96% of Enterprises Are Using AI Agents. Only 12% Have Any Idea How to Govern Them.

A number worth sitting with: 96% of enterprises are already using AI agents in some capacity. 97% are exploring system-wide agentic AI strategies. And 94% are concerned that AI agent sprawl is increasing their complexity, technical debt, and security risk.

OutSystems surveyed nearly 1,900 global IT leaders for its 2026 State of AI Development report. The pattern it describes should be familiar to anyone who watched enterprise SaaS adoption play out over the last decade - and concerning for the same reasons, at significantly higher stakes.

The enterprise went from "get AI in the hands of people" to AI agent sprawl in roughly eighteen months. The question that follows is how to govern what is already in production before it becomes a problem that governance cannot solve after the fact.

SaaS Sprawl Had Bad Consequences. Agent Sprawl Has Worse Ones.

The SaaS sprawl problem was real and expensive. Enterprises ended up with hundreds of disconnected applications with overlapping functions, fragmented data, and integration headaches that consumed IT budgets for years. Many organizations are still working through the consequences.

AI agent sprawl is the same pattern with a fundamentally different risk profile. SaaS tools hold your data. AI agents act on your data. The distinction matters enormously.

A disconnected SaaS tool creates a data silo. A disconnected AI agent creates an autonomous decision-maker operating outside your governance framework, your audit trail, and your ability to explain or correct what it did. According to Gartner, by 2028, 33% of enterprise software applications will include agentic AI - enabling 15% of day-to-day work decisions to be made autonomously. IDC predicts that by 2030, 20% of the largest global enterprises will face lawsuits, regulatory fines, or CIO dismissals due to high-profile disruptions tied to poorly governed AI agents.

Those are not edge case projections from organizations with unusual risk profiles. They are population-level predictions about what happens when governance does not keep pace with deployment - which, in 2026, it demonstrably is not.

What Agent Sprawl Actually Looks Like

38% of organizations globally report mixing custom-built and pre-built agents, creating AI stacks that are difficult to standardize and secure. Different teams deploy different agents from different vendors on different governance frameworks - or no governance framework at all. The agents do not talk to each other. They do not share a consistent data foundation. They make decisions in silos that affect the same customers, the same operations, and the same compliance environment.

Only 12% of enterprises have implemented a centralized platform to manage agent sprawl. The other 88% are experimenting with governance approaches that vary by team, by region, and by whoever deployed the agent in question.

In a regulated industry - healthcare, financial services, government - this is not a future concern. It is a current liability that has not yet triggered an incident significant enough to be audited. The incident is not a question of if. It is a question of when the first agent makes an autonomous decision in a compliance-sensitive context without an auditable trail of how it reached that decision.

The Three Things That Separate Governed Agent Deployment from the Alternative

The organizations getting agentic AI right - the 12% with centralized governance and the minority achieving their AI objectives - are not doing something exotic. They are doing three things consistently that the 88% are not.

1. 1
   They defined the decision boundary before deployment. An AI agent needs to know exactly what it is authorized to do autonomously and exactly when it must stop and route to a human. That boundary is an architectural decision, not a configuration option. Organizations that define this boundary before deployment have agents that fail safely. Organizations that define it after the first incident have agents that fail in production, in compliance-sensitive contexts, in ways that are very difficult to explain to an auditor.
2. 2
   They built the audit trail into the architecture. Every action an AI agent takes in a governed enterprise deployment needs to be traceable - what it saw, what it decided, what it did, and why. Not as a logging feature added after the fact, but as a core architectural requirement. In financial services, this is a compliance requirement. In healthcare, it is a patient safety requirement. In government, it is a public accountability requirement.
3. 3
   They treated governance as a prerequisite, not a retrofit. The organizations currently dealing with agent sprawl did not make a bad technology decision. They made a sequencing decision - deploying agents before governance was in place and assuming governance could be added afterward. Retrofitting governance onto a deployed agent ecosystem is significantly harder than building it into the architecture from the start.

What Agentic AI Actually Requires to Work at Enterprise Scale

The honest answer to "what does agentic AI require to work at enterprise scale" is the same answer that applies to every other AI capability: it requires the data foundation, the governance framework, and the architectural decisions to be in place before the agents are deployed - not after the incident that reveals they were not.

That is a harder sell than "deploy agents and govern them later." But the 94% of organizations concerned about agent sprawl are living with the consequences of the easier sell. The 12% that built governance first are not in that 94%.

The technology for agentic AI that works reliably in enterprise environments exists. The sequencing for deploying it - governance before deployment, data foundation before agents, decision boundaries before autonomy - is known. What is missing in most organizations is the willingness to do the prerequisite work before pursuing the capability.

The Bottom Line

96% of enterprises are using AI agents. 94% are worried about sprawl. 12% have centralized governance.

The math is not sustainable, and the regulatory environment will not wait for it to resolve itself. The organizations that will be in the 12% in two years are the ones building governance into their agentic AI architecture now - not after the first incident makes it unavoidable.

Anterra builds agentic AI systems with governance, auditability, and decision boundaries engineered into the architecture from day one. If you are deploying agents in a regulated environment and governance is an afterthought, we should talk.