← Back to Insights
StrategyMarch 2026

The State of AI in the Enterprise: Technology Is Outpacing the Organizations It's Meant to Transform

An analysis of Deloitte's "State of AI in the Enterprise: The Untapped Edge" (January 2026), supplemented by Gartner research and real-world enterprise case studies.

The State of AI in the Enterprise

The Problem: Companies Are Building AI Fluency, Not Redesigning Work

Deloitte's latest enterprise AI survey paints a paradox. Despite high expectations for automation, 84% of companies have not redesigned jobs or the nature of work itself around AI capabilities. Insufficient worker skills are seen as the biggest barrier to integrating AI into the business, but fewer than half of companies are making significant adjustments to their talent strategies. Most are focused on educating employees, but far fewer are rearchitecting roles, workflows, and career paths.

The fundamental problem statement is clear: the technology is moving faster than companies can operationalize it. New tooling like MCP (Model Context Protocol), autonomous agent frameworks, and open-source AI tools are maturing at a pace that outstrips most organizations' ability to implement them safely and effectively. And yet companies continue to invest in AI fluency as if understanding the technology were the same as transforming the business around it.

AI Agents Are Scaling Faster Than the Guardrails

Autonomous AI agents are racing into the enterprise, but oversight is lagging. Nearly 3 in 4 (74%) companies plan to deploy agentic AI within two years. Yet only 1 in 5 (21%) report having a mature model for governance of autonomous agents, raising the specter of unintended risks.

There is a subtle but critical distinction between an AI agent and an autonomous AI agent. Autonomy means the system operates in a closed loop: it can reason, act, and iterate without constant human intervention. No major enterprise has publicly announced running truly autonomous agents at scale yet, and that should tell us something. The technology is available, but the governance, infrastructure, and organizational readiness are not.

This is the central tension: the tech is coming out way faster than companies can figure out how to implement it safely.

Leaders Feel Strategically Ready but Operationally Unprepared

Despite the rapid evolution of AI beyond Generative AI (GenAI) to agentic and physical AI, 42% of companies believe their strategy is highly prepared for AI adoption, and 30% say the same about risk and governance, both rising since last year. But perceptions of preparedness shifted down slightly for technical infrastructure, data management, and talent, revealing the persistent challenge of modernizing systems and skills at the speed of innovation.

This is improvement from the previous year, but still lagging far behind the demand that model development and agentic strategy are creating. The strategic confidence often comes without the operational backbone to support it. Without centralized AI governance, companies struggle to move from strategic intent to operational reality. You might have the vision to build a chatbot on top of your enterprise data, but without the infrastructure, data pipelines, and governance framework to support it, the vision stays on a slide deck.

AI Maturity vs. AI Experimentation: Lessons from Johnson & Johnson and Gartner

The Thousand Flowers Problem

Johnson & Johnson's AI journey offers a cautionary tale for enterprises caught in the experimentation trap. The healthcare conglomerate initially adopted a "thousand flowers" approach, where employees pursued nearly 900 individual AI use cases, funneled through a centralized governance board. The result? Only 10% to 15% of use cases were driving about 80% of the value. The rest were redundant, underperforming, or simply not working.

CIO Jim Swanson described the pivot: "We've moved from the thousand flowers to a really prioritized focus on GenAI." The company now allocates resources only to the highest-value generative AI use cases, cutting projects that are redundant, underdelivering, or better served by non-GenAI technologies.

What High-Maturity Organizations Do Differently

Gartner's research reinforces this lesson. Their survey found that 45% of organizations with high AI maturity keep AI projects operational for at least three years, compared to only 20% in low-maturity organizations. The differentiator? Choosing AI projects based on business value and technical feasibility, paired with robust governance structures and engineering practices.

The correlation between Gartner's findings and Johnson & Johnson's experience is direct: instead of having 900 internal projects and hoping something sticks, high-maturity organizations evaluate based on business value, technical feasibility, how many people are affected, and how long they anticipate the product will exist and deliver return.

