Enterprises that are successfully deploying agentic AI are doing so by limiting how much their agents can do independently, according to a new analysis of the market. The shift comes as industry data shows that a large portion of current projects are failing. Gartner forecasts that more than 40% of agentic AI projects running today will not survive to 2028, with escalating costs, unclear business value, and inadequate risk controls cited as the primary causes. McKinsey鈥檚 2026 AI Trust Maturity Survey similarly found that while deployment is accelerating, the average responsible-AI maturity across organizations is only 2.3 out of 4, with just about 30% reaching a maturity level of three or higher in governance and agentic AI controls.
The numbers indicate that capability is outrunning control, reframing the competitive landscape. The 2024-to-2025 race was about deploying the most autonomous agent the fastest, but the 2026-to-2027 race is a trust race. It is now about getting an agent approved for production by risk, legal, and compliance teams and keeping it approved once live. Gartner attributes the failure pattern to projects that launch with ambitious, broadly autonomous workflows, hit integration complexity within weeks, and then stall with no defensible path to production ROI. Vendor noise is also a factor, as Gartner counts only around 130 out of thousands of products sold under the agentic AI label as having real autonomous capability; the rest are largely repackaged automation or chatbots.
A structural problem also exists beyond the hype: autonomy and accountability move in opposite directions. An agent that can independently plan and execute a multi-step task becomes harder to trace after the fact, making it difficult to determine why a decision was made and who is responsible when something breaks. In areas like financial reconciliations, compliance processes, manufacturing quality checks, and clinical documentation, this lack of transparency can turn a manageable mistake into a serious regulatory breach. For this reason, legal, risk, and compliance teams are blocking agentic projects from reaching production, regardless of the model鈥檚 underlying capability. Integration complexity is a leading cause of project cancellation, as existing decision points, approval chains, and audit trails must be rebuilt around a system that can act without waiting for a human.
McKinsey鈥檚 research shows that most enterprises are exposed, with a wide gap between the AI risks organizations say they are aware of and the risks they actually mitigate. Nearly two-thirds of businesses report security and risk issues as the greatest challenge to scaling agentic AI, surpassing regulatory uncertainty and technical barriers. The leading enterprises are not halting their AI plans but are restructuring autonomy. Four patterns stand out among governance-mature organizations: narrow-scope agents with single responsibilities, human checkpoints at decision boundaries before high-stakes actions execute, decision traceability as a design requirement, and data sovereignty that limits the blast radius of a misbehaving agent. Regulators are pushing in the same direction, with the EU AI Act鈥檚 human oversight requirements for high-risk systems still coming, though the Digital Omnibus agreement pushed the compliance deadline to December 2027.
The risk runs both ways, as an agent requiring human sign-off on every minor task undercuts the case for building it in the first place. The goal is calibrated control, concentrated where the cost of an error is high. Agent deployment is scaling roughly 8x faster than governance maturity is improving. Architects reviewing an agent for deployment can ask four questions: whether a specific action can be reconstructed six months later, whether every agent has one bounded responsibility, whether human checkpoints are placed before actions rather than after, and how much data a compromised agent could touch before being noticed.
More AI news from TechManNews.
