Executive Summary

As JPMorgan set its 2026 technology budget at roughly $19.9 billion, it quietly rewrote where the AI spending inside it lives on the ledger. Until now, AI sat in the "discretionary innovation" column, the line that gets cut first when results disappoint. It now sits next to data centers, payment systems, and core risk controls — the non-negotiable infrastructure a bank cannot run without. This piece looks at what that move actually means.

Jamie Dimon says the investment has already paid for itself. But when you trace where the returns come from, it isn't the flashy customer-facing AI. It's internal plumbing: contract review, coding, and summarization. A single contract-review tool, COiN, erased about 360,000 hours a year. On the other side of the ledger, the cost-to-value ratio against the full tech budget is roughly 12:1, and an MIT study found that 95% of enterprise generative-AI pilots produced no measurable financial impact.

What separated the teams that delivered from the teams that didn't was not model access. It was clean data, clearly owned data products, measurable evaluation, and access granted to agents more narrowly than to people. The moment AI crosses from experiment to plumbing, what an organization needs first isn't a bigger model. It's tidier data and a tighter door.

$19.9B

2026 tech budget

~$2B of AI reclassified as "core infrastructure"

360,000 hrs

COiN annual savings

ROI comes from internal plumbing, not flashy apps

12:1

cost-to-value ratio

"Buying optionality, not printing money" — a fair read

90%

over-privileged AI agents

Core infrastructure presumes tighter access control

1

AI Left the "Experiment" Column and Sat Beside the Data Center

JPMorgan set its 2026 technology budget at roughly $19.9 billion (call it about $20 billion). That's up around $1.2 billion year over year, and a large share of the increase flows to AI. What stands out is not the figure but the placement. The world's largest bank pulled roughly $2 billion of AI spending out of the discretionary innovation category and stood it in the same line as data centers, payment systems, and core risk controls. It has started to treat AI as a non-negotiable priority on par with cybersecurity and operational resilience.

Moving a line on the ledger is more than notation; it is a declaration. Spending justified as discretionary experimentation is the first thing cut when performance slips. Spending classified as core infrastructure survives the cost-cutting cycle. It's the same logic that keeps a bank from saying "returns are unclear this year, so let's switch off the payment network or risk controls for a while." Writing AI next to those lines means the organization sees it not as an option to toggle on and off, but as plumbing you don't shut down.

Same budget, a different column AI spending moved from the "experiment" column to the "can't-run-without-it" column Discretionary innovation Cut first when results slip AI, before (experiment budget) Core infrastructure (non-negotiable) Data centers Payments Risk controls AI, now Sources: crypto.news, Banking Exchange (2026) | Original diagram by Pebblous
▲ The placement, not the amount, is the news. AI is now recorded next to spending the bank can't switch off | Original diagram by Pebblous

"It's become core infrastructure" is not a congratulation. It's an invoice. It means the same standard of stability, auditability, and data quality demanded of a payment network or risk controls now applies to AI as well. Moving the budget column is, in effect, a bill for maturity.

2

The Money Paid Back in the Plumbing, Not the Spotlight

Jamie Dimon believes the investment has already paid for itself. Across more than 150,000 employees, the bank reports about $2 billion in operational savings and productivity gains of 10–11% in engineering, operations, and fraud detection. Staff who use the internal LLM every week report saving roughly four hours a day. CFO Jeremy Barnum adds that "machine-learning analytics is improving revenue and operations across multiple lines of business."

JPMorgan Chase Tower in Houston — symbol of the bank's scale, where a secured in-house LLM was handed to more than 150,000 employees as the backbone of its enterprise AI strategy
▲ JPMorgan Chase Tower, Houston — the physical scale behind handing a secured in-house LLM to more than 150,000 employees | Source: Wikimedia Commons (CC BY-SA 3.0)

But where exactly those returns came from is the first twist in this story. The customer-facing chatbots get the attention, yet the real savings came from unglamorous internal plumbing. COiN, which automated contract review, erased about 360,000 hours a year of work that lawyers and reviewers used to grind through. Coding assistants lifted development productivity by 10–20%. From meeting summaries to email drafts to document processing, most of the wins came on the side of repetitive work. More than 600 use cases in production generate an estimated $1.5–2 billion a year in value.

These scattered wins share one common denominator: every one of the 150,000 employees was handed a secured, in-house LLM. Not a single flashy breakthrough in one department, but a safe tool everyone uses daily, gradually re-fitting the plumbing of routine work. Why that matters becomes clear later. As the tool spread across the whole company, the variable that actually decided who saved money wasn't the tool itself — it was how trustworthy the data the tool fetched turned out to be.

For balance, look at the other side too. There's a calculation showing that cumulative AI investment to date far exceeds the value created. Measured against the entire tech budget, the cost-to-value ratio lands around 12:1. One analysis reads that number as "JPMorgan isn't printing money; it's buying enterprise-scale optionality." Layered over MIT's 2025 finding that 95% of enterprise generative-AI pilots produced no measurable financial impact, Dimon's confidence starts to look more like an exceptional achievement. The question is what conditions made the exception possible.

Returns don't come from the demo. They come from the plumbing of repetitive work. And for that plumbing to actually save money, the data flowing through it has to be trustworthy. That's where the next section's question begins.

