Closing The AI Control Gap Requires A New Operating Model For Governance

Joe Locandro is an experienced CIO. He is often sought to provide thought leadership in Technology, Innovation and AI.

​As organizations move from AI experimentation to enterprise-scale adoption, many are discovering a growing gap between what AI agents can do and the operating model required to deploy them responsibly at scale. A May 2026 Gartner, Inc. report predicted that “by 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur.”​

The problem isn’t necessarily the technology. Organizations have moved quickly from GenAI pilots to agents that can access data, interact with multiple systems and execute workflows. Yet in many cases, governance hasn’t evolved at the same pace. It’s still largely built around policies, approval processes and acceptable-use guidelines.​

Those foundations still matter, but once agents begin taking action inside the enterprise, governance must move with them.​

Governance must evolve from policy to operational capability.

Policies and training can provide effective guardrails when employees are using GenAI for productivity, but they’re no longer sufficient once agents begin accessing enterprise systems, writing to databases and executing workflows across applications.​

That raises a whole new set of questions for IT leaders: Who’s allowed to build an agent? Which systems can it access? Can it read information, write information or both? What downstream processes might be affected by an action it takes? Who approves the agent before production, and who monitors it afterward?

In our own AI journey, we’ve evolved our governance as adoption matured. We started by establishing policies, delivering training and setting clear guardrails for GenAI. As users grew more comfortable with the technology and began building agents, we rethought how we manage access, auditability, change and oversight.