Skip to content
Book a consult

Insights  /  Platforms

Controlling tool sprawl: platform strategy for GenAI

A decision rubric for selecting tools that fit architecture, cost, and compliance.

Sopra Labs AI  ·   ·  7 min read
SopraLabs Hero Tools

Key takeaways

  • AI tool sprawl is the sum of sensible local decisions. Departments buy, individuals expense, and vendors switch on AI inside software the company already licenses. Nobody chooses the portfolio that results.
  • The base is already large. Zylo’s 2026 SaaS Management Index puts the average company in its data at 305 SaaS applications (Zylo), with business units controlling 81% of SaaS spend and IT directly managing 15% (Zylo).
  • The cost shows up in three places: the same job paid for more than once, company data in more places than anyone has listed, and risk controls that vary by team.
  • A short set of standards and one rubric (architecture, cost, compliance, use) let leadership give every tool one of four outcomes: run, keep, consolidate or retire.

Three renewals, one job

Budget season, software line. The CFO is working through renewals with the controller, and the list is longer than last year’s.

Three of the lines do the same job. Sales pays for one meeting-notes assistant. Customer success pays for another. A third came bundled into the video-conferencing renewal. Further down, the CRM contract carries a new AI add-on at a higher price per seat. The office suite’s assistant is licensed for all 400 employees. On the expense reports, eleven people are also paying for a chat assistant of their own.

The CFO asks which of these the company has decided to use. The controller says, carefully, that nobody decided. Each one was approved by someone with a budget and a reason.

Every purchase on the list made sense on the day it was made. The list does not.

Nobody chose the portfolio. It accumulated.

Software has been bought this way for years. Zylo’s 2026 SaaS Management Index, built on more than 40 million licenses, puts the average company in its data at 305 SaaS applications (Zylo). Business units control 81% of SaaS spend, and IT directly manages 15% (Zylo). Zylo sells software for managing subscriptions, so it has an interest in the problem looking large. The pattern still matches the controller’s list.

AI adds to that base through three doors at once.

The first is the department purchase. A team finds a tool that helps, and its leader has the budget to say yes. In Zylo’s data, spend on AI-native applications rose 108% in a year. Generative AI joined its list of most redundant app functions for the first time, “with an average of 7 apps in the portfolio.”

The second is the individual. Zylo found that an AI chat assistant is now the most expensed application. A University of Melbourne and KPMG study of more than 48,000 people in 47 countries reported that “almost half of employees admit to using AI in ways that contravene company policies” (KPMG). In a Gartner survey of 302 cybersecurity leaders, 69% of organizations suspected or had evidence that employees were using prohibited public generative AI tools (Gartner).

The third door needs no purchase at all. AI arrives inside software the company already licenses. Gartner’s September 2026 forecast says vendors “are rapidly embedding agentic AI within their existing products,” meaning AI that takes actions and does not only draft text. Enterprises, it adds, are using “these simpler embedded AI features from their incumbent software providers” (Gartner). The same forecast puts worldwide AI software spending at about $461.6 billion in 2026, against about $288.2 billion in 2025.

The people who manage technology spend have noticed. In the FinOps Foundation’s 2026 survey of 1,192 practitioners, 98% now manage AI spend, against 31% in its survey two years earlier (FinOps Foundation).

None of this is misbehavior. Each decision is local and sensible. The cost appears only at the level of the whole company: duplicated effort and spend, company data sitting in more places than anyone has listed, and risk controls that depend on which team did the buying.

Decide the portfolio on purpose

A platform strategy at this scale is not an architecture document. It is a list, a few standards, and one rubric applied to every tool.

List tools by the job they do. Vendor names hide overlap, and jobs reveal it. Group every AI tool and AI feature under the work it performs: drafting, meeting notes, search across company documents, coding help, customer replies. Include what arrived inside existing licenses and what appears on expense reports. For each one, record the annual cost, the number of active users and the data it touches.

Set a short list of standards. Five is enough. One default tool for each common job. Company sign-in on everything, so access ends when employment does. Company data only in tools covered by a business agreement. One buying path, which means no AI subscriptions on expense reports. A way to get your data out. NIST’s AI Risk Management Framework asks for a similar footing: “Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues” (NIST AI RMF, GOVERN 6).

Score every tool with the same rubric. Four questions carry it. Architecture: does it connect to the systems and sign-in the company already runs? Cost: what is the full annual cost, including charges that rise with usage, and is the company already paying for this job elsewhere? Compliance: does it meet the data standards above? Use: do people rely on it? Cost deserves particular care. In a survey of 218 IT leaders published by Zylo, 78% reported unexpected charges tied to consumption-based or AI pricing models.

Give each tool one of four outcomes. Run: it is the standard for its job. Keep: it stays as a documented exception with a reason and a review date. Consolidate: its users move to the standard at the next renewal. Retire: it is switched off, on a plan. For that last step, NIST asks for procedures for “decommissioning and phasing out AI systems safely” (NIST AI RMF, GOVERN 1.7). Write each outcome in the decision log.

Rerun it every quarter. New tools and new features will arrive between reviews. Any request for a new tool goes through the same rubric, and the first question is whether a standard already does the job. Gartner’s advice to CIOs points the same way: “incorporate GenAI risk evaluation into their SaaS assessment processes.”

The likely objection is that standards lock the company into the wrong tool in a fast-changing market. A standard is a default, not a ban. The keep outcome exists for teams with a real need the default does not meet, and the quarterly refresh is where a better tool replaces the current one. What the standards rule out is paying three times for one job and finding out at renewal.

The same list, decided

Next budget season, the CFO and the controller open the same list. It is shorter, though that is not the main change. Each line now carries an outcome and a reason.

One meeting-notes assistant is the standard. One is a documented exception for customer success, with a review date in the spring. The third was switched off at renewal.

The CFO’s question has an answer now. The tools did not improve. The company started choosing them.

The opening scenario is a composite of common patterns, not a client engagement. SopraLabs builds the evaluation rubric, shortlist and recommendation with leadership teams as the Platform Selection module of our services.

Frequently asked questions

What is AI tool sprawl?

AI tool sprawl is the unplanned growth in the number of AI tools and AI features a company runs, caused by separate purchases across departments, individual subscriptions, and AI switched on inside software already licensed. Its costs are duplicate spend, company data spread across many tools, and inconsistent risk controls.

How many AI tools should a company have?

There is no correct number. A workable target is one default tool for each common job, plus a small number of documented exceptions. For comparison, Zylo’s 2026 data shows generative AI on its list of most redundant app functions, “with an average of 7 apps in the portfolio” (Zylo).

Should we standardize on one AI platform or allow several?

Standardize by job, not by vendor. One platform rarely covers every job well, so set one default per job and allow exceptions that have a stated reason and a review date. Review the defaults every quarter so a better tool can replace the current one.

How should a company handle AI features inside software it already licenses?

Treat each one as a tool on the list and score it with the same rubric. Gartner reports that vendors “are rapidly embedding agentic AI within their existing products” (Gartner), so these features will keep arriving at renewal or between renewals. An embedded feature may turn out to be the best standard for a job, or a duplicate to leave switched off.

Sources

Keep reading

Browse all insights