Executive Summary
Agentic AI has moved from experiment to enterprise priority: every executive in a recent survey plans to expand adoption in 2026, and most are already using AI agents. But governance has not kept pace — only a fifth of enterprises say their oversight is mature. This gap, not deployment speed, is what now separates businesses that build lasting advantage from those that create new risk. This article explains where the real opportunity sits, what can go wrong, and how leaders should sequence their next 6–24 months of investment.
Estimated reading time: 11 minutes
Key Takeaways
- Agentic AI adoption is now close to universal at the enterprise level, but governance maturity is lagging badly behind — that gap is the defining strategic issue of 2026.
- Businesses that redesign workflows around human-agent collaboration create lasting advantage; those that simply automate existing processes on top of AI tend to amplify whatever was already broken.
- Governance is an investment that pays off, not a compliance cost — organisations that fund it properly report meaningfully stronger financial impact.
- Returns are real but uneven: a meaningful share of deployments hit payback in year one, but a similar share never pay back at all, so measurement discipline matters as much as the technology.
- Security is the most underfunded part of most agentic AI programmes, and a majority of organisations that have deployed agents have already had an incident.
- The businesses winning with agentic AI pick one well-defined job, prove it works, and expand from there — not the other way around.
The Strategic Challenge
Every technology cycle produces a moment when “should we adopt this?” turns into “how do we adopt this responsibly, before someone else out-executes us?” For agentic AI, that moment has arrived in 2026.
Unlike a chatbot or a writing assistant, an agentic system does not just respond to a prompt. It can plan a task, decide how to carry it out, act across multiple tools and systems, and keep working with limited human involvement. That is a meaningful shift in what businesses are actually deploying: not a smarter piece of software, but something closer to a digital employee with a defined job and a degree of independent judgement.
The scale of interest is no longer in question. A CrewAI survey of 500 C-level executives at large enterprises found that all of them plan to expand agentic AI adoption in 2026, roughly two-thirds are already using AI agents, and three-quarters see deployment as a critical strategic priority. IBM’s research points the same way: over half of organisations are actively building or deploying an agentic AI operating model, and most executives believe AI-driven decision-making will become a genuine source of competitive advantage.
What makes this a strategic challenge rather than a straightforward opportunity is the second half of the picture. Deloitte’s survey of more than 3,200 leaders across 24 countries found that only about one in five enterprises has mature governance for agentic AI. McKinsey found that nearly two-thirds of organisations point to security and risk as the biggest barrier standing between them and scaled deployment.
Ignoring this challenge has a cost either way. Move too slowly, and competitors that successfully redesign their operations around agentic AI can create a structural advantage that is hard to close later. Move too fast without the right guardrails, and the same research shows a real chance of ending up among the 65% of enterprises with deployed agents that have already experienced a confirmed security incident.
The strategic question for 2026 is not “should we use agentic AI?” It is “how do we capture the value without inheriting the risk?”
Who This Strategy Is For
Agentic AI strategy is relevant to a wide range of organisations, but the right starting point differs by size and maturity.
Best positioned to act now:
- Growing companies with well-defined, repeatable processes — customer service, finance operations, and document-heavy workflows are where the clearest early returns exist.
- Executive teams and department leaders who own a specific, measurable workflow and want to pilot without committing the whole organisation.
- Digital transformation teams already running structured pilots who need a governance framework to scale safely.
- Enterprise organisations with the budget to invest properly in both the technology and the oversight it requires.
Should proceed carefully, or wait:
- Small businesses without dedicated technical or operational resources may get more early value from proven, vendor-built agent products than from custom builds — the research shows vendor agents reach positive ROI roughly 2.4 times faster than custom-built ones.
- Organisations with weak or undocumented existing processes should be cautious. As Harvard Business Review’s analysis with Google Cloud puts it, when AI is introduced into a weak or fragmented system, it does not fix the system — it amplifies its flaws.
- Businesses without any executive ownership of AI risk should establish that ownership before scaling deployment, not after.
Current Landscape
Agentic AI adoption has accelerated well beyond the pilot stage for large enterprises, though the picture is uneven once you look past the headline numbers.
Gartner expects AI agents to be embedded in around 40% of enterprise applications by the end of 2026, up from under 5% a year earlier. By 2028, Gartner projects that 15% of day-to-day work decisions will be made autonomously by AI agents, compared with effectively none in 2024 — and that a typical Fortune 500 company could be running more than 150,000 AI agents.
At the same time, Gartner has been candid that much of the current activity is still exploratory. Gartner analyst Anushree Verma has described most agentic AI projects today as early-stage experiments or proofs of concept, often driven by hype and frequently misapplied — and the firm expects more than 40% of agentic AI projects to be cancelled by 2027, largely due to incompatibility with legacy systems.
