# The business case for governing AI agents

*A one-pager written to be forwarded. Fill in the four numbers from your own systems, keep the two questions intact, and bring it to the budget meeting. It names no vendor — it is the internal case for governance investment, not a product pitch.*

---

## The opening sentence

**AI agents are already acting inside our business — paying invoices, moving data, writing to systems of record — and today, when one acts wrongly, we cannot say within an hour what it did, why, or who approved it. This one-pager is the case for closing that gap before it closes on us.**

Everything below exists to make that sentence defensible in a finance review: four numbers you can pull from your own systems in a day, two questions that price the downside, and an ask scoped to 90 days.

---

## The four numbers to bring

Pull these before the meeting. Where exact data does not exist, bring a defensible range and say so — a range you can defend beats a point figure you cannot.

| # | Number | Where it comes from | Why it matters |
|---|--------|--------------------|----------------|
| 1 | **Agents in production without tested stop controls** | Your agent inventory minus the ones that have passed a stop drill | Every one of these is an unpriced liability: it can act, and nobody has proven anyone can stop it |
| 2 | **Hours of rework from wrong or unauthorised actions** | Support tickets, incident log, manual-correction time attributed to agent output | This is the cost already on your books — governance spend is measured against it, not against a hypothetical |
| 3 | **Agent spend outside a budget gate** | Cloud and model invoices against the approved pilot budget | Unbudgeted spend is the line item finance already looks for; it also signals agents nobody owns |
| 4 | **Open audit findings or exam questions involving AI** | Internal audit tracker, last examination letter, risk register | Open findings compound: each one raises the cost and length of the next examination |

**What these four say together:** the organisation is already paying for ungoverned agents — in rework, in shadow spend, in findings — and the bill that has not yet arrived is the one an examiner or an incident writes.

---

## The two questions to answer first

Everything in the business case is a multiple of these two. Answer them before you price anything else.

### 1. What does one unauthorised action cost, once?

Pick the most valuable action an agent in production can take — a payment, a data export, a contract term. Price the incident: investigation hours, correction, customer or counterparty impact, reporting obligations if data left the boundary. One real number. Governance spend is then compared against the probability of that event across your agent fleet, not against an abstraction.

### 2. What does one unprepared examination cost, once?

Regulators in banking, insurance, and the EU are now examining AI agents directly — what they are, who approved them, what evidence exists that the controls ran. An unprepared examination costs in three ways: staff months pulled into response, findings that stay open for quarters, and — the expensive one — the agent programs that get paused until the findings close. Price one delayed program launch at its monthly value; that is usually the largest number in the whole case.

---

## What changes if the money is not spent

The honest closing paragraph — write yours in your own words, but make it specific:

*Our current pilots stall at the governance review, because the review now asks who approved the agent's actions and what record exists, and we have neither. The agents already in production stay unrecorded, and each new one adds to the same unpriced surface. Nothing about this improves with time; every month adds another agent to the inventory without adding a single control.*

This paragraph is what converts governance from a cost line into the precondition for the agent programs the business already asked for.

---

## The approval ask

Scope it so a board can approve it without a platform briefing:

* **Scope:** all AI agents in production, plus the two pilots scheduled to reach production in the next quarter.
* **Duration:** 90 days.
* **Single measurable outcome:** every production agent has a named owner, an approved policy, a tested stop control, and a tamper-evident record of its actions — evidenced by artifacts, not assertions.

The evidence-driven format matters: the outcome is proven by records that exist, in the same way the finance function is proven by reconciliations that exist.

---

## The one-line summary for the meeting

**We are not buying a tool; we are paying to be able to answer, within an hour, what our agents did and who approved it — and to prove it to the next examiner.**

---

*After approval, the first artefact to run is the 36-check agent readiness checklist: same evidence-driven format, fits in one review meeting, and produces the not-ready list that scopes the work.*