Governing the agentic enterprise

In our previous article, we explored how a business-led approach helps organizations unlock value from agentic AI, starting with clear use cases, proving impact, and scaling with intent.

Since then, the market has evolved. Agentic AI is no longer just a question of adoption, it’s already being embedded into core workflows across the industry. According to the 2026 KPMG Global Tech Report, 88 percent of organizations are investing in agentic AI and 68 percent expect to reach the highest level of adoption by 2026. Yet only 11 percent consider themselves fully scaled today.

That gap tells a real story. A primary challenge is no longer getting started, it’s how to scale in a controlled, coordinated and sustainable way.

For many organizations, ambition is accelerating faster than maturity

There’s no shortage of ambition, with half of organizations expecting to reach the highest level of AI maturity by the end of 2026, despite only 11 percent rating themselves at that level today. But only 24 percent¹ are achieving return on investment (ROI) across multiple use cases.

So what’s holding organizations back?

Pilots can work because they operate in controlled environments with defined scope, known data and close oversight. Scaling builds on that, as agents evolve into live workflows and interact with systems, processes and people across the enterprise.

In one of our cross-functional “agentathons”, teams quickly moved from ideas to working prototypes. But when it came to scaling, the challenge shifted from building functionality to balancing adoption, governance, access and reuse, while giving teams enough freedom to experiment with AI and embed it in ways that work for them.

Similarly, in a retail HR use case, designing an employee service agent immediately raised questions around permissions, data boundaries, ownership and support. Scaling becomes as much about control and accountability as it is about capability.

At this point, organizations aren’t just deploying technology, they’re also reshaping how decisions are made, how work is managed, and where accountability sits. Governance extends beyond compliance. It can become operating discipline — helping to define decision rights, embed control into workflows, and enable consistent scalability.

A hidden risk of fragmented scaling

Without discipline, things can become fragmented. In fact, 32 percent² of organizations report disconnected AI initiatives and teams, with limited coordination or shared governance.

In practice, this shows up as AI sprawl, with many teams building in parallel, duplicating efforts and applying inconsistent controls. It can especially visible where agents are embedded into end-to-end processes.

Shadow AI can follow, where innovation speeds up, but control falls behind.

Early lessons are clear. Structure should come early through a lightweight center of excellence, a hub-and-spoke model, and shared guardrails that allow teams to move quickly without losing control.

It also means treating agent delivery as a lifecycle with clear ownership, gated progression, and defined approaches to maintenance. And perhaps most critically, governance should be built into the tools — through identity and access management, data protection, and monitoring — rather than relying on manual oversight.

Rethinking governance for the agentic enterprise

As agentic AI becomes embedded in core workflows, governance should evolve with it. This is no longer just about overseeing models, it’s also about managing how AI operates across workflows, teams and decisions.

And three key patterns are emerging:

Hybrid operating model

Many organizations are moving to hybrid models with central guardrails and federated delivery. Where a central team sets policies and reusable components, while business teams build within those boundaries.

This can create clarity without slowing delivery. With the support of a center of excellence, structured intake and repeatable delivery models, organizations can scale AI as a coordinated portfolio rather than a set of disconnected experiments.
Strong data and architectural foundations

Scaling depends on controls built in from the start: identity, access, data protection and clear usage policies.

Equally important is visibility. Monitoring, audit trails and the ability to respond when something goes wrong. When designed into the platform, governance can become enforceable.
Clear value measurement and accountability

As AI moves into production, expectations are shifting. Many boards want clarity on accountability, control and outcomes.

Effective governance brings together business value, adoption, and risk metrics like auditability and policy adherence. So governance is no longer separate, it’s embedded into how AI operates.

Governance as a source of resilience

Done well, governance helps organizations move faster. It reduces rework, enhances visibility, and allows teams to take more deliberate risks because the guardrails are already in place.

In a fast-moving environment, that combination of speed and control can become a real advantage.

Scaling with structure: KPMG and Microsoft

Scaling agentic AI typically requires both the right operating model and the right foundations.

KPMG firms combine their expertise in operating models, governance and delivery with Microsoft platforms that embed governance across identity, data access and monitoring. Together, they provide organizations with a practical path from AI experimentation to enterprise-scale capability.

In summary, Agentic AI is a bit like giving everyone in the organization a set of car keys. You don’t start with ‘drive carefully’ and hope for the best. You start with who’s got a license, who’s insured to drive, what they’re allowed to drive, where they’re allowed to take it, and what happens if there’s an accident. It’s a difference between moving faster safely and ending up with a very expensive insurance claim.

This is a shift that’s now underway. Scaling agentic AI is not about building more, it’s about building with structure, so autonomy can deliver not just speed, but sustained enterprise value.