Regulation is catching up quickly. The EU AI Act’s high-risk provisions take effect in August 2026, carrying fines of up to €35 million or 7% of global turnover for serious breaches. The US National Institute of Standards and Technology launched an AI Agent Standards Initiative in February 2026, and several international agencies have issued their own agentic AI guidance this year.
Quick Reference: Where Agentic AI Stands in 2026
| Metric | Figure | Source |
|---|---|---|
| Enterprises already using AI agents | 65% | CrewAI |
| Enterprises planning to expand adoption in 2026 | 100% | CrewAI |
| Enterprises with mature agentic AI governance | 21% | Deloitte |
| Enterprises citing security/risk as top scaling barrier | ~65% | McKinsey |
| Enterprise apps expected to embed AI agents by end of 2026 | 40% (from <5%) | Gartner |
| Agentic AI projects expected to be cancelled by 2027 | 40%+ | Gartner |
| EU AI Act high-risk provisions take effect | August 2026 | Kiteworks |
Future Signal Tip: Treat any “market size” figure for agentic AI with caution. Most published projections are secondary estimates rather than verified primary research — useful for direction of travel, not for budget planning.
Strategic Opportunities
The opportunity in agentic AI is not evenly distributed. It concentrates in workflows that are high-volume, rules-based, and currently consume significant human time.
Customer service currently shows the strongest evidence base. Digital Applied’s research points to roughly 4.2 times productivity gains, payback periods around four months, and sharp reductions in cost per task. Klarna’s agentic customer service system reportedly handled 2.3 million conversations a month and produced $40–60 million in annual benefit — though, importantly, Klarna later rehired human agents after customer satisfaction slipped, a detail worth holding onto (more on that below).
Software engineering workflows, particularly code review, show similarly strong results — around 3.6 times productivity gains and dramatic reductions in cost per task. Duolingo reportedly cut its code review time from three hours to one.
Knowledge management and document-heavy work is another strong candidate. Morgan Stanley reported 98% adviser adoption of its AI research tools and cut research synthesis time from over 30 minutes to seconds. JPMorgan is reportedly running more than 450 AI use cases across 200,000 employees.
Finance operations, especially accounts payable, show some of the most dramatic reported gains: cost reductions around 76%, automation rates above 90%, and reconciliation work dropping from three hours to two minutes in some cases.
Beyond individual workflows, 60% of organisations surveyed by IBM say they are planning next-generation delivery structures where agents coordinate across finance, supply chain, HR, procurement, and customer service — a shift from point solutions to genuinely cross-functional orchestration.
The organisations capturing the most value share one trait: they treat agentic AI as a way to redesign how work gets done, not simply a faster way to do what they were already doing. HBR and Google Cloud’s analysis frames this as the central strategic distinction of the current cycle — organisations that rewire operations around human-agent collaboration can decouple value creation from headcount growth; those that just automate existing processes tend to get incremental speed at best.
Strategic Risks
The opportunity is real, but so is the risk, and the research is unusually clear that most organisations are underestimating it.
Governance immaturity. Deloitte’s finding that only 21% of enterprises have mature agentic AI governance means the large majority are deploying agents without reliable real-time monitoring, clear decision boundaries, or complete audit trails.
Security exposure. Roughly $1 is currently spent on AI security for every $750 spent on AI capability, according to Speakeasy’s research. That imbalance shows up in outcomes: 65% of enterprises with deployed agents report having had a confirmed security incident, and in breached organisations, 97% lacked proper AI access controls.
Loss of containment. Kiteworks’ research found that 63% of organisations cannot enforce purpose limitations on their AI agents, 60% cannot terminate a misbehaving agent, and 55% cannot isolate AI systems from the rest of the network. In practice, this means many businesses have deployed systems they cannot fully monitor, correct, or shut down if something goes wrong.
Regulatory exposure. With the EU AI Act’s high-risk provisions taking effect in August 2026, and fines of up to €35 million or 7% of global turnover, regulatory risk is no longer theoretical for any business operating in or selling into the EU.
Financial disappointment. MIT’s research found that 95% of generative AI pilots produce no measurable P&L result, and separate research puts the share of agentic AI deployments that never reach payback at 19%. This is a real risk to budget credibility if projects are launched without clear success metrics from day one.
Change management and customer experience. Klarna’s experience is instructive here: after leaning heavily into AI-driven cost reduction in customer service, the company rehired human agents once customer satisfaction scores slipped. It is a useful reminder that cost reduction and customer experience need to be managed together, not treated as automatically aligned.
