Paying for AI nobody uses: unused licences and unlicensed tools in small firms

Many firms have two AI gaps at the same time: seats they pay for that nobody uses, and tools people use that nobody approved. The first wastes money. The second puts client data somewhere you haven't checked. The good news is you can find both without installing monitoring software, by comparing seats with active users, looking at expense claims and asking people which tools they use.

How much AI do firms pay for and not use?

Nobody has published reliable independent figures on AI seat use specifically, so I'd be wary of anyone quoting one. The wider software picture is clear, though. Zylo's 2026 SaaS Management Index, based on more than 40 million licences, found organisations leave an average of 36% of their software licences unused. Zylo's customers are mostly large companies, so I'd treat that as a benchmark rather than a rule for smaller firms.

AI adds to the problem because it's often bought in a hurry. In Flexera's 2026 State of ITAM report, only 31% of organisations said they had accurate visibility into their AI software, and 59% said wasted spending on AI had risen over the year.

The sums add up quickly. Microsoft 365 Copilot Business is £16.10 per user a month on an annual plan, before VAT and any promotional discount, so twenty idle seats cost £3,864 a year. ChatGPT Business is $20 a seat a month on annual billing, or $25 a month.

How many people use AI the firm hasn't approved?

Probably more than most firms realise. Research for Microsoft UK in October 2025 found 71% of UK employees had used unapproved consumer AI tools at work, and 51% did so every week. KPMG's UK findings from its 2025 study with the University of Melbourne say 58% of UK workers are using free, publicly available AI tools, and 39% have uploaded company information, such as financial, sales or customer data, into a public AI tool.

Both studies have their limits. The first was commissioned by a software company, and the second doesn't state the base for its figure. But they point in the same direction, and it shows up in the money too. Zylo found spending on software through expense claims rose 267% in a year, with ChatGPT now the most expensed application.

Why does unapproved AI matter?

Mainly because of client data. IBM's 2025 Cost of a Data Breach report studied 600 organisations that had suffered a breach. One in five said the breach involved shadow AI, and high levels of shadow AI added an average of $670,000 to the cost. Even when a firm chooses the tool itself, the bar is high. The ICO has answered a question from an organisation that wanted to use a generative AI tool to draft replies to client emails. To rely on legitimate interests as its lawful basis, the ICO said, the organisation "must demonstrate that the use of generative AI tools is necessary", and that it is proportionate. With tools the firm doesn't know about, it can't show any of that.

Most of it isn't malicious. The National Cyber Security Centre says shadow IT is "rarely the result of malicious intent" and recommends "a positive and no-blame approach". People reach for unapproved tools because they're useful, and often because the firm hasn't offered an approved one. In the Microsoft UK research, 28% said their employer provided no approved option.

How can you find both gaps without monitoring people?

• Compare seats with active users. If you use Microsoft 365, the admin centre's Copilot usage report shows enabled users against active users. I'd do the same for every AI tool you pay for.
• Check expense claims. Search for AI subscriptions people paid for themselves and claimed back. They show you what people value enough to buy.
• Ask, routinely and without blame. A short question at the end of real work, such as "which tools did you use?", gets better answers than an annual survey. It relies on what people tell you, so it can only undercount, but it shows where client data might be going.

What should you do with what you find?

Cut or reassign the seats nobody uses. Where people are paying for a tool themselves, decide whether to license it properly or offer an approved alternative. Write down which tools can be used with client information. Then check again each quarter, as both gaps tend to reopen whilst the tools keep changing.

This is the first thing Osava's firm report shows: the AI tools you pay for and what they cost, against who actually uses them, and the tools people use that the firm hasn't licensed. If you want to go further, have a look at how to measure the ROI of AI.