Pilots yes, readiness no: 64% are testing AI agents but only 3% are ready to govern them

By El Ecosistema Startup · November 2, 2026.

64% of organizations have already run pilots with AI agents, but only 3% consider themselves fully prepared to adopt them. That is the finding of The Value of AI 2026, a study by SAP with Oxford Economics based on 2,600 executives across 13 markets and reported by Diario TI. In addition, 83% say agents have moderate or very high transformative potential.

The same study estimates that AI is now involved in 30% of the tasks at an average company and would reach 48% within two years, by its own calculations.

The conceptual framework comes from Andrés Mendoza, technical director of ManageEngine for Southern Europe and Latin America, in an interview with EFE. He argues that agents are "the new internet users." An agent (a system that receives a goal, breaks it into subtasks, chooses tools and carries out much of the process without step-by-step supervision) already searches for information, interacts with applications and takes action. Mendoza acknowledges that it is a metaphor, and sums up the shift as moving "from browsing to delegating."

The governance market is moving in that direction, according to the sources cited. On October 27, at TechXchange (Atlanta), IBM unveiled an extension to HashiCorp Vault that issues short-lived credentials, along with an agent registry that tracks ownership, lifecycle and privileges. On October 7, Atlassian announced its AMP protocol (Agentic Multiplayer Protocol), which assigns each agent an owner and its own profile. And 1Password surpassed $500 million in annual recurring revenue, with 500% year-over-year growth in the non-human identities using its tools, according to Biometric Update.

There is also a warning. The Emergence World 2 experiment, published by El País, deployed agents in eight simulated worlds over 16 days; in some, about 55% of the messages were unintelligible to the researchers. Being observable does not mean being understandable.

Our take: the 64% vs. 3% gap is not a technology problem but one of organizational maturity, and it is a healthy one. A company that tests agents without knowing who is accountable for them is piling up risk debt. The underlying question, who answers when something goes wrong, will matter more than any model benchmark.

The winners will be those who treat an agent like an employee with credentials: its own identity, minimal permissions and a record of what it did. The losers will be those who deploy it as just another script. And the readiness figures should be read with caution: they come from executives' self-assessments, not audits, and are mostly published by players that sell precisely that control layer. In general, identity and security vendors are the first to benefit from any wave of autonomy.

The short term will bring incidents, cascading errors and some pressure on administrative roles, whose tasks are the most delegable. But the underlying logic is sound: if limits, traceability and accountability are built in by design, delegating routine work to machines is the path to freeing human time for what requires judgment and vocation. That abundance of time will only come if autonomy is governed before it is scaled.