Governance Is the Next AI Battleground

AI is becoming part of everyday hospitality, bringing new opportunities alongside questions about cost and accountability. As its use expands, hotels need a clearer understanding of what their systems are doing, and whether they are delivering true value.

From AI adoption to accountability

Hospitality has spent the last two years asking whether to adopt AI. That question is largely answered. 91% of hotel chains are already using it, with another 8% planning to within two years.

The question that matters now is different, and far harder: can you prove what your AI actually did, and why?

At IHIF NYU 2026, this shift had a name. Enterprise-wide AI adoption is accelerating, but it's arriving faster than the systems built to govern it. The smartest hotel brands are deploying dozens of AI-powered workflows across reservations, revenue management, marketing, finance, and guest communications. Few of them can yet answer a basic operational question:

Which model touched this decision, what data did it use, and what did it cost to run?

That gap is becoming the real competitive line in hospitality technology. Not who has the most AI. Who can govern it.

From "adoption" to "absorption"

Hyatt's SVP of Data and AI, Pat Nestor, put this plainly at a recent industry event: "In the early days, everything was measured in hours saved. OK, great. That's helpful in terms of your own personal efficiency. But where does that live on a P&L sheet?"

Hyatt has deliberately shifted its internal language from adoption to absorption. The distinction matters. Adoption asks whether a tool is being used. Absorption asks whether the organisation is actually extracting value from it, and whether anyone can demonstrate that value in financial terms. Nestor expects far more scrutiny on this through 2026.

He's not alone. A recent survey of 404 hotel IT decision-makers found that while 37% of AI users report increased room revenue and 20% report lower operating costs, most hotels still expect their IT budgets to rise at least 10% next year. Spend is climbing faster than proof is arriving. That imbalance is exactly what a governance layer is designed to correct.

What a governance layer actually is

"AI governance" has become a loose term covering everything from ethics policy to data privacy. In practice, for the infrastructure we design, it means something specific and operational. A governance layer is the system that sits between your AI tools and your core hotel infrastructure, and it answers four questions continuously:

Which model or agent performed this task? As hotels deploy multiple AI agents across departments, often from different vendors, running on different underlying models, nobody can rely on memory to track which agent handled which workflow. That has to be logged automatically.

What data did it access? An AI agent drafting a guest response doesn't need the same data access as one adjusting room rates. Scoped, auditable permissions are the difference between a tool that assists and a tool that becomes a liability.

What did this workflow cost? This is where "token creep" lives, and it's worth defining properly.

Can you reconstruct what happened, after the fact? If an AI-driven pricing decision, guest communication, or operational change needs to be reviewed six months later, can you show what triggered it and what data it was based on? Most hotel systems today cannot.

This is the emerging category the industry is now calling Agent Management Platforms, or AMPs. As hotels deploy more agents across multiple frontier models or their own smaller, purpose-built models, an AMP becomes the layer that decides which model performs which task, what data it can access, and how much each workflow costs. Expect AMPs to become one of the most significant new software categories in hospitality technology over the next two years, not because they're exciting, but because without them, nothing else scales safely.

The industry has already started formalizing this.

The AI Hospitality Alliance recently published a five-pillar AI governance framework covering accountability, data security, vendor oversight, and AI agent behavior, built specifically for hotel operators and designed to apply regardless of property size. Alongside it, a fourteen-question procurement checklist now exists for operators evaluating an orchestration layer before they buy or build one, covering everything from permission scope to exit terms to who owns written evidence that a system actually works as promised. The fact that this now exists as a formal framework, rather than ad hoc advice, is itself a signal: governance has moved from "nice to have" to "expected baseline."

Token creep, explained

Token creep is what happens when AI costs rise steadily and invisibly because nobody is tracking workflow-level spend.

Most AI tools are priced per token, the unit of text or data a model processes. A single customer service exchange might consume a few hundred tokens. A complex revenue management query touching multiple data sources might consume tens of thousands. Individually, these costs look negligible. At scale, across dozens of agents running continuously across a property or a portfolio, they compound into a cost center with no clear owner and no easy way to audit.

This is precisely the blind spot Hyatt's Nestor was describing. Hours saved is a real benefit, but it's not a line item. Token spend is a real cost, and without governance, it's not a line item either; it just erodes margin quietly in the background of a cloud services bill.

There's a useful metric emerging to address this directly: Token Cost Per Guest. If an AI system costs the equivalent of one dollar in tokens for every guest it touches, has the value it generated, in labor saved, in upsell revenue, in guest satisfaction, actually justified that dollar? Without a governance layer tracking cost per workflow, that question is unanswerable. With one, it becomes a standard line in every technology review.

Why hotels still don't trust AI with autonomy

There's a pattern we see constantly in the infrastructure we design, and it echoes what the data shows industry-wide. Hotels are increasingly comfortable trusting AI to draft, summarise, and suggest. But far fewer are willing to let it act autonomously.

That hesitation isn't irrational. It's a direct response to the absence of audit trails. If an AI system adjusts a room rate, responds to a guest complaint, or flags a maintenance issue, and something goes wrong, most hotels today cannot reconstruct what happened or who is accountable. CISOs surveyed for the 2026 hospitality security landscape identified data leakage through public AI tools (74%), insider misuse and shadow AI adoption (56%), and insufficient governance policies (49%) as their top three AI-related concerns. These are not hypothetical risks. They are the direct consequence of deploying AI without the infrastructure to govern what it touches.

Governance and audit trails are what make autonomy viable. Not as a compliance afterthought, but as the precondition for ever trusting these systems with real operational authority.

What this means for how we specify infrastructure

We've said before that the AI layer is rarely the bottleneck in a hotel's technology stack. The systems beneath it are. Governance is the clearest expression of that principle yet.

When we design the infrastructure behind a property's AI deployment, governance isn't a separate conversation from the network, the data layer, or the integration architecture. It's specified at the same time, because it depends on the same foundations:

• A unified data layer that AI can act on safely, with clear boundaries on what each system and each agent can access

• Logging and audit infrastructure built in from day one, not retrofitted after an incident

• Clear ownership for every AI-driven workflow, the same way every physical system needs a business owner

• Cost visibility at the workflow level, not just the subscription level

  
  

The brands that win the next phase of hospitality AI won't be the ones who deployed the most agents first. They'll be the ones who can prove, to an owner, a guest, or a regulator, exactly what their AI did and why. That proof doesn't come from the AI. It comes from the infrastructure underneath it.

Concluding Notes

As AI becomes part of everyday hotel operations, adoption alone tells us less about its value. The harder questions concern what these systems deliver, what they cost and who is accountable when they act.

Governance brings those questions together. Clear permissions, traceable decisions and visibility over spending give operators a basis for deciding where AI can work autonomously and where human oversight remains essential. The next phase of hospitality AI will depend on how confidently hotels can understand, manage and justify its use.