Assessment · Governance · Assess and know

1AI inventory and shadow AI

What AI do we actually run, and what did nobody approve?

Every AI app, agent, model, key and AI feature in use, with the spend behind it.

AutomatedStakeholder interviews 2 controls 4 engines

How we collect

  • AutomatedMicrosoft Entra and Graph, read-only: service principals, OAuth grants, app registrations, sign-ins, Intune detected apps, Copilot usageRuns today
  • AutomatedCard, AP and expense exports: AI vendors with exact spend, matched to known productsRuns today
  • AutomatedDefender for Cloud Apps discovered generative AI apps export, with device coverage reportedNeeds your export or setup
  • AutomatedGateway logs and AI vendor usage exportsNeeds your export or setup
  • Stakeholder interviewsOwners confirm purpose and approval status of each systemRuns today

Status labels show what runs today, what needs an export or setup from you, and what is planned.

What you get

  • Inventory: app, vendor, how found, users, spend, data class, owner
  • Shadow AI found in the invoice, not only on the network
  • Discovery coverage: how much of the estate the data could see

Questions we ask

  • Which AI tools did your team adopt this year?
  • Which ones touch customer or employee data?

We can start from

Existing app inventories and AI registers as CSV or spreadsheet exports

Example output

AppVendorFound byUsersMonthly spendData classRisk tierOwner
ChatGPT TeamOpenAICard statement, network discoveryFrom sign-in dataFrom statementInternalMediumTo assign
Copilot for Microsoft 365MicrosoftGraph licenses and usageLicensed and activeFrom license countConfidentialMediumIT
Support RAG assistantAnthropic via gatewayGateway logsSupport teamFrom gatewayCustomer dataHighSupport lead

Data sources

SourceWhat we readStatus
Microsoft Graph and Entra IDService principals, OAuth grants, app registrations, sign-ins to AI apps, Copilot usage reports. Read-only scopes, metadata only.Runs today
Defender for Cloud AppsThe discovered Generative AI apps export: which AI sites people use, how often, and Microsoft risk scores.Partly automated
Invoices, card and AP exportsAI vendors found on statements and invoices, including ones never approved. Spend is exact because it is on the statement.Partly automated
AI gateway telemetryLiteLLM, Cloudflare AI Gateway or AICost CostWall logs: cost per team, workload, agent and outcome.Partly automated
QuestionnaireThe short interview for what data cannot show: purpose, owners, decisions AI informs, regulations in scope.Runs today

Built on governance engine modules

P1 BetaAI Inventory & Shadow AI

What AI is actually in use here, sanctioned or not?

Assess & Govern
P15 LiveLicensing, Procurement & Sprawl

What are you paying for that nobody uses, or double-buying?

Value & Optimization

AICost governance controls in this module

AICost-GovControl101Runs today
AI inventory, including shadow AI
What it is

One living list of every AI system in use: models, copilots, agents, AI features inside SaaS, personal accounts and API keys, with the spend behind each.

Why it is needed

You cannot set rules, budgets or owners for AI nobody has listed. Most AI enters through a credit card, a SaaS update or a developer key, not procurement.

Why enterprises need it

Regulators, auditors and customers now ask which AI you run. Finance asks why AI spend appears in five cost centers. Both questions start here.

What you get:Shadow AI found from data, not surveys aloneEvery AI line on the bill tied to a named appOne list that feeds risk, cost and audit work
Run by
AI Inventory and Shadow AI engineVendor Facts engine (ToolsInfo)AI Inventory engineShadow AI Finder engine
Data
Microsoft Graph and Entra ID, Defender for Cloud Apps, Invoices, card and AP exports, AI gateway telemetry, Questionnaire
Evidence produced
Inventory table: app, vendor, how it was found, users, monthly spend, data class, risk tier, owner, review date.
Maps to
NIST AI RMF: Map; ISO/IEC 42001: AI system inventory; EU AI Act: deployer records
AICost-GovControl105Partly automated
Open-weight and self-hosted models
What it is

Review of open-weight models before download, fine-tuning or hosting: license, origin, security, and full hosting cost.

Why it is needed

Self-hosting moves duties to you: patching, safety testing, capacity and the license terms of the weights.

Why enterprises need it

Self-hosting is often chosen to save money or keep data in house. It only pays at certain volumes and with an operations plan.

