Enterprise Agents Are Everywhere. Governance Is Nowhere.
Enterprise Agents Are Everywhere. Governance Is Nowhere.
Every company now runs AI agents. Almost none of them know what the agents are doing.
That is the gap at the center of OutSystems' 2026 State of AI Development report, released this week. The firm surveyed 1,900 global IT leaders in December 2025 and January 2026 and found that 96 percent are already using AI agents in some capacity. Ninety-seven percent are exploring system-wide agentic strategies. And yet, only 12 percent have implemented a centralized platform to manage agent sprawl.
The numbers are striking because the problem they describe is not theoretical. AI sprawl is landing in enterprises as real technical debt, security exposure, and audit risk. OutSystems' finding that 94 percent of organizations report concern about sprawl-driven complexity, technical debt, and security risk is backed independently by McKinsey and PwC, both of which have flagged uncontrolled agent autonomy as a top enterprise AI risk over the past year. Gartner puts a timeline on the pressure: 40 percent of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5 percent in 2025.
The adoption curve is moving faster than the governance curve. Only 36 percent of organizations have a centralized AI strategy at all. Forty percent report seeing immediate returns in IT development and productivity from agentic AI, which is the business case for accelerating deployment. But the same incentives that push agents into production push governance to the back burner.
"The challenge is no longer just about adoption, but about creating a stable architectural foundation that can coordinate these complex intelligent systems," said Woodson Martin, CEO at OutSystems, in the report. That framing is notable: OutSystems is selling the problem and the answer simultaneously. The company introduced Agentic Systems Engineering, its own open approach to governed agent development, alongside this report. Agent Workbench is part of that pitch.
The customer quote in the release illustrates the dynamic. Scott Finkle, VP of Technology at McConkey Auction Group, describes starting with "a small, well-defined project" to "build some muscle for building AI projects moving forward." That is the state of the industry in one sentence: agents are moving into production because the competitive pressure demands it, not because governance is ready.
What sprawl actually looks like
The report's operational details are worth dwelling on. Thirty-eight percent of organizations globally are already mixing custom-built and pre-built agents, which is a provenance and traceability problem as much as a governance one. When something breaks or needs to be audited, the answer to "which agent did that, and who configured it?" may not be available.
Fifty-two percent of organizations are relying on a human-on-the-loop model, meaning a person remains in the supervisory chain. That sounds reassuring but obscures the reality that most human-in-the-loop setups were designed for single-agent oversight, not a system of dozens or hundreds of agents acting in parallel across departments.
Forty-nine percent describe their agentic AI capabilities as advanced or expert, which suggests a meaningful subset of enterprises believe they have moved beyond the experimental phase. Financial services and technology organizations report the highest levels of production deployment. India leads in APAC for advanced capability; Australia and Japan are at intermediate stages.
The regional picture complicates the simple "enterprise is behind on governance" narrative. India is not only adopting agents rapidly but reporting advanced maturity, which suggests governance problems may be more acute in faster-moving markets where the governance gap opened earlier.
The vendor calculus
OutSystems is not a neutral observer here. It makes low-code development platforms and has obvious commercial interest in enterprises standardizing on its agent tooling. The report being a PR vehicle for Agentic Systems Engineering should be kept in mind when evaluating its framing.
That said, the underlying data on adoption and governance gaps is consistent with what independent analysts are finding. Gartner's 40 percent enterprise application prediction, McKinsey's governance warnings, and PwC's call for responsible AI frameworks as non-optional are separate data points that reinforce the same picture.
The governance gap is real. The question is whether a vendor-led open approach, which is what OutSystems is pitching, is the right mechanism to close it, or whether it creates a new form of lock-in dressed up as openness. Agentic Systems Engineering being described as "open" warrants scrutiny; what standards does it adhere to, and who governs them?
What this means
The enterprise agent story in 2026 is not whether to adopt. That question is settled. The story is who is accountable when agents act, how organizations maintain visibility across a distributed agent estate, and whether the tooling being sold as governance solutions today will still be adequate a year from now when agent deployments are denser and more interconnected.
For engineers and architects: the governance vacuum is an opportunity to define patterns before vendors do it for you. For executives: the 12 percent number is a signal that most organizations have not made the governance investment the current agent footprint requires, and the cost of that gap will show up in incidents before it shows up in budgets.
For VCs and founders: the sprawl problem is a wedge. The companies that help enterprises see, control, and audit what their agents are doing will be positioned differently than the companies building agents. The infrastructure layer for agent governance is underdeveloped relative to the agent layer itself.
Source: OutSystems 2026 State of AI Development, PR Newswire release, April 7, 2026. Survey of 1,900 global IT leaders, commissioned by OutSystems via third party, conducted December 2025 through January 2026.
† Add footnote: 'OutSystems survey finding; McKinsey and PwC cited for general concerns about agent autonomy, not specifically for the 94% statistic.'