Short answer. Price an AI system in a bank across 5 cost lines over 3 years, not one build invoice. Build is often the smallest line. Inference, data work, monitoring, model changes, compliance, and the people who run all of it dominate the total. Independent estimates put EU AI Act compliance alone at about a 17% overhead on AI spend, and run costs usually exceed the cost to build. A credible total cost of ownership model separates one-time build from recurring run, then multiplies the pilot’s run cost before you commit.
Total cost of ownership (TCO) is the all-in cost to own and operate an AI system across its full life, not the price to build the first version. A bank that budgets only the build signs off on roughly a third of the real number. The rest arrives after go-live and recurs every year the system runs.
The gap between a pilot budget and a production bill is the single most common reason an AI programme loses board confidence. A pilot runs on a small dataset, a handful of users, and no audit trail. Production runs on live data, full volume, human oversight, logging, and a model that has to be retrained and revalidated. Each of those adds cost that the pilot never showed.
A practical TCO model for a bank separates the spend into lines that behave differently over time:
In a bank the recurring lines are not optional. The EU AI Act classifies credit scoring and many insurance pricing systems as high-risk, which triggers obligations that run for the life of the system: a quality management system, technical documentation, logging, human oversight, and post-market monitoring. These are annual costs, not a one-time compliance project. The European Commission’s own impact assessment estimated roughly a 17% overhead on AI spend to meet the rules, and independent analysis puts the initial compliance cost per high-risk system above 50,000 euros before annual maintenance.
DORA adds a second recurring layer. An AI system that supports a critical function sits inside the bank’s ICT risk framework, so it carries third-party risk management, incident reporting, and resilience testing for as long as it runs. In November 2025 the European Central Bank elevated AI governance and risk management to a Priority 2 supervisory focus for its 2026 to 2028 cycle, and about half of the banks in its sample had already stood up a dedicated AI policy or committee. A TCO model that leaves out supervision and audit readiness understates the real number and sets the board up for a surprise.
Model AI TCO across 5 cost lines over 3 years: build, inference and infrastructure, monitoring and operations, governance and compliance, and people.
The five lines are build, inference and infrastructure, monitoring and operations, governance and compliance, and people. The useful discipline is to split each line into one-time and recurring, then sum the recurring lines across three years. Build is one-time. The other four recur, and together they usually outweigh the build by the end of year two.
For a bank, two lines carry the most estimation risk. People is the largest and the easiest to underfund, because a pilot borrows time from existing staff while production needs named owners. Governance and compliance is the most variable, because it scales with the system’s risk class under the EU AI Act. A low-risk internal assistant and a high-risk credit model can share the same build cost and differ by a factor of three on compliance over three years.
A pilot is engineered to prove value fast, so it strips out everything production needs. It runs on sampled data, skips the audit trail, uses one model version, and relies on an engineer watching it by hand. Production reverses every one of those shortcuts. Full data volume raises inference and storage cost. Human oversight, logging, and drift monitoring become permanent lines. The model has to be retrained and revalidated on a schedule, and each revalidation reopens the compliance work.
The honest planning rule is to treat the pilot’s run cost as a floor and multiply it before you commit. Banks that skip this step tend to approve a build budget, watch the run cost climb through year one, and then face a renewal decision with no model for what steady state actually costs. A TCO built before the pilot ends avoids that corner.
For a high-risk system, compliance is a material and recurring share of TCO, not a rounding error. The European Commission estimated about a 17% overhead on AI spend across the economy, and sector analysis puts the initial conformity cost per high-risk system above 50,000 euros, with a quality management system running 20,000 to 80,000 euros to set up and a five-figure sum to maintain each year. Monitoring, auditing, and reporting account for a large part of the annual figure.
The number a bank should model depends on the system’s risk class and how much of the governance already exists. A bank with a running model risk framework reuses most of it and pays an increment per system. A bank starting from zero pays to build the framework once and the increment every time after. Either way, compliance belongs in the recurring half of the TCO model, reviewed whenever the model or its use changes.
Start from the five lines and fill them with the production assumption, not the pilot assumption. Estimate build once. Estimate each recurring line as an annual figure at full volume, then carry it across three years. Add a line for retraining and revalidation, because a model that never changes is not a production model in a bank. Name the owner and the headcount for the people line, since an unnamed owner is an unfunded one.
Then pressure-test the model against reality. Compare the run cost to the build cost: if run is smaller than build, the estimate is almost certainly too low. Check the compliance line against the system’s risk class under the EU AI Act. Confirm the people line names real roles. A TCO model that survives those three checks gives the board a number it can approve once and track against, which is the point of building it before the work starts.
Ableneo prices AI from production reality, because that is where our work lives. Of the AI projects Ableneo shipped in 2025, 4 of 5 reached production, and 94% use large language models, so our cost models come from systems that run under real volume and real supervision rather than from pilots that stopped at the demo. That track record, including a deployment that passed an ECB vendor security assessment, is why our TCO numbers hold up in front of a bank’s risk and finance functions. A fuller view of how that production discipline works sits across the Ableneo AI transformation FAQ. The lesson from 34 production projects is simple: the build is the cheap part, and a bank that budgets only the build will miss most of the cost.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.