written by someone other than the people who wrote the register.

What the evidence cannot see

None of the three is complete on its own, and it would be a mistake to swap one blind spot for another. Billing sees only what is paid for. A free tier, an employee's personal account, or an open model an institution runs on its own servers never reaches an invoice. The identity provider and the network logs catch part of that, because even free and self-hosted use has to log in somewhere and send traffic somewhere. Taken together the three cover far more of the estate than the register does, which is the claim this piece makes, and the only claim it needs.

What leaves no trace in any of them is a different and harder problem, one I will come back to. It is also the smaller problem in most institutions, because most AI use costs money, needs an identity, or both.

The comparison runs in two directions

Point the register at these systems and you can ask two different questions, and they find different things.

The first starts from the register. For each entry, does the evidence agree with what the entry declares? The register says one model; the gateway says two. The register says the capability is retired; the billing account says it is still being invoiced. This direction finds records that have drifted.

The second starts from the evidence. For each thing the billing account, the gateway or the identity provider shows, is there a register entry at all? This is the direction that finds capability nobody declared, and nothing else finds it. A register can be complete, consistent and fully reviewed, and still describe two thirds of the estate. Only the second direction tells you about the other third.

Most institutions that test their register at all run only the first direction, because the register is where they start. The second is where the surprises are.

The test you can run this quarter

You do not need a program for this. You need three exports and an afternoon.

Ask finance for twelve months of payments to AI providers, and the expense lines for AI subscriptions. Ask technology for the list of applications calling models through any gateway you have. Ask security for the service accounts and registered applications that hold model or agent access.

Then do one thing with each: try to match every line to an entry in your AI register. Count what matches, what matches badly, and what has no entry at all. The third count is the one to take to your board, because it is the part of your estate that every control you have was never applied to.

If the exports do not exist, or nobody can say who would produce them, that is the finding. It means the evidence your institution already pays to generate has never been pointed at the record it is supposed to support.

The position I hold

A register is only as good as the last time it was compared against something its authors did not write. The evidence for that comparison already exists in most institutions, spread across finance, technology and security, recorded because those systems cannot work without recording it.

The institutions that govern their AI estate well will not be the ones with the most detailed register. They will be the ones that stopped trusting the register on its own word and started reconciling it, the way they already reconcile everything else that matters.