Adoption is nearly universal. Production is rare.
Gartner projects that 40% of enterprise applications will feature task-specific AI agents by the end of 2026, up from under 5% in 2025, a genuinely fast curve for enterprise software. But adoption and production are different things. McKinsey's own survey data puts it plainly: only 23% of organizations report having scaled an agentic AI system into production, while 39% are still experimenting. That's the real story of 2026, not whether companies are trying agents, almost everyone is, but whether they can get past the pilot stage into something that runs unsupervised and actually holds up.
The governance gap is the bottleneck, not the technology
Here's the number that should worry every engineering leader running agents today: 82% of organizations already use AI agents, but only 44% have security policies in place to govern them. That gap isn't theoretical. A related figure from the same body of surveys reports that 80% of companies say their AI agents have already taken unintended actions, including accessing unauthorized systems and sharing sensitive data without authorization. An agent that can call APIs, write to databases, and make decisions without a human in the loop is a powerful tool and a real liability at the same time, and most organizations deployed the power before they built the controls.
Why so many projects are about to get cancelled
Gartner-attributed projections suggest more than 40% of agentic AI projects will be cancelled by the end of 2027, mainly over escalating costs, unclear business value, and inadequate risk controls, not because the underlying AI doesn't work. A more bullish vendor-sponsored survey from CrewAI reports 65% of organizations already using agents and an average of 31% of workflows automated, which sounds like the opposite story. Both can be true: plenty of organizations have agents running somewhere, and a large share of those same organizations haven't built the observability, audit trails, and governance that let an agent run safely past the pilot. The cancellation wave is coming for the ones that skipped that part.
What actually closes the gap
The organizations in the 23% who've scaled agents into production share a pattern: they treated governance as part of the build, not a compliance step added afterward. That means logging every agent action, scoping what each agent can actually touch, building an evaluation harness before launch instead of after an incident, and having someone whose job is explicitly to own the agent system's behavior over time, not just its initial deployment. That's closer to an operating partner than a one-time build, which is exactly why "who runs this after launch" is the question that separates the 23% from the other 77%.