The shift from AI that answers questions to AI that takes action is real, and it is happening faster than most organisations are prepared for. The difference sounds simple but the implications are significant. A chatbot tells a procurement manager that a supplier's price has changed. An autonomous agent notices the change, checks it against the contract terms stored in the system, decides whether it falls within the approved threshold, and either places the order or escalates. No one is in the loop unless something goes wrong.
The business case for this is obvious. But the execution gap is enormous.
Deloitte's own research shows that while roughly 30% of organisations are exploring these systems and 38% are running pilots, only 11% have them operating in live, real business processes. Gartner predicts that over 40% of agentic AI projects will be cancelled by 2027, not because the AI is bad, but because the organisations running them were not ready for what production actually demands.
Here is the pattern that keeps repeating. A company runs a successful pilot with a hand-picked team, clean data, and careful supervision. It looks impressive. Then someone asks whether it can be rolled out to the full organisation. That is when the real problems surface.
The first problem is data. Most enterprise data was designed for human analysts, not for a system that needs to make binding decisions. Reports are generated nightly, information is summarised and stripped of context, and there is no clear record of where a number came from or when it was last confirmed as accurate. An autonomous system acting on that kind of data can approve a purchase at a price that expired two days ago, or flag a compliance breach based on a rule that was updated last quarter. McKinsey found that eight in ten companies cite data limitations as the main reason they cannot scale these systems.
The second problem is identity. When an AI agent logs into your procurement system and approves a purchase order, who is it? Most organisations do not have a good answer. A survey by the Cloud Security Alliance found that only 18% of security leaders feel confident their current systems can properly manage what an AI agent is authorised to do. Only 23% of organisations have a formal strategy for this at all. Teams are frequently sharing human login credentials with agents because no proper alternative exists yet, which creates a compliance and audit problem that legal teams will not accept at scale.
The third problem is what happens when a pilot needs to become a product. Pilots succeed because they cut corners that are not visible during a short, managed test. Security reviews get deferred. Compliance approvals get waved through. Data gets manually cleaned in the background. None of that can continue at scale. The governance debt accumulates, and when legal reviews the production rollout, those deferred items become the blockers.
This is not a theoretical problem. A survey of IT leaders found that only 36% of organisations have a centralised approach to governing their AI agents, and just 12% use a unified platform to maintain oversight across all of them. That means the majority of organisations have agents operating in different parts of the business with different rules, different access levels, and no consistent audit trail.
The organisations that are breaking through have one thing in common: they treated their first deployment not as an experiment but as the foundation for everything that follows. They built identity controls, data standards, and governance requirements into the first use case rather than adding them later. The second and third deployments then take weeks instead of months because the foundation already exists.
For non-technical leaders, the practical implication is this. The question to ask before approving any agentic AI project is not whether the demo worked. It is whether the data the system will use is accurate enough to make binding decisions, whether your security team can account for everything the agent is allowed to do, and whether your legal and compliance teams have signed off on the approval thresholds before the pilot starts, not after.
The organisations that get this right early will have a real structural advantage. The ones that rush pilots into production without resolving these foundations will spend the next two years unwinding the problems they created.