CIO confession 4 of 6: Your AI agents need an org chart
October 29, 2026/5 min read/Julia Berman
A finance team builds an AI agent to flag duplicate invoices. HR launches one to answer benefits questions. A regional sales team connects an agent to the CRM through a tool IT has never reviewed. Each one solves a real problem, and each was built by people who know the work best.
Six months later, someone asks: how many agents does the enterprise run, and who owns each one? The answer takes weeks to assemble and still comes back incomplete.
Most CIOs recognize that moment. 84% of CIOs confessed that employees are creating AI agents and applications faster than IT can govern them. In the U.S., that figure rises to 94%.
This post is part 4 of Dataiku's six-part series on the “Global AI Confessions Report: CIO Edition, 2026,” a survey of 685 enterprise CIOs conducted with The Harris Poll. Part 1 traced how pressure to prove AI ROI travels from the board to the CEO to the CIO. Part 2 laid out four questions that show whether an agent is actually working. Part 3 showed how agents can pass every technical check and still put the enterprise at risk.
Now we turn to the report's third confession: AI agents are multiplying faster than IT can govern them. We'll look at where visibility breaks down, why finding an agent is only the start of managing it, and why accountability is the hardest piece to pin down.
Agent creation has moved beyond IT
Business teams are building their own AI applications and agents across teams, tools, and platforms. That momentum is a good sign. AI is reaching the work where value gets created. It also means the enterprise's agent portfolio now spans environments that no single team built or can fully see.
Governance is still catching up. For instance, 60% of CIOs don't have a central AI governance layer spanning enterprise applications, tools, and IT environments. Many governance models were designed for an era when IT built, deployed, and maintained most of the systems the enterprise ran on. Distributed creation calls for oversight that reaches every place an agent can be built.
Confidence in visibility fades at the edges
At first glance, the picture looks reassuring. 90% of CIOs claim they are confident they have complete visibility over and tracking of all agents.
That confidence drops when CIOs are asked specifically about shadow AI, meaning agents created outside an approved system or without formal submission to IT or business leaders. On that question, 81% lack complete oversight of agents.
The distance between those two numbers tells the story. CIOs can see the agents that came through approved channels. Shadow agents, by definition, never did. One might live inside an application's built-in agent features. Another might start as a simple automation and grow into something that acts on enterprise data.
That blind spot raises the stakes from part 3. An agent can drift from business intent while every dashboard stays green. An agent outside the visible network never appears on a dashboard at all.
It also changes what CIOs can show regulators, as 66% aren't completely confident they could produce an end-to-end audit trail for an agent decision if a regulator asked for one tomorrow. An agent no one can see is an AI agent no one can audit.
Finding an AI agent is where management begins
Once an agent is identified, it still has to be managed throughout its lifecycle. They need to be monitored and evaluated, modified when needed, and eventually retired. Like any business process, an agent rarely stays the same as new systems roll out and the enterprise evolves.
Today, each team tends to handle that lifecycle in its own way. For one, 83% of CIOs admit their companies don't have standardized agent lifecycle management across the organization. Agent portfolios are changing fast all the same. Nearly half of all CIOs (47%) claim they have already decommissioned more than 20 agents this year.
That turnover is healthy. It shows CIOs are actively pruning agents that no longer serve the enterprise. When every team retires agents differently, though, each retirement raises the same questions. Which workflows depended on the agent? Was its system access revoked? Did the people who relied on it know it was gone? A standard lifecycle answers those questions the same way every time, wherever the agent was built.
More models mean more ground to cover
The models underneath agents are diversifying too. The Mythos 5 and Fable 5 suspension this summer prompted CIOs to think differently about model dependency and continuity. Most are now preparing for a broader model environment:
Continuity: 75% plan to use more or different models for continuity.
Open models: 74% are considering open-source or open-weight models.
Risk assessment: 80% have conducted or plan to conduct an AI dependency risk assessment.
Each step makes the enterprise more resilient. Each also adds more places where agents run. Governance tied to a single model or platform covers only the agents built there. As portfolios span more models, the ability to manage AI consistently across all of them becomes essential.
Accountability is split five ways
When an agent makes a harmful decision, someone has to answer for it. CIOs are nearly evenly split on whether primary responsibility for harmful agent decisions belongs to:
Shared across multiple teams: 23%
Central IT: 21%
Data or AI team: 20%
Security, risk, or compliance: 18%
Workflow business owner: 13%
The top answer draws just 23%. Different teams naturally play different roles across an agent's lifecycle. The pressure point comes when something goes wrong. Enterprises need a clear path for who can intervene, who makes the call, and who ultimately answers for the outcome.
That clarity also determines speed. As part 3 showed, every hour an agent stays off course adds to the damage. When ownership is settled before an incident, the first minutes go straight to containment.
What distributed agent creation demands
The report draws a clear conclusion. Distributed AI agent creation demands agent management that delivers consistent visibility, lifecycle control, and accountability regardless of platform. In practice, that means three capabilities working together.
Visibility: Keep a single view of every agent, including shadow AI, with its owner, where it runs, the model it uses, and the systems it touches.
Lifecycle control: Apply one standard path for approving, monitoring, evaluating, modifying, and retiring agents, whichever team or tool built them.
Accountability: Assign a named owner and escalation path to every agent before it goes live, so intervention starts the moment an agent drifts.
"Regardless of platform" is the phrase that matters most. AI agents already run across many teams, tools, and models, and that variety will keep growing. Agent management has to span all of it.
From agent sprawl to a managed portfolio
Agent sprawl is a byproduct of progress. It means business teams are putting AI to work across the enterprise. CIOs who bring every agent into view, run each one on a consistent lifecycle, and assign clear ownership turn that sprawl into a portfolio they can measure, defend, and scale.
That matters because accountability stays with the CIO. As we covered in part 1, CIOs are putting their careers and budgets behind measurable AI outcomes. Building now happens across the enterprise, while accountability for results stays concentrated in the CIO's role.
The natural reflex is to pull every agent back under central IT. Stay tuned for our next post, which will look at why CIOs are choosing a different path and what it takes to give business teams room to build within governed guardrails.
