42% of Companies Plan AI Agent Autonomy by 2030. Only 5% Have the Controls.

Only 5% of companies have the full set of governance controls for AI agents in place today, yet 42% expect to give those agents genuine autonomy by 2030. Both numbers come from the same Boston Consulting Group research, released September 30, and the distance between them is the AI agent autonomy story I would put in front of every leadership team this quarter.

The headline BCG chose was calmer, and it is good news. Nearly half of companies, 48.5%, now capture meaningful value from AI: a "future-built" 7.5% plus a "scaling" 41%. In 2025 that figure was 5%, so this is a roughly 10x jump in under a year. Nicolas De Bellefonds, BCG's global AI leader, described the mood the new data overturns: "The perception is that AI isn't delivering." For close to half of companies, it now is.

Hold the two 5% figures side by side. A year ago, 5% of companies were getting meaningful value from AI. Today, 5% have the full set of controls their agents need. The first number moved 10x in a year, and the second one now has to make the same climb from the same starting line.

The money moved faster than the oversight

AI spending has risen to 3.3% of revenue, up from about 1.7% in late 2025. It roughly doubled in less than a year, and BCG found that more than 80% of it now sits outside the enterprise IT budget entirely. Michael Grebe, a BCG managing director and senior partner, summed it up in one line:

"AI spending has doubled in less than a year, and much of it no longer sits in the enterprise IT budget."

That detail deserves more attention than the headline. Most corporate AI governance was built around a purchase that ran through the CIO, with an architecture review and a security sign-off along the way. When more than 80% of the money flows through business units, much of it never reaches those checkpoints.

BCG's companion publication on agentic AI, released in July, makes the same point from the operations side. Only around 15% of companies have the enterprise backbone, meaning the operational and governance infrastructure, to run agentic AI at scale. BCG says that shortfall is "closing more slowly than agentic adoption grows."

This is what rules written for a slower world look like from inside a company. The slow institution in this story is each company's own governance process, and it is the thread running through everything I write about AI governance: organizations trying to govern something that moves faster than their own rule-making cycle. Quarterly risk reviews and annual policy refreshes were designed for software that did what it was told and waited for the next release. An agent with genuine autonomy makes its decisions between those meetings.

Yesterday I wrote about California's attorney general subpoenaing OpenAI over cybersecurity incidents involving its AI models. That is oversight arriving from outside a company. The BCG numbers describe the oversight each company builds for itself, and 95% of companies still have that work ahead of them.

Autonomy ahead of accountability builds a learning debt

Every month that agent-autonomy plans run ahead of governance, a company defers two questions. Who audits what the agent did yesterday? Who is accountable when it gets something wrong? Those questions are the principal on the learning debt, and like any debt it compounds. Ten agents with unclear owners are a manageable problem. A thousand agents, each wired into live systems, become a retrofit that nobody wants to fund.

The economic historian Paul David found a similar pattern in electrification. Factories owned electric motors for decades before productivity moved, because many kept floor plans designed around a single steam-driven shaft. The payoff came once managers rebuilt the work around the new power source. Agent autonomy asks for the same rebuild, applied to oversight. The review cycle and the name attached to every decision have to be redesigned around a worker that never waits for a meeting.

Agents act in seconds. Governance calendars still run by the quarter.

Behind each of those 42% is a person who will get the call the first time an agent approves a refund or changes a price that nobody signed off on. That person may not know yet that the job is theirs. They deserve to know before the call comes, and they deserve the training to answer it.

I spent 20 years at Cisco, where I shaped a $1.1B innovation portfolio and helped decide what to build and what to cut, and today I advise the California State University system on AI governance. In both settings, the first question worth asking about any new capability is the same one: who answers for it when it goes wrong?

These are the questions I am taking into my own conversations this fall, and you are welcome to borrow them. Which decisions do your AI agents make today without a named human owner? And does your governance process see the AI spending that sits outside IT, or only the share that runs through the CIO?

If you work alongside an agent, you have a question of your own. Ask who reviews its work, and whether that person is you. The skills to supervise agents are being learned right now, on the job, and the people who build them early will carry that advantage into every role that follows. It is the pattern at the center of the book I am writing now, The Great Relearning.

Most companies, 95% of them, are still building these controls, so yours is in good company. The 42% have already decided how much freedom their agents will get. The question for your company is who signs for it. I'm easy to find.

Here is what makes Alex a credible voice on this topic: As an AI governance advisor to the California State University system who shaped Cisco's $1.1B innovation portfolio for 20 years, Alex works on the question this BCG research raises: how oversight catches up once AI agents act on their own.

Bringing this conversation to your leadership team or association? book a conversation →