Assessment · Governance · Run continuously

20Evidence, audit and executive reporting

Can we prove control to auditors, regulators and the board?

A tamper-evident evidence journal, audit packs and board reporting from the same data.

AutomatedStakeholder interviewsUses your existing assessments 7 controls 3 engines

How we collect

  • AutomatedEvery finding, decision and policy change written to a hash-chained evidence journalRuns today
  • Stakeholder interviewsClient decisions recorded with name, date and their own wordsRuns today
  • Uses your existing assessmentsPrior audits and certifications as evidence filesNeeds your export or setup

Status labels show what runs today, what needs an export or setup from you, and what is planned.

What you get

  • One-page report: found, means, recommend, unknown, decisions needed
  • Audit and attestation packs, EU AI Act Annex IV skeleton
  • Quarterly review with value reported in four separate columns

Questions we ask

  • Who signs off the quarterly review?

We can start from

Audit reports, ISO 42001 or SOC 2 evidence

Example output

Scorecard by area

AICost-GovControl903
AreaScoreMain gap
Inventory and ownership1 to 5Owners missing on shadow AI
Data and access1 to 5Sites shared organization-wide
Agents1 to 5No stop switch test
Cost1 to 5No caps on agent workloads
Evidence1 to 5Approvals not recorded

Control maturity

AICost-GovControl903
ControlNowTargetEvidenceGapOwnerDue
AICost-GovControl101 AI inventory24Collector run logs, inventory exportNo monthly refreshITQ1
AICost-GovControl402 Agent limits14Gateway configNo stop switch testPlatformQ1
AICost-GovControl603 Bias testing13NoneNo tests on hiring screenHRQ2

Data sources

SourceWhat we readStatus
AI gateway telemetryLiteLLM, Cloudflare AI Gateway or AICost CostWall logs: cost per team, workload, agent and outcome.Partly automated
QuestionnaireThe short interview for what data cannot show: purpose, owners, decisions AI informs, regulations in scope.Runs today
Microsoft Graph and Entra IDService principals, OAuth grants, app registrations, sign-ins to AI apps, Copilot usage reports. Read-only scopes, metadata only.Runs today
Invoices, card and AP exportsAI vendors found on statements and invoices, including ones never approved. Spend is exact because it is on the statement.Partly automated
Defender for Cloud AppsThe discovered Generative AI apps export: which AI sites people use, how often, and Microsoft risk scores.Partly automated

Built on governance engine modules

P9 LiveRegulation, Audit & Compliance

Which obligations apply to you, dated and watched?

Assess & Govern
P20 PlannedMSP Scale & Control Plane

Can you run this for 40 clients without 40 portals?

MSP Managed

AICost governance controls in this module

AICost-GovControl803Runs today
Audit trail and evidence journal
What it is

A tamper-evident record of inventories, assessments, approvals, policy changes, exceptions and remediation.

Why it is needed

A policy without evidence of operation gives little assurance.

Why enterprises need it

Auditors, regulators and litigants ask for proof. Collecting it later is slow and incomplete.

What you get:Audit requests answered quicklyEvery decision traceableLess evidence chasing
Run by
Governance Report and QBR engineEvidence Journal engineAssurance Library engine
Data
AI gateway telemetry, Questionnaire
Evidence produced
Evidence index: item, control, date, source, owner, link.
Maps to
ISO/IEC 42001: documented information; EU AI Act: record keeping; NIST AI RMF: Govern
AICost-GovControl804Partly automated
Compliance audit of an AI system
What it is

A structured audit of one AI system against its required controls, with findings that name the owner and the fix.

Why it is needed

Program-level reviews miss system-level gaps.

Why enterprises need it

High-risk systems need periodic audits with clear remediation work.

What you get:Specific findings, not general adviceOwners and due dates setRetest on closure
Run by
Governance Report and QBR engineShared Responsibility Register
Data
Questionnaire, AI gateway telemetry, Microsoft Graph and Entra ID
Evidence produced
Audit report: control, expected, observed, finding, severity, owner, due date.
Maps to
ISO/IEC 42001: internal audit; NIST AI RMF: Measure
AICost-GovControl902Partly automated
Board and executive reporting
What it is

A regular report to the board with AI inventory, risk, spend, incidents and value, and thresholds for urgent notice.

