Prove what your AI investment is really producing.

Why nobody can answer it

AI activity is instrumented. AI value is not.

Spend shows up in a dozen invoices and a dozen teams. The outcomes it supposedly produced live in different systems, owned by different people, measured on different calendars. Nobody has the authority to connect them, so the honest answer to "what did this return?" is usually that the evidence layer needed to answer it was never built.

That is an organizational gap, not a technical one — which is why a tool has never closed it. Tools are good at what is being spent. They are silent on what it bought and who is accountable for the difference.

The sanctioned tool that cannot see anything

Many organizations now hold a proper enterprise AI agreement with the models deliberately walled off from internal data, production systems and proprietary research. That is a defensible decision and often the right one.

It also means the sanctioned tool cannot do the work people actually need done — and the work does not stop. It moves to whatever can see the data, which is usually an account the organization does not manage.

Independent and vendor research consistently puts a large minority of workplace AI use on personal accounts; the best-documented recent estimate is about a third, with roughly 40% of interactions involving sensitive material. A contract does not change that. Only a sanctioned path that reaches the real work changes that.

The governance question is therefore not "do we have an agreement." It is "can the approved route do the job, and how would we know if it isn't being used."

The sanctioned tool that cannot see anything

Five dimensions, and the layer that holds them

• Capacity — is supply matched to demand, reliably and at the right cost?
• Access — who can use which systems, models and data, and under what controls?
• Provenance — can data, models, content and decisions be traced to reliable sources?
• Compliance — are legal, policy, security and contractual obligations built into the work, and can that be demonstrated?
• Attribution & ROI — can cost and operational gain be traced to business outcomes?

Two of these can be assessed by inspection. Provenance, compliance and attribution usually cannot, because the evidence layer they depend on does not exist yet.

Finding that is not a gap in the review. It is the finding.

Two of the five can be inspected

Where we stop

The review stands on its own. There is no obligation to buy the fix, and we hold no stake in the tools we assess. Where we also help implement, we say so plainly and call it advisory, not assessment.

We do not issue audit opinions, assurance opinions or certifications.

Where this comes from

The method is not a framework assembled from reading. Each part of it is something one of us was responsible for somewhere it mattered: the yearly capacity and planning cycle for infrastructure inside an approximately $20B annual business; cost attribution and chargeback for shared infrastructure; metadata and lineage on data platforms; designated product compliance lead for scoped EU Digital Markets Act work, driven to readiness with verification and signoff held by others; and an operating cadence run for an eighty-engineer portfolio with no formal authority over anyone in it — which is the point, because a cadence that only works when you can order people around is not a cadence.

Twenty-five years, set out in full with the evidence, for anyone who wants to check.