Key characteristics of high-maturity organizations from Gartner's research:

  • Dedicated AI leadership: 91% of leaders from high-maturity organizations have appointed dedicated AI leaders who prioritize fostering AI innovation (65%), delivering AI infrastructure (56%), building AI teams (50%), and designing AI architecture (48%).
  • Centralized strategy: Almost 60% have centralized their AI strategy, governance, data, and infrastructure capabilities to increase consistency and efficiency.
  • Rigorous metrics: 63% run financial analysis on risk factors, conduct ROI analysis, and concretely measure customer impact, enabling them to sustain AI success over time.

The Case for Centralized AI Operations

Not every company will follow the same path. Some organizations may find value in staying experimental, especially smaller ones where the overhead of centralization outweighs the benefits. But for most enterprises, AI needs to be treated like cybersecurity: it touches every part of the organization, it requires specialized expertise, and it cannot be left to each department to figure out independently.

Just as you wouldn't run a company without a cybersecurity function, even if it's a single dedicated person, AI demands its own organizational home. The NIST AI Risk Management Framework describes this in terms of AI actors: AI leaders who set strategy and governance, and AI actors across the organization who execute within that framework. A mature AI organization typically includes:

  • AI leadership that owns strategy and governance
  • An AI governance and infrastructure team that manages platforms, pipelines, and risk
  • An AI application/development team that builds and deploys solutions

When AI lives within a dedicated function, that team accumulates institutional knowledge. They learn from each implementation: what barriers they hit, what governance friction points exist, how to streamline the next deployment. A software development team building a one-off AI feature is unlikely to carry those lessons forward or invest in reducing friction for the next project.

Access Is Expanding, but Utilization Remains the Untapped Edge

According to Deloitte, workforce access to AI has expanded by 50% in just one year, growing from under 40% to under 60% of workers with sanctioned access to AI tools. Eleven percent of leading companies currently provide workers with near-universal (more than 80%) access to sanctioned AI tools.

However, among those workers with access, fewer than 60% use it in their daily workflow, a pattern that remains largely unchanged from last year. This is Deloitte's "untapped edge": while access is widening, enterprise AI remains underutilized, and its productivity and innovation potential are still largely untapped.

Giving everyone access to AI is necessary but insufficient. The question is whether those tools are being directed toward the use cases that deliver big-time savings, meaningful automation wins, and genuine workflow transformation, or whether they're just another application employees have access to but rarely open.

With Sovereign AI Taking Hold, Where Technology Is Built Matters

As sovereign AI gains traction globally, the geographic and jurisdictional dimensions of AI infrastructure are becoming as important as the technology itself. Where AI models are trained, where data is stored, and under which regulatory frameworks they operate are no longer secondary considerations. Companies must navigate an increasingly complex landscape where the where of AI is inseparable from the what.

Conclusion: A Framework for Moving Forward

The state of AI in the enterprise is defined by a gap between strategic ambition and operational readiness, between technology availability and organizational capacity, between access and utilization. Closing that gap requires more than AI fluency training. It requires structural change: dedicated AI leadership, centralized governance, rigorous project selection, and a willingness to cut experiments that aren't delivering value.

For organizations looking to deepen their approach to AI governance and risk management, the following frameworks provide essential guidance:

  • NIST AI Risk Management Framework (AI RMF): A comprehensive framework for managing AI risks across the lifecycle, including roles for AI actors and leaders
  • ISO 42001 series: International standards for AI management systems
  • Gartner AI Maturity Model: A framework for assessing organizational AI readiness and identifying the pillars that drive sustained business impact

The technology will continue to accelerate. The question is whether organizations will build the structures to harness it, or continue letting the untapped edge grow wider.

Sources: Deloitte, "State of AI in the Enterprise: The Untapped Edge" (January 2026); Gartner, "AI Maturity Matters: Increased Trust, Improved Effectiveness, Optimized Operations"; Johnson & Johnson AI Strategy pivot reporting; NIST AI Risk Management Framework.