Deloitte's 2026 State of AI in the Enterprise survey of 3,235 leaders found nearly 75% of companies plan to deploy agentic AI within two years and 85% expect to customize autonomous agents for their business, but only 21% currently report a mature governance model for managing them. McKinsey's 2026 Global AI Trust Maturity Survey confirms the same gap from another angle: "Agentic AI Controls" is the lowest-scoring governance dimension McKinsey tracks, and only about 1 in 3 organizations have governance maturity adequate for the agents they are already running. The fix is not a compliance department or a policy binder. It is five concrete controls, and this article is the checklist a non-technical executive can act on before scaling further.
If governance is the gap holding your rollout back, see how we run responsible AI governance and risk engagements built directly around this data. The checklist below is yours to use either way.
How big is the AI governance gap right now?
Big, and getting bigger faster than most companies are closing it. Deloitte's survey, run across 3,235 business and IT leaders in 24 countries and 6 industries between August and September 2025, found workforce access to AI tools jumped from under 40% to about 60% in a single year. Adoption is not the bottleneck anymore. Governance is: only 21% of companies report having a mature model for governing autonomous agents, even as nearly 75% plan to deploy them within two years.
McKinsey's independent 2026 Global AI Trust Maturity Survey puts a number on exactly where that maturity is weakest. Responsible-AI maturity averaged 2.3 out of 4 in 2026, up from 2.0 in 2025, real progress. But broken into dimensions, "Agentic AI Controls" scores the lowest of all at roughly 2.0, behind Data & Technology (2.6), Risk Management (2.4), Strategy (2.3), and Governance (2.2). Every other part of the organization is maturing faster than its ability to actually control what its agents do. Only about 1 in 3 organizations, per McKinsey, have governance maturity adequate for the agents they have already deployed, not the ones planned for next year.
Why is agentic AI governance different from regular AI governance?
Because an agent does not just produce an output for a person to review. It acts. McKinsey Partner Rich Isenberg frames it precisely: agency is not a feature, it is a transfer of decision rights. Governing a chatbot means checking whether what it said was accurate or appropriate. Governing an agent means controlling what it is allowed to actually do, to which systems, on whose authority, and under what conditions, before it does it, not after.
That distinction is why the gap is concentrated exactly where McKinsey finds it. Only 14.4% of organizations obtain full security and IT approval before deploying an agent. 40% deploy agents with access to sensitive data without human oversight in place. More than half lack human-in-the-loop controls for high-risk workflows entirely. None of that is a documentation problem. It is a controls problem: agents are being handed real authority faster than anyone is building the mechanism to limit or review that authority.
The scale of the mismatch is stark. Task-specific AI agents are projected to be embedded in 40% of enterprise software applications by the end of 2026, up from under 5% in 2025, an eightfold increase in agent surface area in a single year. Governance maturity, by McKinsey's own measure, moved from 2.0 to 2.3 over the same period. Capability is scaling exponentially. Control is scaling incrementally.
Where does the governance gap cause the most damage?
Two places, and they are exactly the two McKinsey's data points to first: sensitive data access without oversight, and missing human-in-the-loop controls on high-risk work. Both are silent failures. An agent with unreviewed access to sensitive data does not announce the risk it carries. It just carries it, quietly, until something goes wrong. An agent making high-risk decisions with no checkpoint does not ask for permission it was never told to ask for.
This is also where the compliance clock adds real urgency, not just risk-management urgency. The EU AI Act's high-risk obligations become enforceable on August 2, 2026, with penalties of up to EUR 35 million or 7% of global annual turnover for non-compliance. That converts "we should probably tighten this up eventually" into a hard deadline most companies with any EU exposure now have to treat as immovable, regardless of where their internal governance maturity currently sits.
What five controls close the AI governance gap?
The technical detail behind good agent governance is genuinely complex; enterprise checklists run to dozens of items covering data access layers, context versioning, and audit lineage. Almost all of that complexity reduces to five decisions a non-technical executive can own directly, without needing to understand the underlying architecture.
| Control | What it actually means |
|---|---|
| Agent inventory | A maintained list of every agent in production: what it can access, what it can do, and who built it, including agents embedded in vendor tools you did not build yourself. |
| Autonomy-level definitions | For every agent, a written line between what it can do on its own and what requires a human's approval first. |
| Human-in-the-loop checkpoints | Mandatory approval gates on irreversible, high-value, or customer-facing actions specifically, not a blanket slowdown on everything. |
| Real-time audit logging | For any agent run, in the last 90 days or the last year, you can answer what data it touched, what it did, and why, without needing an engineer to dig it out. |
| Named, accountable ownership | One person per agent who owns its behavior and has the authority to pause or roll it back. Not a shared responsibility, not a committee. |
These map directly to what McKinsey recommends at the technical layer (agent inventory and identity binding, autonomy-level definitions with escalation requirements, embedded control agents that monitor other agents, real-time audit infrastructure, and standardized build blueprints so every new agent inherits the same controls) translated into decisions an executive, not an engineer, has to make and own.
