--- title: "Nobody knows how many AI agents they have. We're changing that." date: 2026-03-31 author: david excerpt: "Roval is launching the State of AI Agent Governance 2026 survey, the first practitioner-led benchmark focused on how enterprises govern autonomous AI agents. Here's why the industry needs it and why your data point matters." category: research tags: [governance, survey, research, enterprise, ai-agents, eu-ai-act, nordic, benchmark] draft: false tldr: "AI agent adoption more than doubled in 2025, but only 21% of organizations maintain a real-time registry of their agents. Existing research covers AI broadly but not agent-specific governance controls. The State of AI Agent Governance 2026 is a 10-minute survey measuring six dimensions: adoption reality, governance maturity, incidents, regulatory readiness, organizational structure and forward intent. Participants get early access to the published report with benchmarks by industry, region and agent estate size." seo: title: "State of AI Agent Governance 2026 survey: the first practitioner-led benchmark" description: "Agent adoption doubled in 2025 but only 21% of organizations maintain a real-time agent registry. Take the 10-minute survey and benchmark your governance posture against peers by industry, region and estate size." faqs: - question: "What is the State of AI Agent Governance 2026 survey?" answer: "A 10-minute practitioner-led survey measuring how enterprises govern autonomous AI agents across six dimensions: adoption reality, governance maturity, incidents and near-misses, regulatory readiness, organizational structure and forward intent. It produces the first cross-tabulated benchmark by industry, region and agent estate size." - question: "Who should take the survey?" answer: "CTOs, CISOs, Heads of AI/ML, Compliance Officers and Platform Engineering leads at enterprises deploying AI agents. The survey is designed for practitioners who make or influence governance decisions, not for vendor evaluation." - question: "Is the survey anonymous?" answer: "Yes. Every response is anonymized by default. Participants choose whether to opt in for attribution. The data feeds an aggregated published report, not a sales pipeline." - question: "What do participants get?" answer: "Early access to the published report before public release and an invitation to a private briefing on the findings. The report includes benchmarks by industry, region and agent estate size so you can compare your governance posture to organizations that look like yours." - question: "How is this different from existing AI surveys?" answer: "Existing surveys from KPMG, Deloitte, Gartner and the CSA cover broad AI adoption or specific slices like identity management. None focus on the full set of operational governance controls for AI agents: registry, [risk classification](/research/blog/ai-agent-risk-classification), lifecycle management, policy enforcement, compliance certification and incident response. None produce cross-tabulated data by agent estate size and governance maturity." - question: "Why does the Nordic perspective matter?" answer: "Nordic board-level AI policy adoption is among the lowest in Europe: 0% in Finland, 9% in Denmark, 10% in Sweden, 14% in Norway. Only 4% of Nordic companies report strong AI returns. With the EU AI Act taking effect in August 2026, the region that prides itself on transparency is flying blind on agent governance." --- :::cta{title="Take the survey" description="10 minutes, anonymous by default. Your data point becomes the benchmark the industry references tomorrow." cta="Start the survey" href="/contact"} ::: AI agent adoption is surging. According to [KPMG's Q4 AI Pulse Survey](https://kpmg.com/us/en/media/news/q4-ai-pulse.html), agent deployment more than doubled in 2025, rising from 11% of organizations in Q1 to over 26% by Q4. [Gartner predicts](https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025) that 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from under 5% in 2025. And governance? Barely off the starting line. [Deloitte's State of AI in the Enterprise 2026](https://www.deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/content/state-of-ai-in-the-enterprise.html) found that only one in five companies has a mature model for governing autonomous AI agents. A [Cloud Security Alliance survey](https://cloudsecurityalliance.org/blog/2026/02/24/the-visibility-gap-in-autonomous-ai-agents) published in February reported that just 21% of organizations maintain a real-time registry of their agents. Only 28% can reliably trace an agent's actions back to a responsible human across all environments. At RSA 2026 last week, [Cisco presented survey data](https://usdm.com/resources/blogs/agents-without-owners-what-rsa-2026-revealed-about-the-agentic-ai-governance-gap) showing that 85% of organizations are adopting agents, but only 5% have scaled them to production. The blocker isn't technology. It's trust, security and governance. This is the gap we're setting out to measure. ## Why existing research doesn't go deep enough There's no shortage of AI reports. KPMG, Deloitte, Gartner and the CSA have all published valuable data on AI adoption, security posture and agent identity. But none of them focus on the operational governance controls that enterprises are (or aren't) putting in place for AI agents. - **KPMG's Pulse Survey** covers 130 US-based C-suite leaders at billion-dollar companies. It tracks broad AI investment trends, not agent-specific governance controls. - **Deloitte** surveys 3,235 leaders across 24 countries, but governance is one section among many in a wide-ranging AI maturity report. - **The CSA/Strata study** goes deep on identity and access management for agents (a critical piece) but doesn't cover lifecycle management, policy enforcement, compliance certification or organizational governance structures. None of them produce cross-tabulated data by