Over the past few months, something has changed in how companies actually work. Until recently, AI was mostly a topic for board decks and conference panels. Now it shows up in the work itself: extracting the key terms from a contract, drafting the first version of a memo, summarizing a quarter’s worth of customer correspondence, populating a dashboard. Doing any of that used to require a dedicated software project and specialists to build it. Now an employee can describe the task in plain language and get usable output back the same afternoon. Nearly every company surveyed across industries is now using AI in some form.<\/p>\n
The interesting question is no longer whether to adopt it. It is how these new tools fit alongside the systems a company already runs on \u2014 and on that question, many leaders appear to be reaching for the wrong mental model.<\/p>\n
AI Agents Are Colleagues, Not Software<\/p>\n
The more useful model is to stop thinking of an AI agent as a piece of software and start thinking of it as a teammate. An agent takes instructions, does the work, produces an output, and moves on. Like a sharp new hire, it is fast, it scales easily, and it costs a fraction of a person. But like any new hire on her first day, it has no memory of the business beyond what it has been told, no instinct for process, and no obligation to anyone but whoever happens to be prompting it. Almost everything an agent does, a person could do given enough time \u2014 a room of interns could read two hundred contracts and key the terms into a spreadsheet. What the agent adds is throughput: more work, faster, at lower cost. That is genuinely valuable. It is also, on its own, incomplete.<\/p>\n
Gartner has confirmed the productivity trajectory: AI agents are embedded in less than 5% of enterprise applications today, but that figure is projected to reach 40% by the end of 2026<\/a> \u2014 one of the fastest technology adoption curves on record. The same research organization warns that more than 40% of agentic AI projects<\/a> will be canceled by the end of 2027 due to escalating costs, unclear business value, or, most commonly, weak risk controls. The productivity is real. The governance infrastructure to sustain it is not keeping pace.<\/p>\n Where All That Output Actually Goes<\/p>\n Here is where the real risk of this moment lies. It is not that companies will fail to adopt AI. It is that some will adopt it so successfully that they conclude they no longer need anything else. The productivity is real and highly visible. In documented cases, analysts have quintupled memo output and small teams have absorbed work previously requiring departments twice their size. The harder question, the one that tends to go unasked in the excitement, is where all of that output actually goes.<\/p>\n In companies without a strong system of record, the answer is usually: into personal drives, ad hoc spreadsheets, email threads, and chat messages. The work is getting done, and it is dissolving into precisely the silos that enterprise platforms were built to eliminate. This is best understood as a shadow workforce problem. When meaningful work is performed by agents whose output lives outside any system of record, a company has quietly built itself an off-the-books workforce \u2014 undocumented, unaudited, and uncoordinated.<\/p>\n Deloitte’s 2026 research found that only 21% of organizations currently have a mature governance model for AI agents, even as 74% plan to expand agentic AI deployment within two years. IBM’s cost-of-breach data puts a number on the exposure: organizations with high levels of unsanctioned AI incurred an average of $670,000 in additional breach costs compared to organizations with low or no shadow AI. Verizon’s 2026 Data Breach Investigations Report found that shadow AI detections at enterprises rose fourfold in a single year.<\/p>\n The Compliance Bill Is Already Due<\/p>\n The bill for that arrives later, and it is often someone from outside the company who presents it. A client doing due diligence, an auditor at year-end, or a regulator asks where a particular number came from. “The AI generated it” is not an answer, and neither is a saved chat log. The institutional answer is an audit trail: who entered this, when, on what assumptions, reviewed and approved by whom. A system of record produces that trail as a matter of course. An agent, left to its own devices, does not.<\/p>\n For companies operating in or serving the European market, the question is no longer hypothetical. The EU AI Act’s full enforcement provisions for high-risk AI systems \u2014 those used in employment decisions, credit scoring, and other consequential functions \u2014 are scheduled to take effect August 2, 2026, thirty days from this writing. Penalties under Article 99 for high-risk system violations can reach \u20ac15 million or 3% of global annual turnover, whichever is higher. The European Parliament has voted to defer some Annex III obligations to late 2027, but that delay has not yet taken legal effect through Council agreement; Holland & Knight advises<\/a> that August 2 “remains the legally operative deadline” for planning purposes. More than 70% of enterprises have not reached even basic maturity in AI governance controls, according to the Cloud Security Alliance’s March 2026 analysis.<\/p>\n A Pattern With a Familiar Shape<\/p>\n None of this is new, incidentally; only the form is. Veterans of any large organization will recognize the shape of it. Spreadsheets stood in for databases in the 1990s. Departments bought their own software around IT in the 2000s. Robotic process automation bolted scripts onto brittle systems in the 2010s. Each promised to let companies route around their systems of record. Each delivered a real near-term win. And each, at sufficient scale, hardened into infrastructure that no one fully trusted and no one could easily replace. Agents are by far the most capable entry in that lineage, which is exactly why they are the most consequential to get wrong.<\/p>\n This cycle has a well-documented end state. McKinsey’s January 2026 analysis of AI in enterprise resource planning describes how AI agents will increasingly become the interface layer \u2014 querying ERP, CRM, and HR systems in natural language while those systems of record continue to provide “auditability, compliance, and data consistency” underneath. Microsoft, Google Cloud, and AWS have each built their 2026 enterprise AI infrastructure around the same principle: agent identity management, tool-call-level audit logging, and policy enforcement at runtime, before an agent acts rather than after. At SAP’s Sapphire 2026 conference in May, CEO Christian Klein argued that the company’s long-term moat will come from “trusted operational data, embedded process logic, and governance infrastructure \u2014 not AI models themselves.”<\/p>\n The Flywheel That Only Spins Both Ways<\/p>\n All of which is why the popular framing \u2014 that agents will replace enterprise platforms \u2014 has it backwards. The argument runs that the agent becomes the surface where work gets done, leaving the platform beneath it as a slower, costlier way to accomplish the same task. But efficiency was rarely why companies bought these systems in the first place. No CFO would run the books on a paper ledger, however many clerks she could assign to it \u2014 not because the ledger is too slow, but because the business needs one set of books that everyone can trust. Platforms exist for consistency, for governance, for a single source of truth that survives staff turnover. An agent, on its own, supplies none of that.<\/p>\n The more useful way to see it is that each makes the other materially better. Give an agent clean, well-structured data and a clear set of actions it is allowed to take, and it produces sharper, more reusable work. Let that same agent populate the system from source documents in seconds and answer questions about it in plain language, and a platform that people used to avoid becomes one they are willing to live in. Better data makes the agent more useful; the agent puts more good data back into the system; the next task starts from better data than the last. That is a flywheel, and it only spins for companies that have invested in both halves of it.<\/p>\n