Why it is needed

Boards are accountable for AI risk and spend but rarely see either in one place.

Why enterprises need it

Directors need enough context to ask good questions, and investors and regulators ask how the board oversees AI.

What you get:Board sees risk and spend togetherUrgent issues escalated on a ruleDisclosures backed by evidence
Run by
Governance Report and QBR engineAnnual Forecast engine
Data
AI gateway telemetry, Invoices, card and AP exports, Questionnaire
Evidence produced
Board pack: inventory change, top risks, spend and forecast, incidents, value delivered, decisions needed.
Maps to
NIST AI RMF: Govern; ISO/IEC 42001: management review
AICost-GovControl903Partly automated
Program maturity and program audit
What it is

Scoring the governance program itself across all controls, from initial to optimized, with an evidence-backed rating and a plan.

Why it is needed

Without a maturity view, programs grow paperwork instead of control.

Why enterprises need it

Internal audit, buyers and investors ask how mature the program is and what evidence supports it.

What you get:Maturity rated on evidenceA sequenced improvement planClear build or buy choices
Run by
Governance Assessment wizardGovernance Report and QBR engineEU AI Act Quick Check engine
Data
Questionnaire
Evidence produced
Maturity scorecard: control, current level, target, evidence, gap, owner, due date.
Maps to
ISO/IEC 42001: performance evaluation; NIST AI RMF: Govern
AICost-GovControl901Runs today
Acceptable use and staff training
What it is

Plain rules on approved tools, what data may be typed in, what must never be, and training with completion records.

Why it is needed

Most AI risk starts with a well-meaning employee pasting the wrong thing into the wrong tool.

Why enterprises need it

The EU AI Act expects staff AI literacy, and customers ask for the policy in security reviews.

What you get:Clear rules people followTraining completion recordedFewer data leaks through prompts
Run by
Policy Drafting engineAI Adoption and Enablement engine
Data
Defender for Cloud Apps, Microsoft Graph and Entra ID, Questionnaire
Evidence produced
Policy pack: approved tools list, data rules, training completion by team, exceptions.
Maps to
EU AI Act: AI literacy (Article 4); ISO/IEC 42001: competence and awareness
AICost-GovControl905Partly automated
Governance for small and mid-size teams
What it is

A starter set of controls for companies without a governance team: inventory, rules, spend caps, vendor settings and one owner.

Why it is needed

Small teams use the same AI tools as large ones, with fewer people to watch them.

Why enterprises need it

A proportionate program protects data and budget without slowing a small team down.

What you get:Essential protections in weeksSpend capped from day oneRoom to grow into a full program
Run by
Policy Drafting engineEU AI Act Quick Check engineShadow AI Finder engineCost Firewall engine
Data
Microsoft Graph and Entra ID, Invoices, card and AP exports, Questionnaire
Evidence produced
Starter checklist: control, done, owner, next step.
Maps to
NIST AI RMF (scaled); ISO/IEC 42001 (scaled)
AICost-GovControl204Runs today
Cost of compliance in the AI budget
What it is

The running cost of required controls, such as human review, safety screening, logging and evaluations, priced into each AI use.

Why it is needed

Compliance work is real spend. Leaving it out makes AI look cheaper than it is and breaks the business case later.

Why enterprises need it

Finance and product need the full cost per outcome, including review time, before they commit to scale.

What you get:Honest business casesNo surprise review costs at scaleControls planned, not bolted on
Run by
AI Cost Governance and FinOps engineCompliance Cost engineHuman Review engineSafety Screening engineTracing Cost engine
Data
AI gateway telemetry, Questionnaire
Evidence produced
Cost table: control, unit cost, volume, monthly cost, share of workload cost.
Maps to
NIST AI RMF: Manage; FinOps for AI

Frameworks

ISO/IEC 42001AI management system: policy, roles, risk treatment, suppliers, monitoring, internal audit, improvement
EU AI ActCategory and role per system, prohibited uses, high-risk duties, transparency, AI literacy, incident reporting

Stakeholders

Internal auditBoardCompliance
← 19. Continuous monitoring and incidents All modules
📖 Data sources & methodology 172 text models · 9 embeddings · 44 vision · 62 audio · 8 vector DBs across 10 vendor pages · last verified 2026-10-18

Methodology

  • All prices are USD per 1 million tokens, current as of 2026-10-18.
  • Vendor-published values have no mark. Inferred/extrapolated values are marked with * and listed below.
  • Batch API discounts are 50% off standard rates across providers that offer Batch mode.
  • Prompt caching discounts vary by provider (typically 80-90% off cached input tokens).
  • Regional data-residency surcharges (Anthropic 1.1x, OpenAI 1.1x, Google regional tiers) are NOT included in base rates.
  • Long-context pricing tiers apply when input exceeds model threshold.
  • Embedding prices are input-only (no output tokens generated).

