Ten or fifteen years ago, every board wanted to be in the cloud. The instruction was simple: move fast, and sort out the details later. Teams signed up for services on company cards, developers spun up whatever they needed, and finance found out at the end of the month.
I spent a good part of my career helping organisations deal with what came next: estates that had grown faster than anyone could see, bills nobody could explain, and contracts that were hard to leave.
AI is repeating that land grab. The pattern is the same, the pace is faster, and this time more is at stake. This piece opens a series on getting AI right: what to govern, how to control it, who should manage it, and how to make sure it builds the value of the business rather than quietly eroding it.
What happened with cloud
The cloud land grab followed a pattern most leaders will recognise.
- The rush. Moving was the priority. Governance could come later.
- Sprawl. Accounts, services and subscriptions multiplied across teams, many of them unknown to IT.
- Surprise bills. Pay-as-you-go pricing met nobody watching the meter.
- Lock-in. Systems built around one provider became hard and expensive to move.
- The clean-up. Years later, organisations built the discipline they had skipped: cost management, central oversight, and an owner for every account.
That discipline now has a name, and it has become mainstream. In Flexera's 2026 State of the Cloud Report, 63% of organisations have an established FinOps team and 71% run a cloud centre of excellence. It took years, but it worked.
AI is following the same path, only faster
| What happened with cloud | What is happening with AI |
|---|---|
| A rush to move, often without a plan | Staff adopting AI tools faster than policy can keep up |
| Sprawl and shadow IT | Tools, agents and connections multiplying across platforms |
| Surprise bills | Consumption nobody budgets for, and seats nobody uses |
| Lock-in | Dependence on AI platforms, and vendors holding your data |
| A costly clean-up, years later | Still to come, unless governance starts now |
The early signs are already there. Delinea's 2026 Identity Security Report, a survey of 2,254 IT and security leaders and 2,250 employees, found that 99.7% of organisations have a formal policy on what data AI tools and agents can access, yet only about half check access against it in real time. Three-quarters of employees (76%) said they had bypassed formal approval at some point. The policies exist; the control doesn't.
The pace is different too. In Flexera's surveys, the share of organisations using generative AI rose from 47% to 81% in two years. And AI is already undoing some of cloud's hard-won progress: surging AI workloads pushed estimated wasted cloud spend up to 29%, the first increase in five years. The discipline organisations spent years building is being tested by a technology that arrived in two.
The pressure is also starting to come from outside. In the conversations I'm having, customers are beginning to ask their suppliers for proof of AI safeguards in contracts, not just a policy statement. With cloud, governance was mostly an internal matter for a long time. With AI, it is becoming part of how you win and keep business.
What is different this time
If AI were simply cloud again, the answer would be FinOps again. It isn't, for three reasons.
- AI learns. Cloud stored your data. AI absorbs it: from the prompts people type, the documents agents read, and the expertise it captures from your best people.
- AI acts. Agents don't just hold data. They send messages, update records and make decisions in your systems. When one gets it wrong, someone needs to have owned it before it did, yet Delinea found only 36% of IT leaders can always trace a sensitive AI access back to the person who authorised it.
- AI is becoming the product. For a growing number of businesses, AI is moving into what they sell. Knowledge that used to live in people's heads is becoming an asset the business owns, or one it gives away.
That is why late governance costs more this time. With cloud, it cost money. With AI, it can cost what makes the business valuable.
AI is the first technology that can learn your business, and the first that can leave with it.
What the organisations that got cloud right did
The organisations that came through the cloud land grab well did a few things early. None of them involved slowing down.
- They looked before they legislated. They found out what was actually running before writing the rules. With AI, that means evidence of the tools, agents and connections in use, not just a policy and a survey.
- They gave people a route, not a wall. Blocking cloud pushed it onto personal cards and accounts. Blocking AI does the same. Shadow AI is a sign of demand, and an approved route turns it into adoption.
- They gave everything an owner. Every account and every service had someone accountable for it. Every AI use and every agent needs the same: a named person, before it goes live.
- They paid for what they used. Cost discipline came from seeing spend against use. With AI, seats nobody opens and consumption nobody budgets for are the first savings, and they can help fund the rest.
- They kept it proportionate. A light touch for low-risk use, real scrutiny where it mattered. Governance that slows everything down gets worked around.
Those five habits are what this series is about.
Where are you?
Most organisations recognise themselves in one of three stages, and the stakes rise at each one.
| Stage | What it looks like | What is at stake |
|---|---|---|
| 1. AI helps your people work | Assistants and everyday tools, often adopted faster than policy | Cost and data |
| 2. AI does the work | Agents acting in your systems, on tasks set by a process or a person | Control and accountability |
| 3. AI becomes your business | Customers instruct AI directly, or it decides outcomes for them; at the far end, AI becomes what you sell | Customer outcomes, IP, people and the value of the business |
The later governance starts, the more each stage costs to put right.
There is an important difference between the first two stages and the third. At stages 1 and 2, you are still a people-first business: AI makes your people faster and takes on some of their work, but the value you deliver still comes from them. Many organisations will rightly stay there, because of what they do, with perhaps a few pockets of stage 3 in particular teams or services.
Stage 3 is different in kind. When AI becomes what you sell, the business becomes tech-first, and that is a business transformation rather than a technology upgrade. The structure changes, the way you manage changes, and so does the competition. Some of your vendors may become competitors, because the platform you rely on can offer your customers the same outcome directly. And new rivals will start at stage 3, without the people and costs you carry. Knowing which kind of business you intend to be is the first decision, because it shapes everything you govern.
Three questions to ask this week
- Who leads AI here, end to end?
- Do we know what AI is actually in use, including what nobody approved?
- What does our AI cost, and what is it returning?
If those are hard to answer, you're not alone, and you're not too late. The pieces that follow take them in turn, starting with who should lead AI. At Peruze, we help organisations answer them with evidence, starting with a short walkthrough of where AI already sits in your business.
Which stage is your organisation at, and which of the three questions is hardest to answer?
Sources
- Delinea, 2026 Identity Security Report: The AI Enforcement Gap, announced 29 September 2026: AI policy adoption, real-time checking, employee bypass and traceability figures
- Flexera, 2026 State of the Cloud Report, announced 18 March 2026: FinOps teams, cloud centres of excellence, generative AI adoption and wasted cloud spend