The Procurement Pattern That Makes AI Waste Invisible

Torii's 2026 SaaS Benchmark found that 61.3% of applications in modern organizations are shadow IT, with AI tools comprising the majority of that unmanaged category. The same report shows the average employee interacts with roughly 40 apps during a workday. Zylo's SaaS Management Index puts the unused license rate at 36%, while per-employee SaaS spend nearly doubled to $9,455 by 2026. These numbers do not describe negligence. They describe a procurement pattern: OAuth sign-up, corporate card charge, no usage tracking, no owner assigned.

The mechanism that hides the cost

When a founder or team member signs up for an AI writing tool, a meeting summarizer, or a workflow automation service through OAuth, the subscription appears on a credit card statement between a dozen other line items. No IT ticket gets filed. No one gets assigned ownership. The tool enters the stack the same way a Slack notification enters a conversation — instantly, invisibly, and with no record of whether it ever got read again.

Productiv documented shadow IT growing 8 percentage points in a single year, with no ownership structure attached to those tools. That growth rate matters because informal judgment cannot track it. A founder managing a four-person team might know which tools each person uses. At ten people, with 40-60 tools per department, that knowledge degrades fast. The waste does not announce itself.

The case for tolerating the mess

The strongest argument against a decommissioning schedule is worth taking seriously, not dismissing. When an account manager signs up for an AI tool without asking permission, she is running a test. The research acknowledges directly that AI adoption, even when disorganized, correlates with productivity and revenue gains for some firms. A hard 90-day kill switch applied uniformly treats that employee-driven experimentation as waste by default, and for a small team, removing a tool someone has genuinely built a working habit around is disruptive in ways a metric dashboard will not capture.

This argument has weight. It also rests on a premise the data does not support: that founders can identify which shadow tools are generating value without ever looking. If 36% of licenses go entirely unused, the informal judgment that protects productive tools is already failing to catch the dead weight.

What a 90-day review actually does

A 90-day review does not automatically decommission every unreviewed tool. It makes usage visible for the first time. The question is simple: has anyone logged in, and has the metric this tool was supposed to move changed? Tools that survive that question are exactly the ones the "tolerate the mess" argument wants to protect. Tools that get cut are the ones sitting in the 36% unused-license figure.

One genuine limitation: the research does not establish that 90 days is long enough for every tool to show measurable impact. A tool affecting a sales cycle longer than 90 days will look like a failure before it has had a fair test. [Inference: the 90-day interval appears in practitioner guidance but is not empirically derived from the sources reviewed here.] For tools tied to longer cycles, the review should still happen at 90 days, but the decision to decommission should account for whether the underlying metric has had time to move at all.

The second cost nobody tracks

Zylo's data covers the financial waste. There is a second cost the credit card statement will never show. Research on technostress in knowledge work finds that unmanaged AI adoption does not reduce workload; it shifts cognitive effort into verification, output-checking, and task-switching between tools. Workers report measurable increases in exhaustion when the number of tools grows without governance. Forty apps a day is not a stack. It is a context-switching tax paid in attention.

The founders most resistant to a decommissioning schedule are usually the ones who added the most tools fastest. That is not a coincidence. It is the same procurement pattern running in the other direction: adding felt productive, so reviewing feels like slowdown. Pull your credit card statement, list every SaaS charge from the last 90 days, and mark the ones where you cannot name the last person who logged in. The Zylo data suggests roughly a third of them will have no answer.