agent estate size, governance maturity and region that practitioners can use to benchmark against their actual peers. ### The Nordic blind spot Almost none of these surveys capture the Nordic and European perspective in meaningful detail. [EY's Responsible AI Pulse Survey](https://www.ey.com/en_no/insights/ai/how-nordic-leaders-can-drive-responsible-ai) found that 74% of Nordic CxOs believe their AI controls are moderate to strong. But when measured against EY's nine-principle responsible AI framework, organizations only demonstrate strong controls in three out of nine areas. [BCG's Nordic AI report](https://www.bcg.com/publications/2026/nordic-ai-value-creation-or-bubble), published in March 2026, found that over half of Nordic companies operate with decentralized models that limit clear governance ownership. Only 4% report achieving strong returns on their AI investment. [Glass Lewis research](https://www.glasslewis.com/article/the-current-state-of-board-ai-policies-and-oversight-in-europe-in-2025) shows Nordic board-level AI policy adoption is among the lowest in Europe: - Finland: 0% - Denmark: 9% - Sweden: 10% - Norway: 14% The region that prides itself on transparency and responsible technology is flying blind on agent governance. With the EU AI Act's high-risk system requirements taking effect in August 2026, these gaps aren't academic. They're operational, financial and regulatory. ## What this survey measures The State of AI Agent Governance 2026 is a 10-minute survey designed to produce the first practitioner-led benchmark focused entirely on how enterprises govern AI agents. Not AI broadly. Not models. Agents: the systems that reason, access tools and take autonomous action inside your infrastructure. The survey covers six dimensions across 20 questions. **1. Agent adoption reality.** How many agents are deployed? What types? What level of decision authority do they hold? And critically: how confident are you that those numbers are accurate? **2. Governance maturity.** Does your organization have a formal agent-specific governance framework? Do you maintain a [centralized registry](/platform/agent-registry)? How do you classify agent risk? The survey measures adoption of 11 specific governance controls, from unique agent identity assignment through to decommissioning processes. **3. Incidents and near-misses.** Has an agent accessed data it wasn't authorized to access? Taken actions outside its intended scope? Has an orphaned agent been discovered running in production with no owner? These questions produce incident prevalence rates the industry currently lacks. **4. Regulatory readiness.** Can you produce, on demand: - A complete audit trail of an agent's actions on a specific date? - Evidence of compliance certification? - A record of all human oversight interventions? These are the questions the EU AI Act will require you to answer. We want to know how many organizations can answer them today. **5. Forward-looking intent.** Are you scaling agents or pausing? Building governance before scaling, or scaling first? Planning to adopt a dedicated governance platform? **6. Organizational structure.** Who owns agent governance in your organization? A dedicated team? An existing function? Nobody? Every response is anonymized by default. You choose whether to opt in for attribution. The data feeds an aggregated, published report, not a sales pipeline. ## What you get Participants receive: - **Early access** to the published report before public release - **An invitation** to a private briefing on the findings - **Benchmarks** by industry, region and agent estate size so you can see how your governance posture compares to organizations that look like yours If you've been in a board meeting unable to answer how many agents your organization has, or sat in a compliance review wondering whether your agent controls would survive scrutiny, your experience is exactly what this research needs. :::cta{title="Take the survey" description="10 minutes, anonymous by default. Your data point becomes the benchmark the industry references tomorrow." cta="Start the survey" href="/contact"} ::: ----- *The State of AI Agent Governance 2026 is a research initiative by [Roval](https://roval.ai), the governance platform for AI agents. The survey is open to CTOs, CISOs, Heads of AI/ML, Compliance Officers and Platform Engineering leads. The published report will be freely available.* ## Sources | Source | Link | |---|---| | KPMG, Q4 AI Pulse Survey | [kpmg.com](https://kpmg.com/us/en/media/news/q4-ai-pulse.html) | | Gartner, 40% of Enterprise Apps Will Feature AI Agents by 2026 | [gartner.com](https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025) | | Deloitte, State of AI in the Enterprise 2026 | [deloitte.com](https://www.deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/content/state-of-ai-in-the-enterprise.html) | | Cloud Security Alliance, The Visibility Gap in Autonomous AI Agents | [cloudsecurityalliance.org](https://cloudsecurityalliance.org/blog/2026/02/24/the-visibility-gap-in-autonomous-ai-agents) | | Cisco/USDM, Agents Without Owners: RSA 2026 | [usdm.com](https://usdm.com/resources/blogs/agents-without-owners-what-rsa-2026-revealed-about-the-agentic-ai-governance-gap) | | EY, How Nordic Leaders Can Drive Responsible AI | [ey.com](https://www.ey.com/en_no/insights/ai/how-nordic-leaders-can-drive-responsible-ai) | | BCG, Nordic AI: Value Creation or Bubble | [bcg.com](https://www.bcg.com/publications/2026/nordic-ai-value-creation-or-bubble) | | Glass Lewis, Board AI Policies in Europe 2025 | [glasslewis.com](https://www.glasslewis.com/article/the-current-state-of-board-ai-policies-and-oversight-in-europe-in-2025) | | Roval, The AI Agent Governance Framework (8 Pillars) | [roval.ai](/research/blog/ai-agent-governance-framework-8-pillars) | | Roval, 10 Questions Every CTO Should Ask About AI Agents | [roval.ai](/research/blog/10-questions-cto-ai-agents) |