Minimum Effective Intelligence: AI Spend Is Now a Board Line, and Most Teams Have No FinOps for It

In January 2026 the FinOps Foundation reported two things that belong on the same page. First, about 98% of organizations now say they are managing AI spend. Second, AI cost management is the top wanted skill of the year, meaning demand for people who can actually do it has badly outrun supply. Read those together and you get the real state of the market: nearly everyone has AI on the bill, and almost no one has an operating model for it. For a senior buyer at a regulated, operationally complex mid-market organization, a behavioral health group, a PE portfolio company, a regulated SaaS vendor, that is not a finance footnote. AI spend has become large enough and volatile enough to surface in board materials, which means it now carries the same expectation every other board line carries: that you can explain it, attribute it, and defend it. The uncomfortable part is that the controls you would build to govern the cost are the same controls a regulator or auditor will ask you to produce as evidence. If you cannot say which model answered which request and what it cost, you also cannot say which model touched which regulated record. Cost governance and AI governance are the same artifact viewed from two angles. What actually changed Three shifts converged in the first half of 2026. The first is price-performance churn at the model layer. Claude Opus 4.8 shipped on 28 May, roughly 41 days after 4.7, and added a user-selectable effort control, and Anthropic's own guidance is that maximum effort can burn around five times the tokens while underperforming the "high" setting on long-horizon work. The same dial that improves an answer can quietly quintuple its cost. New flagships keep landing on top of that: Fable 5 and Mythos 5 launched on 9 June, Google announced Gemini 3.5 and Gemini Omni at I/O on 1 May, and the open-weight Gemma 4 models arrived the same day. Every release reshuffles the cheapest acceptable option for a given task. The second shift is the erosion of model pinning. When GPT-5.5 Instant became the ChatGPT default on 5 May, it was exposed as a floating "chat-latest" alias. Floating aliases are convenient, and they are a governance hazard: the model behind your workload can change underneath you, along with its cost and its behavior, without a deploy on your side. For a regulated buyer that is a change-management event you did not authorize. The third shift is that the platforms finally shipped the plumbing to measure any of this. Amazon Bedrock added request-level usage attribution on 20 May. Microsoft, having renamed Azure AI Foundry to "Microsoft Foundry" effective 1 January, shipped project-level cost attribution on 31 May, alongside Managed VNet reaching general availability. The tooling to run AI FinOps now exists. Most mid-market teams have not turned it on. Why your existing cloud cost controls miss it Traditional cloud FinOps assumes roughly stable unit economics: an instance costs what it costs per hour, storage is priced per gigabyte, and variance comes from how much you provision. AI inference breaks that model. The unit is the token, the token count per request is non-deterministic, and the cost per request can swing by an order of magnitude based on prompt length, retrieved context, retry behavior, and, as Opus 4.8 makes vivid, a single effort setting. A tagging strategy built for EC2 and S3 does not see any of this. It sees one large, lumpy line item from a model provider and no way to decompose it. That opacity is exactly where the risk lives. A workload that quietly routes every classification task to a frontier model is overspending and over-exposing in the same motion, sending more data, to a more capable model, than the task required. You cannot fix what you cannot attribute, and you cannot attest to what you cannot fix. Minimum effective intelligence: route to the cheapest accepted result The operating principle worth adopting is minimum effective intelligence: send each task to the cheapest model that still yields an accepted result, and reserve frontier models for the work that genuinely needs them. This is not cost-cutting theater. It is the AI-era version of right-sizing, and it pays a governance dividend, smaller, cheaper, often self-hostable models keep more data inside your perimeter. The Gemma 4 open-weight release on 1 May is a concrete example: a self-hosting path for data that cannot leave the boundary at all, which is frequently the right answer for protected health information or regulated financial records regardless of price. Routing is a decision you make per task type, written down and reviewable, not a vibe each engineer carries in their head. The artifact that makes it real is a per-request cost ledger. Every AI call should produce one row, with at minimum these columns: request id and timestamp requesting workload, team, and cost center model id requested (pinned version, not a floating alias) and model actually served input tokens, output tokens, and effort or reasoning setting computed cost, attributed to project or cost center data classification touched (e.g. PHI, PII, financial, public) outcome: accepted, retried, or rejected That ledger is your FinOps source of truth and your governance log at once. The "model actually served" column catches alias drift. The "data classification" column is what turns a cost record into an audit record. Per-request attribution is also your audit trail This is the move regulated buyers should internalize. Bedrock's request-level attribution and Foundry's project-level cost attribution were built to answer a finance question, who spent what, but they answer a compliance question with the same data. The US Treasury's Financial Services AI RMF, published 19 February, lays out 230 control objectives across seven domains; a recurring theme across frameworks like it, Texas TRAIGA (in force since 1 January, with a NIST AI RMF safe harbor), and the preliminary NIST Cyber AI Profile (IR 8596, December 2025) is the same demand: show which AI system processed which data, under which configuration. A per-request ledger that records model, version, and data classification is precisely that evidence, produced as a byproduct of running cost control well. There is a clock on this for anyone touching Europe, too. The EU AI Act's "Digital Omnibus" deferred the high-risk Annex III obligations to December 2027, but general-purpose AI enforcement powers still activate on 2 August 2026, with fines up to 3% of global turnover, and downstream deployers are expected to collect provider documentation now. The teams that already know exactly which models they run, pinned to which versions, will assemble that file in an afternoon. The teams running on floating aliases will not. What we recommend In the advisory work we do with regulated mid-market clients, four moves turn AI spend from a surprise into a controlled, attestable line. First, put budget caps at the gateway, not in a spreadsheet. Route all AI traffic through a single gateway and enforce hard per-workload spend limits there, so an over-budget or runaway job is throttled in real time rather than discovered on next month's invoice. The cautionary tale is the AI coding agent that reportedly deleted a startup's production database and its volume-level backups in about nine seconds, automation moves faster than your billing alert. Second, pin your models and ban floating aliases in production. Pin to stable ids such as "claude-opus-4-8", record the version served, and treat any provider-side model change as a change-management event. Third, instrument the per-request ledger above and make data classification a required field. If you cannot tag the data class, the call does not ship. Fourth, run a weekly AI cost review, fifteen minutes, finance and engineering together, covering spend by workload, routing exceptions, alias drift, and any request that touched a higher data class than its task required. For the cloud-side mechanics of Bedrock and Foundry attribution, see our AWS and Azure FinOps Field Guide at /blog/aws-azure-finops-field-guide; if you want a second set of eyes on your own setup, that is what our Diagnostic is for. Stand up the FinOps layer before the spend reaches the board, because the records that control your cost are the same records your auditor will demand, build them once, use them twice.