Uber rolled Claude Code out to its engineers in December 2025. By April, the company's CTO confirmed it had spent its entire 2026 AI budget. Uber then capped agentic coding tools at $1,500 per employee per tool per month, and its COO told Fortune it had become hard to connect the token bill to features customers actually use.
Most of a company's AI bill isn't decided by how the tools get used. It's decided in how vendors count users, in contract terms, and in admin defaults nobody revisits after rollout. Here are six levers for whoever signs the invoice.
1. Your security bill counts who pushed, not who you employ
GitHub Advanced Security bills per active committer: anyone whose commit was pushed to an enabled repository in the last 90 days. A contractor who pushes one fix holds a license for three months. Enable it across the organization and every prototype and forgotten internal tool adds to the count.
The timing rules are lopsided too. Remove a person from the enterprise and their license frees up within 24 hours. Turn the feature off on a repository and its committers stay billable until the end of the cycle. So enable it only on repositories that ship to customers, offboard in GitHub the same day HR does, and keep contractor work in as few repositories as you can.
Or stop paying per person. At $30 per active committer, 20 committers on GitHub Code Security cost $600 a month. Patchlight charges per scan, at a median of $0.20. A weekly scan of 10 repositories comes to about $9 a month, and it costs the same whoever committed.
2. Don't lock in this year's prices
The price of a given level of model capability keeps falling fast. a16z estimated about 10x a year. Epoch AI measured anywhere from 9x to 900x, depending on the benchmark. A three-year deal at a fixed unit price means paying 2026 rates in 2028 for work that will cost a fraction by then.
Keep AI terms to twelve months, or write the decline into the contract: when the vendor's published rate or its upstream model price drops, yours drops within a set number of days. Add a most-favoured-customer clause. The escalation cap your procurement team usually asks for only protects you from increases. And run a second vendor on a slice of real work. A live alternative moves a renewal far more than one named on a slide.
3. Buy for your heaviest users separately
AI usage is not spread evenly across a team. Jellyfish found the median developer uses about 51 million tokens a month, and the 90th percentile more than seven times that. One plan for everyone overpays at both ends: flat seats are wasted on light users, and metered billing runs away with heavy ones.
Split the team. Put the top tier on flat-rate plans, keep everyone else on metered usage, and look at the split again every quarter. Set a per-person cap with an exception route, the way Uber did, instead of finding out from the invoice.
4. The default model is a budget line
A model picker is a price list. On GitHub Copilot's legacy annual plans, the request multiplier for Opus 4.6 went from 3x to 27x. Same seat, same developer, same prompt, nine times the burn. Most teams never set an organization default, so every developer pays for whatever they last picked.
Set an allowlist and a sensible default, and keep the most expensive models for the tasks that need them. Bigger is not reliably better either. In our own review benchmark, a model about eight times cheaper found the same bugs as its larger sibling, with far fewer false alarms.
5. Ask what else bills when a feature runs
“Included” features often carry a second meter. Since June 1, 2026, Copilot code review on private repositories uses GitHub Actions minutes on top of AI credits, with overage billed at Actions rates. Self-hosted runners avoid the minutes, if someone sets them up.
Before rolling out any AI feature, ask the vendor one question in writing: what else is charged when this runs? CI minutes, storage, egress and calls into another product are the usual answers.
6. Seats count people. Review counts pull requests
AI code review is usually sold per seat: $24 a developer a month for CodeRabbit's cheapest yearly plan, $30 for cubic. A developer who opens two pull requests a month pays the same as one who opens sixty. Quiet weeks, holidays and people who mostly review still cost a full seat.
The work itself is the pull request, so price it that way. A typical small team merges about 16 pull requests per developer a month. For 20 developers, that is 320 reviews. At Patchlight's median of $0.015 a review, the month comes to about $5, against $480 in seats. Larger pull requests cost more than the median, and a seat may bundle other features, but a quiet month costs close to nothing.