91% of Executives Already Use Agentic AI, but 49% Have Not Updated Their Governance Controls

My take: An EY survey of 202 senior executives at companies with over one billion dollars in annual revenue found that 91% already use agentic AI in their organization, either in active pilots or full deployment. 49% acknowledge their governance frameworks have not been updated to include the specific risks of agents, and 26% admit they cannot detect unauthorized AI agents operating internally.

The most revealing data point: 85% say at least some of their agentic systems execute actions without real-time human review. And 36% have already experienced an AI incident with a materially negative impact, from data loss to reputational damage.

This is not an argument to slow agent adoption. It is a signal that implementation strategy needs to be paired with real controls. Adopting without monitoring is exactly where the risk lives.

If your organization already uses AI agents, do you have visibility into which ones are active, what actions they execute, and who authorized them?