Confidence in AI Governance Jumped. The Share of Firms Building Controls Into Their Agents Fell.

In one quarter, the share of US enterprise leaders who say they have the capabilities and governance to manage AI risk at scale rose from 57% to 73% (KPMG, 2026). Across roughly the same window, the share of organisations building controls into their agents, alongside monitoring and evaluation procedures, fell to 30% — down from 43% two quarters earlier. KPMG states the reason in a single clause: many are "relying on guardrails already in place."

Same survey. Same firms. Confidence rose as the controls closest to the agent came out.

The third number is the one that should move a decision this quarter. Organisations actively developing or implementing multi-agent systems climbed to 25%, from 6% in each of the previous two quarters. Complexity is compounding at the exact moment in-agent control is thinning — and AI agent governance is being asked to run on infrastructure that was built for a different problem.

What KPMG Actually Measured

The survey ran 24 July to 25 August 2026 and captured 314 US-based C-suite and business leaders at organisations with $1 billion or more in annual revenue; more than a third were above $10 billion (KPMG, 2026). That sample matters, and I will come back to it.

Two movements run in opposite directions:

The financial discipline is genuinely improving: 74% now include cost reviews in AI approval processes, up from 61% the prior quarter, and 70% use AI monitoring dashboards. This is not a story about careless organisations. It is a story about governance maturing in one dimension — spend, visibility, approval process — while a different dimension quietly deregulates.

Why AI Agent Governance Confidence Outran Control

The phrase "guardrails already in place" is doing a lot of work, so it is worth asking what those guardrails are.

KPMG itself lists what organisations include in their control layer: data access controls (59%), security and identity controls (53%), monitoring of AI outputs (47%), policy and guardrail enforcement (42%) and model access management (40%) (KPMG, 2026).

Read that list again as an operator. Every item governs access — which systems a model may reach, which identity it carries, which model may be called, and whether outputs look acceptable after the fact. Not one of them answers the question an agent raises: may this agent take this specific externally visible action, under whose name, inside what budget, and who can revoke it mid-flight?

Perimeter controls are necessary and they do not travel with the agent. An agent that has legitimately authenticated, is reaching only approved systems, and is calling an approved model can still send the wrong email to a client, issue a refund outside policy, or commit the company to a supplier. None of those is an access violation. Each is an action-authority question, and action authority is precisely what the 30% were building and 13 points' worth of firms stopped building.

The Gap Is Widest Where Deployment Is Fastest

A single agent calling a well-scoped tool is a manageable case under perimeter controls. A multi-agent system — where one agent's output becomes another's instruction — is not, because no perimeter sits between the two. That configuration went from 6% to 25% in two quarters. The control model was thinning out at the same time the architecture it governs became harder to reason about.

The Cost Explanation Nobody States Out Loud

There is an unglamorous reason in-agent controls get cut, and it is not complacency.

McKinsey's QuantumBlack team priced the variable run cost of a production agent and found that for a banking customer-service task, token costs frequently represent just 20 to 25 percent of variable run costs, while human oversight accounts for 70 to 75 percent (McKinsey QuantumBlack, 2026). In customer onboarding they expect 10 to 20 percent of agentic runs to be reviewed by risk and functional experts.

Oversight is not a rounding error in an agent business case. It is the business case. Which means every control that puts a human in the path of an action is a visible, recurring, quantifiable margin cost — and the moment a dashboard says things look fine, that line becomes the easiest one to defend cutting.

That is the mechanism behind KPMG's two curves. Rising confidence did not cause controls to fall. Rising confidence removed the argument for keeping an expensive control that had not yet failed loudly.

The Control-by-Design Counter-Evidence

If thinning in-agent controls were simply a rational efficiency, the firms doing it would be outperforming. The available evidence points the other way.