What you get:Break-even known before buying GPUsModel origin and license checkedA maintenance plan, not just a launch
Run by
Model and Vendor Decision engineAI Architecture Decision engineOpen Model Finder engineOpen Model Hosting engineSelf-host or API engineModel Origin Risk engine
Data
Questionnaire
Evidence produced
Open-model intake record: model, license, origin, hosting option, monthly cost at volume, break-even, approver.
Maps to
NIST AI RMF: Map, Manage; ISO/IEC 42001: third-party and supplier relationships

Stakeholders

CIOCISOFinance
All modules 2. Workflow map and owners →
📖 Data sources & methodology 172 text models · 9 embeddings · 44 vision · 62 audio · 8 vector DBs across 10 vendor pages · last verified 2026-10-18

Methodology

  • All prices are USD per 1 million tokens, current as of 2026-10-18.
  • Vendor-published values have no mark. Inferred/extrapolated values are marked with * and listed below.
  • Batch API discounts are 50% off standard rates across providers that offer Batch mode.
  • Prompt caching discounts vary by provider (typically 80-90% off cached input tokens).
  • Regional data-residency surcharges (Anthropic 1.1x, OpenAI 1.1x, Google regional tiers) are NOT included in base rates.
  • Long-context pricing tiers apply when input exceeds model threshold.
  • Embedding prices are input-only (no output tokens generated).

Primary sources

Last-verified date is the most recent successful daily snapshot (aicost_pricing_snapshots) or, when no snapshot exists yet, the latest successful crawler run (aicost_crawler_runs). 10 of 10 vendors are currently verified. Aggregator services (TokenCost, AI Pricing Guru, etc.) are not listed.

Anthropic
2026-10-18
https://www.anthropic.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Anthropic Docs
2026-10-18
https://platform.claude.com/docs/en/about-claude/pricing
Daily snapshot since Sep 2023 · 704 days captured
OpenAI
2026-10-18
https://openai.com/api/pricing/
Daily snapshot since Sep 2023 · 705 days captured
Google AI
2026-10-18
https://ai.google.dev/gemini-api/docs/pricing
Daily snapshot since Dec 2023 · 680 days captured
Google Vertex
2026-10-18
https://cloud.google.com/vertex-ai/generative-ai/pricing
Daily snapshot since Dec 2023 · 680 days captured
DeepSeek
2026-10-18
https://api-docs.deepseek.com/quick_start/pricing
Daily snapshot since May 2024 · 619 days captured
xAI
2026-10-18
https://x.ai/api
Daily snapshot since Nov 2024 · 537 days captured
Mistral
2026-10-18
https://mistral.ai/pricing
Daily snapshot since Dec 2023 · 678 days captured
Cohere
2026-10-18
https://cohere.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Voyage AI
2026-10-18
https://docs.voyageai.com/docs/pricing

Inferred values (marked with * in calculator tables)

Derived from industry conventions, not directly published by the vendor. Typical conventions: cached input = 10% of base (90% off), Batch API = 50% of base (50% off).

Vendor / Model Field Why it’s inferred
Anthropic — Claude Sonnet 4.6 cachedInput Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.
Anthropic — Claude Sonnet 4.5 cachedInput Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.
Anthropic — Claude Sonnet 4.5 batchInput Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Sonnet 4.5 batchOutput Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Haiku 4.5 cachedInput Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.
OpenAI — GPT-5.4 Mini cachedInput Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.
OpenAI — GPT-5.4 Nano cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Nano batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Nano batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Pro batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.2 cachedInput Derived at 10% of input; no residency uplift.
OpenAI — GPT-5.2 batchInput Derived at 50% of input.
OpenAI — GPT-5.2 batchOutput Derived at 50% of output.
OpenAI — GPT-5 cachedInput Derived at 10% of input.
OpenAI — GPT-5 batchInput Derived at 50% of input.
OpenAI — GPT-5 batchOutput Derived at 50% of output.
OpenAI — GPT-5.5 Pro cachedInput Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.
OpenAI — GPT-5.5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.2 Pro cachedInput Derived at 10% of input — pro-tier convention.
OpenAI — GPT-5.2 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.2 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.1 batchInput Derived at 50% of input.
OpenAI — GPT-5.1 batchOutput Derived at 50% of output.
OpenAI — GPT-5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5 Nano cachedInput Derived at 10% of input.
OpenAI — GPT-5 Nano batchInput Derived at 50% of input.
OpenAI — GPT-5 Nano batchOutput Derived at 50% of output.
Google — Gemini 3 Flash cachedInput Derived at 10% of input — Google caching discount convention ~90%.
Google — Gemini 3.1 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 3.1 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 3.1 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Pro cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 2.5 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
xAI — Grok 4 (legacy) cachedInput Extrapolated at 25% of base.

Pricing is cross-verified against the LiteLLM community registry when available. Daily snapshots are kept in aicost_pricing_snapshots; every change is logged to aicost_price_changelog with old & new values for full audit trail. Read the full methodology →