Consultancies, hyperscalers and frontier labs publish AI playbooks faster than anyone can read them. Nobody has read them all. Read across 269 of them, 76% published in 2025–26, the disagreements are smaller than the noise suggests — as is the list of things that demonstrably work.
Updated August 2026 · newest source August 2026
Answers come from this index's own analysis — the named issues, the sourced positions and the owned steps. Every line links to the publisher it came from. Nothing here is generated from publishers' text.
Everything added to the index appears here automatically as it is added — this is a record, not a selection. Listed from Aug 13.
If a transformation plan does not have an answer to each of these, it is not yet a plan.
Where an agentic transformation works, $1 of technology is matched by $3 of process redesign and $5 of capability building. McKinsey’s point is that most companies fund it the other way round.
McKinsey & Company · August 2026 >40% agentic projects abandonedGartner’s forecast for the share of agentic AI projects cancelled by the end of 2027, on runaway cost, unproven value or thin risk control. EY cites it to argue the outcome is avoidable rather than fated.
Gartner, cited by EY and Capgemini · June 2026 $18T value modelled as trappedValue modelled across the Global 2000 and its $32.4T of combined revenue, from what 2,002 executives estimate clearing their two most burdensome debts would return. 85% say those debts limit their AI value today.
Genpact & HFS Research · June 2026 78% of savings, two decisionsInfosys reads the research on AI cost governance as putting roughly 78% of achievable savings in two decisions: how model calls are routed, and how retrieval is governed. Governing before scaling cuts AI infrastructure cost 40–50%, with no loss of capability.
Infosys · June 2026Share of the 269 sources that substantively address each theme, and how many distinct publishers raise it. Measured across every document, not hand-picked.
How many of the 269 sources substantively discuss each theme. This measures the index rather than the industry: a short bar can mean the theme is under-sourced here, not that publishers are quiet about it.
Findings with a number attached and a named source. Every one of these is a structural change, not a tool purchase.
In the early-adopter teams on one bank’s 400-component core modernization, time and effort fell by more than half, with people moved to supervising agent squads that document, write, review and integrate code. Reported by the consultancy from its own engagement.
McKinsey & Company · March 2025Among 100 sales leaders whose organizations already run agentic AI, 89% report a positive effect on growth, 87% on rep productivity and 61% on lead conversion. The gains cluster in the earliest commercial steps — identifying which accounts to chase and in what order — while nurture further down scores mid-range. Adopters only, and self-reported.
Oliver Wyman35% of companies said they had an AI strategy in place, and 78% of those reported returns from generative AI (Google Cloud, 2024). Separately, organizations with someone owning AI at C-suite level report 10% higher return on AI spend — IBM counted equivalent roles as well as the formal title, so this is not evidence for creating a new seat.
Google Cloud · IBM · October 2024The pattern is consistent: effort spent adding AI to the existing shape of the work, or waiting for the economics to fix themselves.
Grafting AI onto task flows that should first have been eliminated or consolidated makes low-value work faster and leaves the cost structure where it was. BCG rates the companies furthest along on AI maturity as reporting roughly three times the cost reduction of laggards — self-reported, and measured only inside the areas where AI is applied.
Boston Consulting Group · July 2026Total spend is set by how the system is built, not by the list price. Ungoverned retrieval and a default to frontier models are the two decisions that dominate the bill, and both are configuration rather than rebuild. The unit of management has changed.
BCG · Infosys · July 2026General-purpose assistants deploy fast and cheaply, and the time they save is real — but it lands a few minutes at a time across thousands of people, where no P&L line records it. The changes that show up in results are built into a single function’s process, and McKinsey estimates most of those are still short of production.
McKinsey & Company · March 2025FinOps exposes infrastructure cost well and is the right starting point — but a token bill moves with prompt length, retrieved context, model choice and how long an agent keeps going before it settles. The same spend belongs in three places at once: capital where it builds reusable capability, operating where it runs internal work, cost of goods where it sits inside the product.
Boston Consulting Group · July 2026Genpact and HFS put $18 trillion of recoverable value behind four interlocking debts. 85% of leaders say those debts actively limit AI value; over half have no funded plan to address them.
The gap between the data firms hold and what AI needs. Data quality failures delay, degrade or sink 42% of analytics and AI initiatives. Cited as the single biggest blocker.
Workflows that are largely undocumented and hard to change — fewer than half are formally documented. Point an agent at one unaltered and it carries out the same flawed sequence, only faster and at scale.
