Most AI pilots that stall do not fail. They work well enough that someone has to check every answer. That checking is the cost nobody put in the business case, and it is why so many pilots never reach production.
A Certinia executive writing in diginomica gave it a good name: the "verification tax." He was writing about professional services firms. The same tax is running inside banks, insurers and health systems right now, and the past few weeks of news showed it at three more levels.
Where your teams are paying it
The pattern is familiar. An agent drafts a KYC summary, a credit memo or a claims note. It is right most of the time. Because no one can say which times, an analyst reads all of it. The pilot saved typing, not time.
The tax shows up in three places:
- Analysts re-reading output because nothing tells them which answers to trust.
- Model validation rebuilt for each use case because evidence was never captured as the system ran.
- Audit and exam preparation done by hand, reconstructing what an agent saw and why it acted.
None of these appear in the pilot's success metrics. All of them appear in the production budget. That is usually where the project stops, at the approval step we described in why AI projects stall at governance gates.
Firms like ours pay it too
Advisory firms carry the same tax. When we use AI to produce a design, a data mapping or a test plan, a senior engineer still signs it. If that engineer has to re-derive the work to sign it, the AI saved nothing, and the client should not pay for the difference.
The firms that deliver faster will be the ones that removed the need to re-check, not the ones that added more AI. The same is true for their clients.
The audit profession just chose the other route
On November 2 the SEC approved amendments to the PCAOB's quality control standard, QC 1000, as CFO Dive reported. Large audit firms no longer have to set up an external quality control function, an outside check on how they evaluate their own quality control. KPMG, PwC, Deloitte and EY supported the change. The CFA Institute opposed it and called the external check a key safeguard for investors.
Whatever one thinks of the merits, the lesson for AI programs is plain. When verification is expensive, the pressure is to do less of it. The better answer is to make it cheap: build the evidence into the system so the check is a lookup, not a project.
Access was checked. Behavior was not.
WSO2's CEO, Harry Ault, made a related point in a Business Standard interview on November 3. Enterprises, he said, need to understand how agents behave and interact with their systems, not only whether the right agents have access. Older automation was deterministic. Generative AI is probabilistic, so outcomes are hard to predict once the system is in production.
The access check itself also has to hold. Gateways are a favorite target because every call passes through them, and a flaw that lets a forged token through hands an attacker everything behind it. Vendors ship fixes quickly. The exposure sits with anyone who has the fix available and has not confirmed it was applied.
Two lessons for anyone putting agents behind a gateway:
- Verify behavior continuously, not just identity at the door.
- Verify your own controls. An available patch is not an applied patch until someone checks the update level.
What removing the tax takes
Three moves remove most of it.
- Produce evidence as the system runs. Log what each agent saw, which policy applied and what it did, in a form a validator or examiner can read without a reconstruction project.
- Enforce agent identity, policy and logging on every call to a model, a tool or an API. That is the job of an enterprise AI gateway, and it is where behavior becomes visible.
- Settle definitions before the build. Much of the re-checking happens because people do not trust what the data means. An agent that reads a field two teams define differently will be right and wrong in ways no reviewer can predict.
None of this is new technology. It is design work done before the pilot instead of after it. It is also the difference between agent governance that passes a pilot and governance that survives an audit.
The question for your next pilot review
Ask how much of the pilot's labor is checking. If the answer is most of it, the pilot has not proven value yet. It has proven a cost you will pay at scale.
Finding where that cost sits, and designing it out, is the core of our AI governance consulting work.
