Publicis Sapient surveyed 1,550 AI decision-makers for its 2026 Global Enterprise AI Report. 73% of them use AI regularly or across most of their processes. Only 10% say AI is core to how their business operates. That is the whole story of enterprise AI right now, told in two numbers: almost everyone is using it, almost nobody is running on it.
I have run 40 GenAI deployments into enterprises, every one of them through security review, and the space between 73 and 10 is where I work. The most useful number in the report is actually the third one: 42% of respondents say AI is capable but their organization is not set up to capture the value. Read that carefully. Almost half the people paying for these systems say the model is fine. The failure is somewhere else, and they know it.
It was never the demo
The demo has been good for a while now. Anyone can build a pilot that summarizes tickets or drafts responses, show it to a leadership team, and get applause. The pilot then enters a phase nobody budgeted for, and this is where the 90% goes missing.
The moment that decides an AI rollout is not the demo. It is the meeting three or four weeks later, where a security admin asks who is accountable when the model sends something wrong to a customer, what data leaves the tenant, and who reviewed the vendor's retention terms. Then the room goes quiet, because the pilot team treated those as someone else's questions. I have sat in that meeting many times. The admin is not being obstructionist. The admin is doing their job, and they are usually right.
So the 90% that goes missing is not sitting inside the model waiting for a better checkpoint. It is sitting in the operating model: who owns the workflow, how quality is checked, how security signs off, how anyone would know if the thing stopped working. A better model does not answer any of those questions. That is the thesis I keep coming back to: AI adoption is not a demo problem. It is a trust, workflow, and ownership problem.
What the 10 percent actually do
The organizations where AI is core to operations are not the ones with the smartest model. In my experience they do four unglamorous things.
First, every AI workflow has a named owner. A person, not a committee, not "the AI team." When output quality drops or the workflow needs to change, there is one name on it, the same way there is a name on the payroll run. Workflows without owners decay quietly until someone notices in a customer escalation.
Second, the security sign-off path is designed in, not begged for after. The teams that clear review fast are the ones that show up with the data-flow diagram, the access scoping, and the failure modes already written down. In the deployments I run, the sign-off memo is a design artifact that exists before the pilot, and security is a reviewer of a plan rather than an emergency brake on a surprise. That single change is most of the difference between clearing review in weeks and stalling for months.
Third, they measure the workflow before and after. Minutes per ticket, error rate, rework rate, escalation rate. Not "user satisfaction with the AI assistant," which measures the demo. If you did not measure the workflow before the model arrived, you cannot claim it improved, and the CFO eventually notices.
Fourth, quality drift fails loudly, in CI, before it fails quietly in front of a customer. This is the pattern I open-sourced in llm-judge-evals: keep a golden dataset of inputs with known-good outputs, run a judge model over the system's current outputs, and fail the build when scores drift below threshold. Models get swapped, prompts get edited, vendors push silent updates. Without an eval gate, the first person to notice a regression is a user. With one, it is a red pipeline, which is the cheapest place a failure can happen.
None of this is exotic. It is the same operational discipline enterprises already apply to payments and deployments, extended to a system that is probabilistic instead of deterministic. That extension is the actual work.
Why "agents for everyone" dies in security review
The current version of the demo trap is agents. The pitch is to roll coding and workflow agents out to the whole company. Then it reaches security review, and OWASP's State of Agentic AI Security report from June 11 explains what happens next: prompt injection maps to six of the ten categories in OWASP's Agentic Top 10, and coding agents are the epicenter — 28 of the 53 agentic projects OWASP tracks are coding agents, and the top repositories by security advisories are n8n at 57, Claude Code at 22, and AutoGPT at 15. Only 37% of organizations say they can even detect shadow AI in their environment.
That report reads like ammunition against adoption. I read it the opposite way. It is a map of exactly why the blanket rollout fails and the scoped one survives. An agent with access to sensitive data, exposure to untrusted content, and the ability to act externally is the configuration OWASP flags via Simon Willison's "lethal trifecta" heuristic, and it is what "agents for everyone" ships by default. The 10% ship the narrow version instead: scoped permissions, a named owner, untrusted-input boundaries, an eval gate on output. The security admin approves that version, because it comes with answers instead of enthusiasm.
The regulation clock slowed down, not stopped
On May 7 the EU reached a political agreement to postpone key AI Act high-risk deadlines: roughly 16 extra months for new Annex III high-risk systems and about 12 for product-safety components, with formal adoption expected before the original August 2 date. Penalties still run up to 7% of worldwide turnover.
Some teams heard that as a pass. It is breathing room, and the honest question is what you do with it. The compliance obligations coming (risk management, logging, human oversight, documented accountability) are the same operating-model machinery the 10% already built, because named owners, sign-off paths, measured outcomes, and eval evidence are what a regulator asks for too. Teams that spend the extension building that machinery will find compliance mostly done. Teams that spend it shipping more demos will do a panicked retrofit in 2027, and retrofitted accountability is expensive and ugly.
The missing 90% was never going to arrive in a model release. It arrives one owned, measured, signed-off workflow at a time. That is slower than a demo and much less fun to present. It is also the only version that survives contact with the security admin, the CFO, and eventually the regulator, which is to say the only version that counts.