Core enterprise systems run to about ten years old on average, and roughly two fifths of development-team time goes to maintaining the debt they carry rather than building anything new.
The readiness gap that quietly compounds all three other debts — and the one whose cost never lands in a ledger of its own.
Among 1,000 C-level executives, 61% say something in their AI estate — a model, its data, or the assets around it — was breached in the past year. In a separate survey of 300 security and IT professionals, only about a quarter are confident their organization can run a security strategy for AI; 21% say plainly that they are not, and half sit on the fence.
IBM with Palo Alto Networks · Cloud Security Alliance with Google CloudThe range most often quoted for market capitalization lost after a serious breach of trust. Follow it back and it is older and broader than it looks: Deloitte relays it here from its own 2021 work on institutional trust, which in turn attributes it to earlier research. It predates generative AI and is not about AI at all — carried here because it is the order of magnitude an AI governance failure is being weighed against, not because anyone has measured that.
Deloitte, relaying its 2021 trust research · October 2024As the stack consolidates, dependence shifts from the platform to the reasoning layer that shapes how the organization thinks. Where the boundary sits around the company’s own IP, essential data and business rules is a chief-executive question, and not one to settle inside IT alone.
Boston Consulting Group · August 2026Token spend behaves nothing like a software licence. It scales with usage, it has no natural budget owner, and the crossover points that decide build-versus-rent arrive faster than most planning cycles.
Deloitte’s modelled comparison at equivalent configuration and token volume: once demand is sustained, an owned AI factory is roughly 2.1× more cost-effective than metered API hosting over three years.
The curve moves fast in both directions: Deloitte models a greater than 90% fall in cost per billion tokens between year one and year three for the owned path, against roughly 150% annual TCO growth as volume climbs. The decision is therefore about sustained demand, not today’s per-token price. Two architectural choices — how model calls are routed and how retrieval is governed — account for 78% of achievable savings, and programmes that put governance in before scaling spend 40–50% less.
Ordered by how much the research agrees on them and how early they gate everything downstream.
McKinsey finds the transformations that work put three dollars into reshaping how the work runs, and five into teaching people to run it, for every one spent on the technology. Read as a budget test, a plan without that shape is not funded.
Meter tokens per workflow, not per platform, before scaling. FinOps was built for infrastructure and does not price a loop an agent runs; the unit that matters is cost per useful outcome, with an owner on every material workflow.
Both publishers argue the value sits in eliminating and reordering steps rather than adding assistants to them, and that spreading AI thinly is what produces diffuse benefit and no earnings impact. Pick where value is concentrated and rebuild the whole path.
Anthropic’s security team screens every agentic use case on four axes: which of its inputs an attacker could write, which actions it can take and under whose identity, how far the damage reaches if it goes wrong, and whether its actions can be told apart from a person’s in your logs. Give it the least reach that still completes the work.
McKinsey finds readiness is the link between structured and unstructured data rather than a cleanup of either alone, and that governance has to reach the embedding and retrieval layer instead of stopping at the document. Genpact ranks data debt alongside process debt and finds the two are created by the same manual work. Sequencing the paydown behind the workflows you are rebuilding is our own recommendation.
Frame what AI means for value creation yourself, run hands-on sessions, and consider a transformation committee of the more fluent directors rather than waiting for the full board to catch up.
A modular, layered stack with a security perimeter around proprietary knowledge lets you adopt better models as they arrive. Decide sovereignty deliberately rather than inheriting it from a vendor roadmap.
Ranked by publisher standing, how many of the consensus themes each document substantively covers, and depth of treatment — capped at two per organization so no single firm dominates. Summaries are ours, written after reading each document in full.
Anthropic's deputy CISO on the framework his team applies before approving an agentic use case: what untrusted content it ingests, what actions it can take and on whose behalf, what the blast radius is if it misbehaves, and whether its activity is observable at all.
States that one answer can be assembled from fragments of many documents at once, so the trail is not straightforward, and identifies unstructured data entering and exiting AI systems with little traceability as a major challenge.
Argues the opposite of consolidation: train people inside the delivery and data science teams to run their own reviews and to recognise when to escalate, on the reasoning that a single central function becomes the gate every review waits at, and that each hand-off across an organizational boundary costs something. Offers its own internal programme as the worked example, and is explicit that the posture has to be enablement rather than refusal.
Reports 36% higher AI ROI for Chief AI Officers running hub-and-spoke or centralized operating models than for those managing decentralized ones, and roughly twice as many pilots reaching production, from a survey of more than 600 such officers fielded in the first quarter of 2025.
Names the pattern precisely: someone with low privilege induces a high-privilege agent to do what they could not do themselves, and because the action genuinely executes under the agent's trusted identity, the record it leaves reads as legitimate and pushes detection further out. Adds the credential half - keys and tokens that are static, shared between agents, or weakly held let an attacker act as the agent rather than merely through it, which defeats behavioural guardrails and the monitoring tuned to normal behaviour at the same time.
A three-layer framework covering vision and strategy, an agentic development lifecycle, and the horizontal capabilities underneath. Its distinguishing feature is operational: each stage names objectives, inputs, activities, owners and deliverables, so it can be run as a programme rather than read as a point of view.
Widens the picture by listing what a regulated firm is already tracking, and the length of that list undercuts the idea of three blocs - though the items are not equivalent regimes. In the United States alone it names a federal executive order, a federal bill, the NIST framework, a securities regulator notice, statutes in Colorado and Texas, and a privacy regulator's automated decision-making rules in California. The United Kingdom appears not as a statute but as a government department and two regulators publishing separately. Asia-Pacific carries national laws in South Korea and Japan, Australian guidance alongside a voluntary safety standard, a Singapore consultation aimed at financial institutions, two Hong Kong publications and an ASEAN guide. The list is offered as non-exhaustive and omits China entirely, so it is a picture of the tracking burden rather than a census.
A 63-page assessment model built by Carnegie Mellon's Software Engineering Institute with Accenture. Five maturity levels are scored across eight dimensions covering strategy, workforce, workflow and risk on one side, and data, engineering, operations and ecosystem on the other. Piloted with Fortune 500 early adopters.
Proposes a concrete measure that separates working systems from demonstrations: count only tasks meeting the quality bar, divide full cost - including employee time, human review, retries and rework - by that number, and track results as ready to use, needs correction, or needs escalation.
A survey of more than 2,000 executives across 16 industries, conducted with HFS Research, which quantifies four interlocking obstacles: data, process, technology and talent debt. Its contribution is sizing them individually and modelling what resolving them is worth.
Describes investing in production capabilities including safe model deployment and automatic model retraining, and tooling that measures model quality across all stages, precisely because manual maintenance does not scale.
Records the reasoning directly: if the agent gives the wrong answer and the employee acts on it, it is still the employee's mistake, so people are reluctant to rely on tools they do not fully understand where accuracy, professional judgment and reputation are on the line.
Reports leaders investing in few high-priority opportunities with roughly double the ROI impact instead of hundreds of use cases, backed by around twice the investment in AI capability and twice the people.
Proposes the surrounding structure in which an individual control sits, so that a disabled control is visible as a gap rather than as a local preference.
Records that both sides found the activity independently and began containing it - while itself treating that detection as insufficient, since the monitoring in place during internal testing is named among the things to strengthen and the systems had already gained network access, escalated privilege and reached a third party's production database before anyone noticed.
Describes subagents operating in parallel with their own context windows and condensing the most important tokens back to a lead agent, which is a context management strategy as much as a capability one.
A short executive perspective on why AI cost programmes underdeliver. BCG reports only a small minority generating value at scale, with leaders achieving roughly three times the cost reduction of laggards, and identifies the traps: fragmented initiatives, and AI layered onto processes instead of removing steps.
States the case directly: the tolerable error rate is set by what the agent is wired to, not by the agent, and recent capability gains have bought only small improvements in reliability.
IBM's treatment of agent governance in regulated environments, comparing the regulatory trajectories emerging in Australia and the European Union rather than assuming a single global regime. Its most useful contribution is a test for deployments that are permitted but still ill-advised.
Proposes an identity and session model in which a revocation is notified once and every enforcement point consults shared state, so that a terminated agent is blocked across protocols and integrations rather than per system.
Sets out a specific task-level set - completion rate, work reduction, cost and cycle time per task, safety violations - explicitly in place of technical model scores, which are equally unrelated to whether work got done.
Positions independent assurance over AI as an emerging oversight responsibility for audit committees rather than a delivery-team function.
Prescribes budget alerts, context window limits and API usage caps, controls that exist because parallel and long-running work consumes unpredictably.
Notes that non-human identities are created by systems rather than business processes and run continuously without direct human oversight: a person reading a screen and pausing between actions creates natural moments to catch a mistake, while an identity executing thousands of operations a second offers no such window.