Deloitte Surveyed 3,235 Enterprises:
Only 21% Have Mature Agent Governance

In July 2026, Deloitte released its 7th annual State of AI in the Enterprise report. It surveyed 3,235 global executives across 24 countries and every major industry, which makes it one of the largest enterprise AI governance surveys ever conducted. The core finding: 79% of enterprises lack mature agent governance.

The 79% Gap

The survey of 3,235 enterprise leaders across 24 countries found:

A 79% governance gap means 4 out of 5 enterprises are deploying AI agents without systematic control frameworks: no agent inventory, no unified permission management, no cross-vendor compliance mapping, no cost attribution.

Three Big 4 Firms, One Conclusion: Cross-Validated

Deloitte's data isn't an outlier. In the first half of 2026, two other Big 4 firms published independent surveys reaching highly consistent conclusions:

Three Big 4 firms, three different methodologies, three independent research teams, all converging on the same conclusion. That makes it an industry-wide consensus rather than one firm's opinion.

Why Don't 79% of Enterprises Have Governance?

Deloitte's report reveals several root causes:

• Speed mismatch: AI agent deployment outpaces governance by months. A team can create an agent via API in days; building cross-department governance takes months
• Vendor fragmentation: Enterprises use multiple AI vendors (OpenAI, Anthropic, Google, open-source), each with different management interfaces, permission models, and compliance standards
• Talent shortage: Professionals who understand AI technology, compliance requirements, and business risk simultaneously are extremely scarce
• Priority misalignment: Most AI investment focuses on model selection and use case development; governance is treated as a "deal with it later" problem

The Cost of the Governance Gap Is Already Visible

When governance capability lags behind adoption speed, the costs are already materializing:

• Security risk: Agentjacking attacks succeed in 85% of test environments; MCP tool calls lack standardized audit logs
• Compliance risk: EU AI Act Article 50 transparency obligations take effect August 2, 2026, with fines up to 7% of global annual revenue. 78% of EU enterprises have material compliance gaps
• Financial risk: KPMG finds only 26% of enterprises have real-time AI cost visibility. AI bills are surging without attribution mechanisms
• Business risk: A 79% governance gap means AI projects stall at the pilot stage, because security won't approve and compliance can't sign off

Governance and Growth Go Together

Deloitte's core thesis: "governance and growth go together." Successful enterprises don't "grow first, govern later" or "govern first, grow later": they start with low-risk use cases, build governance capability in parallel, and scale deliberately.

IBM's data supports this: governance-embedded enterprises deploy 16x more agents with 18% higher margins. Governance is an accelerator.

For enterprises planning AI agent deployment, Deloitte's survey provides a clear roadmap:

1. Inventory: Build a complete agent inventory, so you know which agents are running, who's using them, and what data they access
2. Classify: Categorize agent use cases by risk level. Fast-track low-risk work and build controls for high-risk.
3. Framework: Establish a cross-vendor unified governance framework that covers strategy, compliance and FinOps.
4. Automate: Embed governance into the agent development and deployment pipeline, not as a post-hoc check

Sources

Business and IT leaders report AI agents are scaling faster than their guardrails (Deloitte's 2026 State of AI in the Enterprise), Deloitte Insights, 2026, for "3,235 information technology and business leaders from 24 countries", "only 21% say their organizations have a mature governance model in place for agentic AI", the 79% gap, and "by 2027, 74% of respondents expect their companies to be using AI agents at least moderately": deloitte.com/us/en/insights/topics/emerging-technologies/ai-agents-scaling-faster.

New IBM Study Finds CIOs and CTOs Face Growing AI Control Gap as Enterprise Deployment Scales, IBM Institute for Business Value with Oxford Economics, 2026, for "77% of organizations report AI adoption is already outpacing current governance capabilities", "deploy 16x more AI agents" and "18% higher operating margins": newsroom.ibm.com/2026-06-08-new-ibm-study-finds-cios-and-ctos-face-growing-ai-control-gap-as-enterprise-deployment-scales.

AI Act — regulatory framework, European Commission, 2026, for "the transparency rules of the AI Act will come into effect in August 2026" and for national authorities and the AI Office enforcing the Act from 2 August 2026: digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai.