ANZ is ahead, and that cuts both ways. 39% of ANZ leaders call agentic AI deployment critical, against 22% globally — which means a larger live surface area of ungoverned agents than most markets carry.
The estate is about to become uncountable. Gartner forecasts the average global Fortune 500 enterprise will run more than 150,000 agents by 2028, up from fewer than 15 in 2025. Only 13% of organisations believe their agent governance is adequate.
Uniform controls are the trap. Gartner expects 40% of enterprises to demote or decommission autonomous agents by 2027 — usually because one control set was applied across four very different autonomy levels.
The ROI problem is an operating-model problem. In an August 2026 study of 150 CX and IT leaders, not one respondent reported achieving cost reductions through AI; 67% said costs had risen.
There is a particular kind of trouble that only arrives after a technology starts working. For the past eighteen months the conversation about AI agents has been about capability — can they reason, can they act, can they be trusted with a task rather than a prompt. That question is largely settled in practice. The harder question, the one now landing on the desks of CTOs and IT programme managers across Australia and New Zealand, is what happens when the pilots succeed and nobody has decided who owns the resulting fleet.
Three separate pieces of research published this year point at the same conclusion from different angles: agentic AI is being deployed faster than most enterprises can govern it, and the cost of that mismatch is about to become visible on the balance sheet.
Research published by Genesys in July 2026, drawing on 1,560 CX and business leaders across more than 20 countries, found that 39% of ANZ leaders consider deploying agentic AI critical to their strategy — compared with 22% globally and 21% across the wider Asia Pacific region.
Nearly half of ANZ organisations, 48%, already have agentic virtual agents in production, and 89% expect autonomous agents to be orchestrating customer experiences within three years.
That is a genuine competitive position. It is also a larger surface area of risk than most of our peers carry. The same research found that 39% of organisations do not automatically pass information between their virtual and human agents — which means a meaningful share of those production deployments are creating the exact discontinuity they were bought to remove. Being early is only an advantage if the operating model catches up, and in our experience it rarely does on its own.
In April 2026, Gartner forecast that the average global Fortune 500 enterprise will have more than 150,000 agents in use by 2028, up from fewer than 15 in 2025. Even discounting heavily for the scale difference between a Fortune 500 business and a mid-market ANZ enterprise, the direction is unambiguous. Agents are not going to be a handful of governed, centrally procured systems. They are going to arrive the way SaaS arrived — from every department, through every platform your teams already licence, faster than procurement can see them.
Against that forecast, Gartner reported that only 13% of organisations believe they have appropriate AI agent governance in place.
Max Goss, Senior Director Analyst, Gartner
The gap between 150,000 agents and 13% governance readiness is not a technology gap. It is an accountability gap, and it is the reason we expect the next two years of agentic AI work to look far more like identity and access management than like machine learning.
The instinct, once leadership recognises the exposure, is to apply a single control framework across everything called an agent. Gartner's May 2026 research suggests this is precisely the wrong move. It predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance failures — not because the agents did not work, but because the controls around them did not fit.
Shiva Varma, Senior Director Analyst at Gartner, described the two failure modes plainly: “Agents operate at different autonomy levels and across different trust boundaries. When the same controls are applied indiscriminately, organizations encounter two common failure modes: over-restriction of simple agents, which slows delivery and drives shadow development, or under-restriction of more autonomous agents, which increases operational, security and compliance risk.”
LEVEL
WHAT THE AGENT DOES
WHAT THE CONTROLS MUST COVER
TYPICAL EXAMPLE
1 — Observe
Reads only. Takes no action.
Lightweight controls, data access scope
Summarising tickets or logs
2 — Advise
Recommends. A human executes.
Quality testing on outputs, bias review
Drafting a response for an agent to send
3 — Act with approval
Executes autonomously, gated by explicit human sign-off on each action
Approval workflow, audit trail, identity
Issuing a refund above a threshold
4 — Act autonomously
Executes independently inside guardrails
Continuous monitoring, circuit breakers, rollback, scope alerting
Rebalancing inventory or scaling infrastructure
It is a useful frame precisely because it is boring. It maps cleanly onto controls most enterprises already run for privileged access, and it gives architecture and risk teams a shared vocabulary they currently lack.
This is not a new concern from Gartner. The firm has forecast since June 2025 that more than 40% of agentic AI projects would be cancelled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls. What has sharpened in 2026 is the weighting. The 2025 framing was largely about hype and immature use cases; the 2026 research points at governance designed after deployment rather than alongside it — a failure that only shows up once the use case is good enough to scale.
A study released on 17 August 2026 by TTEC Digital, in partnership with CX Dive, surveyed 150 CX, contact centre and IT leaders and produced findings that are difficult to read comfortably.
Not one respondent reported achieving cost reductions through AI. Sixty-seven per cent said operational costs had actually risen. Just 1% described their operating model as highly adaptive and built for continuous change.
The structural explanations sit in the same dataset. Sixty per cent of organisations run seven or more distinct platforms. Only 29% apply formal, cross-functional governance consistently, while 64% apply policies inconsistently across the enterprise. Marcy Riordan, VP of Data & Analytics at TTEC Digital, put it directly: “Companies can no longer afford to buy into tech that fails to move the bottom line.”
A single 150-respondent survey is a signal, not a verdict, and this one is weighted towards customer experience functions rather than IT as a whole. Treat the direction as reliable and the precise percentages as indicative.
That caveat aside, it is consistent with what we see in modernisation engagements: the agent is rarely the constraint. The constraint is a data estate that cannot answer the agent's questions reliably, and a process that still requires a human handoff the agent was never designed to make.
On 4 August 2026, the Ninth Circuit vacated Amazon's preliminary injunction against Perplexity's AI-enabled browser, holding that an AI agent operating through a user's own device does not constitute unauthorised access under the US Computer Fraud and Abuse Act. The opinion's framing — “the Assistant, however advanced, is a tool, not a person for statutory purposes” — has been widely reported as a win for agent developers.
It is narrower than the headlines suggest. The court expressly stated it was not establishing a new legal regime governing agentic AI, and the holding turned on a specific architecture: the user's browser, not Perplexity's servers, made the request. Where an agent runs server-side, or acquires greater autonomy, the analysis may differ. Contractual terms of access remain fully enforceable regardless.
The direct precedential value is limited — this is US law. The practical lesson transfers cleanly, though. If your agents transact with third-party systems, the architecture of that interaction is now a legal question your counsel should see before it becomes a design decision your engineers make alone.
Three things, in order, before adding another agent to the estate.
1. Build the inventory before you build the policy. You cannot govern what you cannot see, and shadow agents inside sanctioned platforms are already the norm rather than the exception. Gartner's own guidance places a centralised inventory second only to establishing policy; in practice the inventory usually has to come first, because it tells you what the policy needs to cover.
2. Classify by autonomy, not by department. A read-only agent summarising tickets and an agent authorised to issue refunds are different risk objects, and treating them identically guarantees one of Gartner's two failure modes. Assign each agent an autonomy level, an owner, an identity and a retirement date at the point of creation.
3. Fix the data foundation in parallel, not afterwards. The TTEC data showed 43% of leaders prioritising data modernisation for 2027. That work has a longer lead time than any agent deployment, which means starting it after the agents are live is how organisations end up in the cost-increase cohort.
WEEKS
FOCUS
WHAT “DONE” LOOKS LIKE
1 – 4
Discovery
A single register of every agent in the estate, including those embedded in SaaS platforms, with an owner named against each
5 - 8
Classification
Every agent assigned one of the four autonomy levels, with its identity, permissions and data scope documented
9 - 12
Proportional controls
Approval workflows live for Level 3, monitoring and rollback live for Level 4, and a retirement process for agents nobody claims
None of this is glamorous, and none of it is what the vendor demos are about. It is, however, the difference between an agent estate that compounds and one that gets quietly decommissioned in eighteen months.
An AI agent is a system given a goal rather than a prompt, with the ability to take steps towards it — calling tools, querying systems, and in some configurations executing actions without a human in the loop for each step. The distinction that matters for governance is not how sophisticated the model is, but how much the agent is permitted to do.
No — that figure is Gartner's forecast for the average global Fortune 500 enterprise by 2028. The useful signal is the shape of the curve, not the absolute number. Most organisations will move from a countable handful of agents to a number large enough that manual tracking stops working, and the governance problem arrives at that inflection point regardless of the total.
No — that figure is Gartner's forecast for the average global Fortune 500 enterprise by 2028. The useful signal is the shape of the curve, not the absolute number. Most organisations will move from a countable handful of agents to a number large enough that manual tracking stops working, and the governance problem arrives at that inflection point regardless of the total.
The proliferation of agents created across an organisation without central visibility — including agents spun up inside SaaS platforms your teams already licence, which never pass through procurement or architecture review. It is the agent-era version of shadow IT, and it is why an inventory has to precede a policy.
Generally no, and Gartner's own framing warns against over-restriction, which slows delivery and pushes teams into shadow development. The proportional model exists so that low-autonomy agents can move quickly while high-autonomy ones carry heavier controls. What we would pause is any new Level 3 or 4 agent until the inventory and ownership model exist.
Not directly — it is a US federal appellate decision interpreting a US statute. It carries no precedential weight in AU or NZ courts. It is worth understanding because it signals how courts are beginning to reason about agent architecture, and because many ANZ enterprises deploy agents against US-hosted platforms whose terms of access are governed by US law.
In our experience it fails when it sits in only one of them. The inventory is an architecture problem, the identity and permissions model is a security problem, and the decision about which actions an agent may take without approval is a business one. The organisations getting this right are running it as a cross-functional forum with a named owner, which is precisely the 29% figure in the TTEC data.
Basilu Weerakoon
Software Engineer
Blog
