AI control tower: what a mid-size company can expect

Where the word comes from #

At an airport, the control tower sees every aircraft, whatever its airline. It flies none of them. It knows who is where, who is cleared, and who is coming in.

The word is used more and more for AI in companies, for the same reason: there are now too many AIs, from too many vendors, for anyone to keep track of them from memory.

Why the question comes up now #

Two recent facts show what a company cannot see without a control tower.

The first: AI gets turned on without a decision. In Microsoft 365 Copilot, the setting that runs Anthropic's models in Word, Excel and PowerPoint is on by default for European tenants created after March 25, 2026, with processing outside the European Union Data Boundary (Microsoft documentation updated on October 23, 2026). Nobody in the company had to say yes.

The second: AI gets added without a contract. In Sweden, the internal audit at Trafikverket, the transport administration, found in 2026 a widespread use of about ten different AI services (Ekot, October 23, 2026). The Swedish government drew a simple rule from it: no contract, no access. We covered that decision in detail.

In both cases, the problem is not AI. It is that nobody keeps the list.

What an AI control tower should show #

1. Everything in place, whatever the vendor: features turned on in the suites, assistants, agents, applications connected by employees.
2. What changed, and when: the feature turned on by default, the new model behind a tool, a vendor's modified terms.
3. What AI costs, all vendors combined, including what is billed by usage and has no cap.
4. What each tool reads, the model running behind it, and where the data is processed.
5. Who decided on each tool and each setting, with the date.

What it does not do #

• It does not fly your tools. It reads logs and configurations; it changes no setting on your behalf.
• It does not rate your AI. It counts and it dates; the decision stays with the company.
• It does not replace your security tools. Blocking an agent or filtering a request is a different job.

Who runs the tower #

The large platforms are announcing their own control towers, often with AI vendors as partners. For a large account that already lives on one of them, that is a natural next step.

For a mid-size company, two points deserve attention. A tower tied to a platform sees first what goes through that platform. And when the vendors being governed are also partners of the one governing, the controller and the controlled work together. That is not a flaw in itself. It is a fact to know before choosing.

Five questions before choosing one #

1. Does it see all your vendors, or only those on its platform?
2. Does it read from your tools, or ask you to declare what you have?
3. Can it change your settings, or does it only read them?
4. Where is the data it collects processed and hosted?
5. Does whoever provides it also sell AI, or have ties to vendors?

Where to start on Monday #

You do not need to buy anything to start. Ask your administrator for the list of AI features turned on in your two or three main suites, with their activation date. Ask your finance team what AI cost you over twelve months, all vendors combined. If nobody can answer within a day, you know what is missing.

You are not behind. You do not know where you stand. That is where it starts.

To see in ten minutes what AI costs you and what is already turned on, request your free statement: ojja.ai/releve