Enterprise GenAI Adoption — Research Brief (2026-10-31)
Key Developments
Only 13% of CIOs report major AI value, few set exit rules
Economists argue AI value depends on cross-functional deployment, not model capability
- What changed: HBR economists argued on October 21 that AI underperforms because of deployment, not capability.
- Why it matters: Fund cross-function rollout and task-level time measurement, and expect a productivity J-curve before returns appear.
- Sources: [33]
Barclays ties 5,000 job cuts to AI-driven efficiency
US federal agencies can now buy Claude on usage-based terms
- What changed: GSA expanded its OneGov agreement with Anthropic on October 27 to cover discounted, consumption-based Claude purchases.
- Why it matters: Government buyers are standardizing on usage-priced AI contracts, which moves metering and cost control onto agencies.
- Sources: [12], [13] [Tier 2 sources only]
Notable Papers / Models / Tools
| Item | Date | Source | Summary |
|---|---|---|---|
| McKinsey banking agentic AI series (three articles on financial-crime prevention, transaction monitoring and the CIO guide) | Oct 26, 2026 | [4], [5], [6] | Consultancy's own client work, first-party only, no independent corroboration. Reports production agentic results in financial-crime prevention and transaction monitoring. Says human oversight is 70–75% of variable run cost and tokens 20–25%. Ranges are reported without distributions or sample sizes. Treat as a hypothesis, not a benchmark. |
| SAIR: distribution-based financial risk model for shadow AI (Social Sciences & Humanities Open) | 2026, exact date not shown | [35] | Pre-retrieved candidate. Peer-reviewed journal, 0 citations, abstract only. Uses Monte Carlo simulation to estimate primary losses (direct damage) and secondary losses (reputational and regulatory). Loss depends jointly on employee behavior, threat capability and organizational resistance. It is a quantification template, not validated against incident data. I could not confirm it falls inside the 14-day window, so it stays here. |
| Shadow AI and the Limits of Institutional Agility (JMIR, commentary) | 2026, exact date not shown | [36], [39] | Pre-retrieved candidate. Peer-reviewed commentary, 0 citations. Argues health systems must pair speed with transparent, stakeholder-engaged governance, because physicians are adopting AI faster than systems can evaluate it. It comments on a Swedish physician study of shadow-AI drivers that I could confirm exists [39]. A commentary, not new data. |
| Explainable Risk-Aware Framework for Governing Shadow AI (Zenodo) | 2026, exact date not shown | [37] | Pre-retrieved candidate. Unaffiliated Zenodo item, 0 citations, unverified. A six-step conceptual pipeline from discovery to continuous monitoring, with an explicit "indeterminate" decision class. The authors say nothing was implemented and all weights are illustrative. Read it as a design checklist. |
| Managing Shadow AI (Apress book chapter) | 2026, exact date not shown | [38] | Pre-retrieved candidate. 0 citations, single author. A credit-union vignette in which an AI drafting tool began citing products the institution did not offer. It frames shadow AI as a content-correctness problem, not only a data-leak problem. Narrative, not evidence. |
| HBR: "The Deployment Failure Holding Back Your AI Investments" (Hastings, Syverson, Zimmerman) | Oct 21, 2026 | [33] | Tier 1 venue, promoted to Key Developments. I saw only the summary and excerpts, not the underlying data. The economist authors argue the problem is deployment, not capability. AI pays off when rolled out across functions, not only within them. They advise measuring time at task level and expect a productivity J-curve. |
| Deloitte, State of AI in the Enterprise (3,500 leaders, 25 countries) | Oct 29, 2026 | [3] | [Vendor marketing] consultancy survey, self-reported. 81% report faster decisions, but most are speeding existing workflows rather than changing the work. 28% report revenue gains, up from 20% in January. 60% have redesigned jobs at least moderately, while only 15% report a significant shift in decision authority. Leaders can see total AI spend but often not what drives it. |
| O'Reilly security-practitioner survey on AI risk | Oct 26, 2026 | [26] | Tier 2 coverage of a vendor-run survey. Where policy is comprehensive, 17% call shadow AI widespread, versus 35% where policy is basic. It is a useful, partly independent signal for the shadow-AI papers above. Sample details were not retrievable. |
| BIS Bulletin No 140, Building AI on credit: structures and spillovers | ~Oct 27, 2026 | [34] | Tier 1 central-bank research, context only. Owned by the infrastructure topic. It finds AI-related borrowing is rising fast through off-balance-sheet structures. Spillovers beyond the AI sector have so far been limited. Relevant to counterparty-concentration views of AI vendors. |
| Randstad research on software-engineer pay | Oct 29, 2026 | [27] | Tier 2 coverage of recruiter research. Banks and healthcare firms are paying more than tech companies for software engineers. Postings requiring AI skills grew fivefold in a year. Directional labor-market evidence. |
Note: Candidates 5 (Shadow AI: What It Is) and 6 (AI Center of Excellence blueprint) had no abstract, so I could not assess them. The Tier 1 HBR item [33] is dated Oct 21, 2026, inside the recency window, so it was promoted to Key Developments. The other scholarly candidates could not be shown to fall inside the window, so none of them was promoted. All four assessable ones are conceptual or illustrative, with no operational validation.
