The ROI conversation has gotten more precise
Doug Gilbert of Sutherland frames the central question enterprise technology leaders are asking heading into 2027 bluntly: are we building value or are we just burning tokens. That question reflects a maturing of the AI conversation inside enterprises, moving past the earlier era of pilot programs justified by novelty alone and into a phase where rising per-query and per-agent-action costs force a harder look at whether specific AI deployments produce returns that justify their ongoing operating cost, not just their initial build cost.
Gilbert's second priority follows directly from the first: we will not deploy any AI that we cannot observe. Observability and auditability of AI systems are no longer treated as a nice-to-have governance layer bolted on after deployment. They are becoming a precondition for deployment itself, because an enterprise cannot manage what it cannot measure, and a model whose outputs cannot be traced back to specific inputs and decisions is one that cannot be reliably improved or defended if something goes wrong.
Autonomy is being rationed deliberately
Jody Fullman of Reconomy describes the central operational challenge as moving AI from human-assisted agentic processes to much more autonomous ones, while staying secure and cost-effective. That framing captures where most enterprises actually sit today: comfortable with AI agents that assist human decision-makers, but still working out how much unsupervised authority to grant agents operating independently, and how to do that without creating new categories of risk that current controls were never designed to catch.
Amy Farrow of Celigo lays out the governing principle plainly: agents start with the minimum autonomy needed, hold fewer permissions than the people they act for, and require human sign-off for major changes. That is a notably conservative default, deliberately asymmetric in favor of caution, and it reflects a lesson many enterprises have already learned the hard way, that granting an AI agent the same permissions as the human whose work it automates is a much larger risk than it initially appears, because an agent can act at a scale and speed no single human ever could.
Vendor-embedded agents are the next governance frontier
Perhaps the sharpest new governance question in this survey concerns AI agents that vendors embed directly inside enterprise systems, rather than agents the enterprise builds and controls itself. Farrow's framing is the one every enterprise technology leader should adopt as policy: the vendor's agent did it is not a defensible answer. As more software vendors ship agentic capability built into their platforms by default, enterprises are losing visibility into what those agents access and do inside their own systems, often without a clear contractual or technical mechanism to audit that behavior independently.
This is a governance gap that existing vendor risk management programs, built around traditional software features and data processing agreements, were not designed to catch. Enterprises should expect to renegotiate vendor contracts specifically to cover agentic behavior, visibility, and accountability as a distinct category from standard data processing terms, because the two carry meaningfully different risk profiles and the contractual language covering one does not automatically cover the other.
The talent constraint is now the binding one
Lauren Wilkinson of Vanguard identifies AI as the most sought-after and hardest-to-find skill in the current market, and crucially argues that the real differentiator will not simply be who has access to the best AI technology, since that access is increasingly commoditized across vendors and tiers. The scarce resource has shifted from model access itself to the people who understand both the technology and the specific business context well enough to deploy it effectively inside a particular organization.
That shift has real implications for how enterprises should be allocating hiring and development budgets heading into 2027. A technically excellent AI specialist who does not understand the specific business processes they are meant to transform is a weaker hire today than a strong business operator with solid AI fluency, a reversal of the skills hierarchy many enterprises were still implicitly operating under as recently as a year or two ago.
The ambition question is the one worth sitting with longest
Wilkinson's other contribution to this survey may be its most important: the question of whether current AI ambitions are bold enough, pushing leaders to reconsider what outcomes with AI are possible rather than simply using AI to speed up processes that already exist. That reframing, from acceleration to reinvention, is the hardest one for most enterprises to actually act on, because it requires starting from a desired business outcome and working backward to the technology, rather than starting from the technology an enterprise already has and asking what it can speed up.
Shelia Anderson of Unum Group's framing of 2027 as a year of maturing captures where this collective thinking seems to be heading: less about whether AI works, which most enterprises have already answered for themselves through two or three years of pilots, and more about whether the organization's ambition, governance, and talent strategy are actually sized to match what the technology can now do. Enterprise leaders reviewing their own 2027 technology agendas should treat that maturing framing as a checklist, not just a mood, and ask whether each of their own current AI initiatives has grown past the pilot-justification stage into a genuinely ambitious bet on new outcomes.