3

What Separated the Returns Was the Data Layer, Not the Model

The conclusion that reports analyzing JPMorgan keep returning to fits in one line: durable AI success is not achieved at the surface application layer. It requires deep, sustained, and usually unglamorous investment underneath — modern cloud, robust data governance and pipelines (JADE), a scalable ML platform (OmniAI). Bolting AI onto brittle legacy is a recipe for failure. The gains concentrated not in the teams that bought a bigger model, but in the teams that put the foundation in order.

At the heart of that foundation sits the question of data ownership, which JPMorgan learned about the expensive way. A centralized data team creates a bottleneck. Sales asks for a report, IT answers "three months," and because no one is accountable for accuracy, data quality erodes. So the bank moved to a Data Mesh. Sales owns sales data, support owns tickets, finance owns transaction records. Each team treats its data like a product and publishes cleaned datasets as APIs. Once ownership became clear, someone became accountable for quality.

Which layer produced the returns Not the visible app, but the data layer holding it up Application layer (flashy but shallow) Data ownership · Data Mesh (as a product) Data governance · pipelines (JADE) Measurable evaluation · KPIs (test/control) Source of ROI
▲ The returns came not from the app layer but from the foundation: ownership, governance, and evaluation | Original diagram by Pebblous

The evaluation discipline tells the same kind of story. JPMorgan sets very explicit success targets and KPIs for each rollout. It gives the tool to only some teams and measures the incremental gain against test/control groups. It learns what works and what doesn't from numbers, not gut feel. What's interesting is the bank's stance on governance. By extending its investment in ethical AI, bias mitigation, and security all the way to its vendors, it turned what could have been a regulatory liability into a strategic lever for faster deployment. Governance wasn't the enemy of speed. It was the condition for it.

This is the part that matters most to Pebblous readers. If you want AI ROI, the first thing to put in order isn't a list of models. It's data ownership and an evaluation system. Who is accountable for the accuracy of this data, and how do you measure whether this deployment actually delivered a gain? If you can't answer those two questions, no model you bolt on will stop the plumbing from leaking.

4

Agents Get a Narrower Door Than People

AI becoming plumbing means it no longer stops at generating text; it actually takes action. Agents call systems, receive delegated permissions, and execute things in real time. JPMorgan's engineering blog notes that this difference extends the attack surface well beyond model parameters. So the principle the bank prescribes is to align safeguards to capability and risk. A limited, read-only agent needs only light guardrails, but an agent that combines untrusted-input handling, sensitive-data access, and external action authority in one body — the so-called "lethal trifecta" — demands strong, continuous control. The more those three combine, the larger the blast radius of an incident.

Reality runs the other way. One survey found 90% of deployed AI agents were over-privileged, and at many firms non-human identities (NHIs) outnumbered human ones by 144:1. At one large financial institution, roughly 50,000 human accounts sat alongside 4.2 million non-human identities. Two-thirds of organizations, by one assessment, apply weaker controls to agents than to people. Persistent, over-scoped credentials are exactly what turn a trivial prompt injection into a serious breach.

Data center server racks — the infrastructure AI agents call and execute against in real time. With 90% of deployed agents over-privileged and non-human identities outnumbering humans 144:1, access control is the critical variable
▲ Data center infrastructure — AI agents call and execute against systems like these in real time. An over-privileged agent turns a trivial prompt injection into a serious breach | Source: Wikimedia Commons (CC BY-SA 3.0 / GFDL)

The prescription is clear. Treat agents as first-class identities. Give each an owner, a purpose, and a measurable access scope; make least privilege and just-in-time (JIT) access the default; scope permissions to the task; and use dedicated identities and time-boxed tokens instead of shared credentials. One common misconception is worth clearing up, though: you don't need to invent entirely new tooling for this. Most analysts advise extending your existing identity, access, and lifecycle governance to cover agents. The core message isn't "third-party vs. build-your-own" — it's to treat agent permissions as an identity decision, not a software decision.

AI that has become core infrastructure demands not a bigger model but a tighter access boundary. Give people broad discretion if you must, but give agents that act on their own a narrower door than people — that's the valve that keeps the plumbing flowing safely.

5

So What You Need Now Isn't a Bigger Model

Fold JPMorgan's story into a single line and it reads like this. Moving AI from the experiment column to the core-infrastructure column is a symbol, but what turned that symbol into results was the foundation. The 360,000 hours saved on contract review, and the logic that justifies a 12:1 cost ratio as optionality value, only hold up on top of clean data, clear ownership, measurable evaluation, and agent access control. Without that foundation, $19.9 billion is just a big number.

So for any decision-maker trying to map this case onto their own organization, the question narrows to one. Before we expand model access, did we put the data and the doors in order first? Who is accountable for the accuracy of this data; how do we measure whether this deployment actually delivered a gain; and did we truly grant agents that act on their own narrower permissions than people? Only when you can answer "yes" to those three does moving the AI budget's column finally mean something.

Editor's note. The conclusion of this piece rests entirely on one point: the precondition for AI becoming plumbing is data and access control. If you're interested in the problem of shaping data into a form AI can trust, we'd suggest the AI-Ready Data perspective Pebblous has been working on.

R

References

Official Sources (JPMorgan Primary)

Industry & News

Analysis & Expert Reports