Want these five controls built into your agents from day one, not retrofitted after an incident? Get an AI personal assistant or a full agentic workforce, governed the same way from the first deployment.
How do I know if my governance is actually working, not just documented?
Run two tests, both borrowed from the technical governance literature and translated into plain language, because a policy that only exists on paper is not governance, it is a permission slip.
The operational test. Pick any agent, and any run from the last 90 days. Can someone in your organization, without pulling in an engineer, tell you what data that run touched, what actions it took, and what it produced? If the honest answer is "we'd have to dig through logs" or "we're not sure," your audit logging is not real yet, regardless of what your policy document says.
The coverage test. Ask for a one-page report showing every agent currently in production, whether each one is inventoried, whether its autonomy level is defined, and whether human-in-the-loop checkpoints are actually configured, not just planned. If that report cannot be produced quickly, your inventory is not real either.
Both tests take an afternoon to run and will tell you, honestly, whether you are in the 21% or the 79%.
What should a non-technical executive actually do this quarter?
A governance program does not have to start as a company-wide initiative. It starts as a short, ordered list, and the order matters, because trying to do all of it at once is how governance programs stall before they close anything.
- Run the agent inventory first. You cannot govern what you cannot see, including agents embedded inside vendor tools nobody thought to list.
- Fix sensitive-data access without oversight next. This is McKinsey's sharpest-scoring gap (40% of companies have it) and the highest-consequence one to leave open.
- Add human-in-the-loop checkpoints to high-risk workflows. Not everywhere: irreversible, high-value, and customer-facing actions specifically.
- Name one accountable owner per agent. Diffused ownership is the single factor McKinsey found most correlated with lower governance maturity scores.
- Stand up real-time audit logging, so the operational test above has a real answer, not a promise.
- Only then formalize the policy document and the committee. Documentation that follows working controls is useful. Documentation that substitutes for them is not governance, it is theater.
That order is deliberate. Deloitte separately found that only 30% of companies are actually redesigning key processes around AI, while 37% apply it only superficially. The same pattern shows up in governance: writing a policy is the superficial version, building the five controls above is the version that actually changes what can go wrong.
What mistakes do companies make when trying to close this gap?
A few patterns show up repeatedly among the 79% still working toward mature governance, and most of them come from treating governance as a document rather than a set of working controls.
- Writing a policy before building the inventory. A governance policy that references agents you have not actually listed is not enforceable, it is aspirational. The inventory has to come first, or the policy has nothing real to apply to.
- Gating everything equally. Requiring human approval on every single agent action kills the speed gains that justified the agent in the first place, and it does not actually make the system safer, because reviewers stop reading approvals carefully once there are too many of them. The fix is to gate by consequence: irreversible and high-value actions get a checkpoint, low-risk reversible actions run freely and get logged.
- Treating governance as a one-time setup. McKinsey's own data shows agent capability and the software embedding it are both moving fast (that eightfold jump in enterprise-app agent coverage projected for 2026 alone). A governance model set once at launch and never revisited falls behind within a quarter, not a year.
- Diffusing ownership across a committee. McKinsey found organizations with a single named, accountable owner per agent score measurably higher on governance maturity than those with shared or unclear ownership. A committee can set policy. It cannot be the person who notices an agent drifting off its intended behavior at 2am and pauses it.
- Waiting for a mandate before starting. Nothing above requires board approval to begin. The inventory and the operational test in particular can be run by any team lead this week, with or without a formal governance program attached yet.
How does a done-for-you partner close the gap faster?
The reason only 21% of companies have mature governance is not that the five controls above are secret. It is that building an agent inventory, defining autonomy levels, wiring in human-in-the-loop checkpoints, standing up real-time audit logging, and assigning real ownership is real infrastructure work, on top of the agent-building work itself, and most internal teams are already stretched thin just shipping the agent.
This is exactly where a partner earns their keep: not by handing over another policy template, but by building the five controls into the agent from the first deployment, the same way McKinsey's highest-scoring organizations do it, instead of retrofitting them after an incident forces the issue. We write the inventory, define the autonomy limits, design the approval gates on the actions that actually carry risk, wire in the audit trail, and stay on as the accountable operator, so governance is not a separate project competing for the same stretched team's time.
How to get started
You do not need to close the entire governance gap before you deploy your next agent. You need to close the two highest-consequence pieces first: know what data every agent can touch, and know which of its actions require a human to say yes before they happen. Everything else, the inventory, the audit trail, the named owner, follows from getting those two right.
Run the operational test and the coverage test on your current agents this week. If either comes back uncertain, that is your starting point, not a company-wide governance overhaul. If you want it built in from the start rather than retrofitted later, book a free consultation below and we will map your agent inventory, set the autonomy limits, and design the guardrails before you scale further.