IBM's Institute for Business Value surveyed 2,000 C-level technology executives and compared organisations that embed control directly into AI systems against those relying on manual governance. The control-by-design group reported 25% fewer incidents, 16 times more AI agents deployed, 18% higher operating margins, and 4 times less of their AI budget consumed (IBM Institute for Business Value, 2026).

Built-in control was not the brake on deployment. It was the thing that made deployment survivable enough to scale — a 16x difference in agents actually running.

The same study puts the confidence figure in an uncomfortable light: 77% of these technology executives said AI adoption already outpaces their governance capabilities, two-thirds reported being held accountable for AI systems they do not fully control, and the average surveyed organisation logged 54 agent incidents in a year, 17% of them taking more than four hours to contain. KPMG's respondents are mostly C-suite and business leaders. IBM's are the CIOs and CTOs who would be paged. The 73% and the 77% are not necessarily contradictory; they may simply be measuring confidence at different distances from the incident.

The Honest Counter

Three limits, stated plainly.

This is a $1B+ sample, and that cuts against the obvious reading. More than a third of these firms are above $10 billion in revenue. A 200-FTE company does not have the identity management, access tooling and security review that these leaders are falling back on. So the finding does not transfer as "large firms are getting complacent, and we are fine." It transfers as the harder version: the pre-existing guardrails being relied upon here are mostly absent in the mid-market, which makes in-agent control less optional, not more.

Confidence is self-reported; the control figure is too. Nobody audited these organisations. A rise from 57% to 73% in one quarter is a large move in a belief, and beliefs can re-rate faster than capabilities do. Read the 73% as a sentiment reading, not a maturity assessment.

More oversight is not monotonically better, and the article should not pretend otherwise. Gans and Holden model oversight of agents that can conceal their actions and show that stronger auditing deters misconduct while raising concealment among agents that still violate — so the catch rate, the probability of detecting an agent that violates, can fall as auditing rises (Gans & Holden, NBER, 2026). Their deterrence conditions are specific: evidence of a violation has to survive concealment, the agent must not learn the audit draw before acting, and sanctions must scale rather than cap at forfeiting the task's reward. The implication is not "add more review." It is that control design beats control volume, and that audit trails which cannot be edited by the thing being audited are doing more work than review frequency.

What to Put in Place Before the Next Agent Goes Live

Four moves. None requires a platform programme, and KPMG's own data shows each is already normal practice rather than a frontier ask.

1. Write the never-autonomous list first. 49% of these organisations have defined high-risk use cases where agents are not permitted to decide autonomously — up from 28% a year earlier. This is a document, not a procurement. Name the action classes that always require a human decision before anything is deployed against them.
2. Put a ceiling on every agent. 43% already run usage or token budgets. Set a per-transaction and monthly limit so that a malfunction has a bounded cost rather than an open one, and so the finance conversation is about a ceiling instead of a surprise.
3. Attach a named human to each agent, not to the programme. "The AI committee owns oversight" is not an owner. A specific person who approves the action classes you did not automate, and who can revoke autonomy without filing a ticket, is.
4. Make the audit trail unwriteable by the agent. This is the operational reading of the concealment result: log the action, the approver and the revocation at the moment they happen, in a place the agent cannot amend. Review frequency is tunable later; evidence integrity is not retrofittable.

Those four are also the design most defensible under the EU AI Act's human-oversight obligations, which is a useful side effect rather than the reason to do it. If you want a worked reference for how per-action approval and earned autonomy are structured — approval requests that carry a name, autonomy granted per kind of action rather than per agent, an unanswered request that expires instead of passing silently, and a human supervisor required above every agent — Scovai documents its Digital Employee governance model publicly.

The deeper point is about what a confidence number can and cannot tell you about AI agent governance. The 73% is not wrong; those firms did build real governance, around spend, access and visibility. The controls they let go are the ones that sit between an agent and an action in the world, and nothing in a monitoring dashboard will report their absence until something has already happened.

Before your next agent goes live, find the list of actions it may take without asking anyone. If that list does not exist on paper, it is not empty — it is just unwritten.