Callout — The Governance Payoff: McKinsey’s research is the strongest single data point in this space: organisations investing $25 million or more in responsible AI are far more likely to report EBIT impact above 5%. Read literally, this suggests governance should be budgeted as a growth investment, not filed under compliance overhead.
Decision Box
Act now if: you have one well-defined, high-volume workflow (customer service, finance ops, document review) and can assign clear ownership of AI risk before you start.
Pilot first if: the business case looks strong but your organisation hasn’t yet tested agentic AI in production, or governance processes are still being built.
Wait if: underlying processes are undocumented or inconsistent — fix the workflow before automating it, or AI will scale the problem, not solve it.
Monitor if: you operate in a heavily regulated sector awaiting EU AI Act clarity, or your industry has limited verified ROI evidence so far.
Implementation Roadmap
A structured, staged approach reduces the two biggest failure modes seen in the research: deploying too fast without oversight, and never deploying at all because of analysis paralysis.
- Assess readiness. Audit current processes, data quality, and existing automation before selecting any technology. Identify who currently owns AI risk decisions — if no one does, that is the first gap to close.
- Define objectives. Set a specific, measurable outcome for each proposed use case (hours saved, cost per task, cycle time) before selecting a vendor or tool. Avoid vague goals like “improve efficiency.”
- Select technologies. Weigh build versus buy carefully. The research shows vendor agents reach positive ROI roughly 2.4 times faster than custom builds — a meaningful consideration for organisations without deep in-house AI engineering capacity.
- Pilot implementation. Choose one bounded, well-understood workflow rather than attempting to automate an entire department. Set a decision point — commonly around 90 days — to evaluate results against the objectives set in step 2.
- Measure outcomes. Track the metrics defined at the start, not just adoption or usage. Distinguish productivity gains from actual P&L impact.
- Scale successfully. Expand only once the pilot has demonstrated clear, measured value and the governance framework can support additional agents. This is also the point to introduce cross-functional orchestration if multiple workflows are ready.
Implementation Checklist
- Executive-level ownership of AI governance is assigned
- Current processes have been audited before automation begins
- Each pilot has a specific, measurable success metric
- A build-vs-buy decision has been made deliberately, not by default
- A 90-day (or similar) review point is scheduled before scaling
- There is a documented way to monitor, limit, and shut down each agent
- Customer experience metrics are tracked alongside cost metrics
Common Mistakes
Automating a broken process instead of redesigning it. Applying AI to a process that was already inefficient tends to produce a faster version of the same problem. Review the workflow itself before automating it.
Trying to automate an entire department at once. The research is consistent: bounded use cases with a measurable before-and-after succeed far more often than department-wide rollouts attempted in one step.
Treating governance as something to add later. Waiting until after deployment to build monitoring, audit trails, and containment controls is a major contributor to the 65% security incident rate seen in the research. Build governance alongside the pilot, not after it.
Optimising for cost over customer experience. Klarna’s decision to rehire human agents after an AI-first approach hurt satisfaction scores is a useful cautionary example for any business considering an aggressive cost-cutting deployment.
Measuring adoption instead of business impact. High usage numbers do not guarantee financial return. With MIT finding that 95% of generative AI pilots produce no measurable P&L result, tying every pilot to a concrete financial or operational metric from the outset is essential.
Success Metrics
Organisations should track outcomes that connect directly to business performance, not just usage statistics.
| Category | What to Measure |
|---|---|
| Productivity | Hours saved per employee or team per week |
| Cost | Cost reduction per task or per workflow |
| Speed | Time-to-value for each pilot (vendor vs. custom-built) |
| Financial | Direct P&L impact, not just efficiency gains |
| Customer | Customer satisfaction alongside any cost-driven changes |
| Risk | Number and severity of security or containment incidents |
| Adoption | Employee adoption rate, balanced against actual outcomes |
Digital Applied’s research found a median of 6.4 hours saved per knowledge worker per week, but with wide variation by function — customer service functions saw around 4.2 times productivity gains, while legal functions saw closer to 1.4 times. Set expectations by function, not by a single company-wide benchmark.
Future Outlook
Confirmed developments: The EU AI Act’s high-risk provisions take effect in August 2026. NIST’s AI Agent Standards Initiative, launched in February 2026, has an open request for information that closed with 932 comments, with final standards still pending.
Industry expectations: Gartner projects that AI agents will be embedded in roughly 40% of enterprise applications by the end of 2026, and that 15% of day-to-day work decisions will be made autonomously by 2028. Gartner also expects more than 40% of current agentic AI projects to be cancelled by 2027, primarily due to legacy system incompatibility — a sign that the current wave of deployments will likely consolidate around what actually works.