Primary sources

Last-verified date is the most recent successful daily snapshot (aicost_pricing_snapshots) or, when no snapshot exists yet, the latest successful crawler run (aicost_crawler_runs). 10 of 10 vendors are currently verified. Aggregator services (TokenCost, AI Pricing Guru, etc.) are not listed.

Anthropic
2026-10-18
https://www.anthropic.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Anthropic Docs
2026-10-18
https://platform.claude.com/docs/en/about-claude/pricing
Daily snapshot since Sep 2023 · 704 days captured
OpenAI
2026-10-18
https://openai.com/api/pricing/
Daily snapshot since Sep 2023 · 705 days captured
Google AI
2026-10-18
https://ai.google.dev/gemini-api/docs/pricing
Daily snapshot since Dec 2023 · 680 days captured
Google Vertex
2026-10-18
https://cloud.google.com/vertex-ai/generative-ai/pricing
Daily snapshot since Dec 2023 · 680 days captured
DeepSeek
2026-10-18
https://api-docs.deepseek.com/quick_start/pricing
Daily snapshot since May 2024 · 619 days captured
xAI
2026-10-18
https://x.ai/api
Daily snapshot since Nov 2024 · 537 days captured
Mistral
2026-10-18
https://mistral.ai/pricing
Daily snapshot since Dec 2023 · 678 days captured
Cohere
2026-10-18
https://cohere.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Voyage AI
2026-10-18
https://docs.voyageai.com/docs/pricing

Inferred values (marked with * in calculator tables)

Derived from industry conventions, not directly published by the vendor. Typical conventions: cached input = 10% of base (90% off), Batch API = 50% of base (50% off).

Vendor / Model Field Why it’s inferred
Anthropic — Claude Sonnet 4.6 cachedInput Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.
Anthropic — Claude Sonnet 4.5 cachedInput Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.
Anthropic — Claude Sonnet 4.5 batchInput Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Sonnet 4.5 batchOutput Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Haiku 4.5 cachedInput Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.
OpenAI — GPT-5.4 Mini cachedInput Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.
OpenAI — GPT-5.4 Nano cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Nano batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Nano batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Pro batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.2 cachedInput Derived at 10% of input; no residency uplift.
OpenAI — GPT-5.2 batchInput Derived at 50% of input.
OpenAI — GPT-5.2 batchOutput Derived at 50% of output.
OpenAI — GPT-5 cachedInput Derived at 10% of input.
OpenAI — GPT-5 batchInput Derived at 50% of input.
OpenAI — GPT-5 batchOutput Derived at 50% of output.
OpenAI — GPT-5.5 Pro cachedInput Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.
OpenAI — GPT-5.5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.2 Pro cachedInput Derived at 10% of input — pro-tier convention.
OpenAI — GPT-5.2 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.2 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.1 batchInput Derived at 50% of input.
OpenAI — GPT-5.1 batchOutput Derived at 50% of output.
OpenAI — GPT-5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5 Nano cachedInput Derived at 10% of input.
OpenAI — GPT-5 Nano batchInput Derived at 50% of input.
OpenAI — GPT-5 Nano batchOutput Derived at 50% of output.
Google — Gemini 3 Flash cachedInput Derived at 10% of input — Google caching discount convention ~90%.
Google — Gemini 3.1 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 3.1 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 3.1 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Pro cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 2.5 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
xAI — Grok 4 (legacy) cachedInput Extrapolated at 25% of base.

Pricing is cross-verified against the LiteLLM community registry when available. Daily snapshots are kept in aicost_pricing_snapshots; every change is logged to aicost_price_changelog with old & new values for full audit trail. Read the full methodology →