Editorial interpretation: The direction of travel — from AI as an assistant to AI as an operating layer for entire workflows — looks well supported by the research. What remains genuinely uncertain is the pace at which governance and regulation catch up, and how many of today’s deployments survive the shift from pilot to scaled, audited operation. Businesses that treat the next 12–24 months as a governance-building period, not just a deployment race, are best placed regardless of how quickly the technology itself moves.
The Future Signal
The signal here is not that agentic AI works — the evidence on that is already strong. The signal is that deployment speed is no longer what separates winners from losers. Governance maturity is.
McKinsey’s finding that $25 million-plus responsible AI investors are far more likely to see EBIT impact above 5% is the clearest evidence in this research set that oversight is not a brake on value — it is a precondition for it. Businesses chasing fast deployment without matching investment in monitoring, containment, and accountability are, on the current data, more likely to end up among the 65% with a security incident or the 19% that never reach payback than among the success stories.
For most businesses, the practical takeaway is to stop asking “how fast can we deploy agents?” and start asking “what is the one workflow where we can prove value safely, and what does the governance for that workflow need to look like before we scale it?”
What can safely be ignored, for now, is the race to deploy the largest number of agents. Gartner’s own data suggests a large share of today’s projects will not survive contact with legacy systems and unclear governance. Depth and discipline on a small number of use cases will outperform breadth for most organisations in this cycle.
What Businesses Should Do Next
- Assess readiness by auditing current processes and identifying who owns AI risk decisions today.
- Develop a focused roadmap built around one or two bounded, measurable use cases rather than an organisation-wide rollout.
- Launch a pilot in a function with strong existing evidence — customer service, finance operations, or document-heavy knowledge work are the best-supported starting points.
- Establish governance — real-time monitoring, clear decision boundaries, and the ability to limit or shut down an agent — before scaling beyond the pilot.
- Train leadership on what agentic AI can and cannot do, so investment decisions are based on evidence rather than vendor claims or hype.
- Review current processes before automating them, since AI tends to amplify whatever process it is layered onto, for better or worse.
Frequently Asked Questions
What is agentic AI, in plain terms? It is AI that can plan a task, take action across multiple tools or systems, and complete a job with limited step-by-step human input — closer to a digital employee with a defined role than a chatbot that only responds when prompted.
Is agentic AI only relevant to large enterprises? No, but the way you approach it should differ by size. Larger enterprises have the resources to build custom systems and dedicated governance teams. Smaller businesses often get faster, safer results from proven vendor products, since the research shows vendor agents reach positive ROI roughly 2.4 times faster than custom builds.
Should we build our own agents or buy from a vendor? For most businesses without deep in-house AI engineering capacity, buying from an established vendor is the lower-risk starting point. Reserve custom builds for workflows that are genuinely unique to your business and where an off-the-shelf product does not fit.
How do we know if a pilot is actually working? Set a specific, measurable metric before you start — hours saved, cost per task, or a similar figure — and review it against a fixed timeline, commonly around 90 days. Usage or adoption numbers alone are not sufficient; tie every pilot to a financial or operational outcome.
What is the biggest risk most businesses are underestimating? Security and containment. The research shows a majority of enterprises with deployed agents have already had a confirmed incident, and most cannot fully monitor, limit, or shut down a misbehaving agent. This is worth addressing before scaling, not after.
Does agentic AI replace the need for good processes? No — the opposite. AI tends to amplify existing processes, whether they are strong or weak. A poorly designed process automated with AI is likely to produce a faster version of the same problem.
How fast should we be moving on this? Fast enough to run a well-governed pilot in the next few months, but not so fast that governance is treated as an afterthought. The strongest evidence in the research favours organisations that pair deployment with real investment in oversight.
What should we watch over the next year? The EU AI Act’s high-risk provisions taking effect in August 2026, the finalisation of NIST’s AI Agent Standards, and how many of the current wave of agentic AI projects survive contact with legacy systems — Gartner expects more than 40% will be cancelled by 2027.
Conclusion
Agentic AI has crossed from experimentation into an accepted part of how businesses expect to operate — the adoption numbers make that clear. But the research is just as clear that adoption alone does not create advantage. The businesses seeing real financial impact are the ones investing in governance as seriously as they invest in the technology itself, choosing one bounded workflow to prove value before scaling, and measuring outcomes rather than usage.
The practical next step for most business leaders is not to ask how many agents to deploy this year. It is to pick one process that is well understood, define what success looks like in measurable terms, and build the oversight needed to run it safely — before deciding what comes next.