Technical Deep-Dive
McKinsey's October 26 banking-agent series: where the money actually goes. One reusable finding is a cost-structure claim. McKinsey says that when an agent performs a banking customer-service task, tokens are only 20–25% of variable run cost. Human oversight is 70–75% [4], and the figure originates in an August 24 McKinsey economics guide [8]. If that holds, cheaper models barely move total cost. The levers are the oversight terms: how much review each output needs, how fast reviewers can verify it, and how many outputs they must see. The financial-crime article describes one architecture for this. Task-specific agents handle extraction, consolidation, conversion, extrapolation and drafting. They are wired through a multistep workflow with deterministic services between them [4]. That pattern limits where model errors can propagate, so review can focus on the points where nondeterminism enters.
The transaction-monitoring companion reports that agentic workflows cut effort by 30–50%. Agent-generated reports scored more complete than analyst-written ones against a predefined checklist, with every claim referenced to its source [6]. Separate coverage cites a 30–70% reduction in KYC time [7]. The CIO guide proposes classifying agents by autonomy, with controls tied to the actions they take. Authority limits, confidence thresholds and escalation rules bound each level. It also recommends a common gateway for agentic activity and treating token metering and model tiering as architectural assets [5]. For an observability and governance platform, the practical implication is a per-task cost record that includes reviewer minutes. Token spend alone would hide 70–75% of the cost.
The series also addresses governance candidly. Approval of a bank's first few use cases takes six to eight months, yet ongoing monitoring is still unresolved when the second use case arrives [4]. Coverage of the series says institutions often lack metrics for agent reasoning and behavior, even though such evaluations are relatively inexpensive because they need no labeled data [7]. This lines up with Gartner's finding that 71% of organizations expect to deploy agentic AI within 12 months, while only 21% have agentic governance capabilities [16]. The gap is a monitoring-infrastructure problem as much as a policy one.
Limits matter for how much weight to give this. Everything here is McKinsey's own client work, with only Commerzbank's proof of concept named [6], and there is no independent corroboration. The ranges are reported without distributions or sample sizes. The completeness checklist is defined by the institution, so "higher completeness" partly measures fit to its own rubric. The 20–25% and 70–75% split comes from one task type, and McKinsey's own text says oversight shrinks for deterministic, low-compliance workflows [8]. Use the series as a hypothesis for your own cost accounting, not a benchmark. A bank under supervisory pressure to show human control may also be unable to cut the oversight term as far as the economics alone would suggest.
Landscape Trends
[Enterprise GenAI Adoption × Agentic Systems] Banks are closing the door to outside agents while consolidating their own. JPMorgan's CEO said on its Q3 call that it will not let outside agents into its environment, citing "rogue agents" [23]. This week's reporting adds that major US banks are detecting third-party agents operating inside customer accounts, sometimes with customers' own credentials [24]. JPMorgan's CIO said the bank will start with one core agent-building platform so controls can scale, and that its LLM Suite supports 1,000 business applications [25]. Gartner's prediction that 25% of enterprise breaches will trace to AI-agent abuse by 2028 is uncorroborated [17]. The decision-level read is that agent identity and credential delegation are becoming a procurement requirement. Agentic-commerce roadmaps assume banks will accept agents they have not approved, and so far that assumption is not holding.
[Enterprise GenAI Adoption × LLM Production Infrastructure] Cost attribution is becoming the real observability requirement, and the telemetry standard it relies on is still settling. McKinsey advises token metering and model tiering at a common gateway [5]. Gartner predicts that IT-operations agents on uncapped token pricing will exceed cost expectations by over 50% versus bundled pricing [15]. Forrester's uncorroborated 2027 predictions include AI reaching 20% of business technology spend [18]. Deloitte reports leaders can see the AI bill but often not what drives it [3]. The OTel GenAI conventions moved into their own repository in June [22]. That repository still has no tagged release, and a downstream project logged breaking renames in mid-October [19], [21]. A vendor guide updated October 21 still lists the conventions at Development status [20]. This is an ongoing gap, not a new event. The practical consequence is to contract for OTLP export and per-task cost fields, but keep attribute names behind an adapter layer you control.
Callback to 2026-10-24 (Gartner CEO survey, 44% struggling to show returns): the new evidence reinforces it. Gartner's CIO survey adds that only 13% report significant value and about one in five use cases succeeds [1]. McKinsey's 6% figure for substantial EBIT attribution is still being cited this week [41]. Deloitte offers a counterweight, with revenue gains up to 28% from 20% in January [3]. That is self-reported and measured differently, so the sources do not contradict each other. Together they say adoption is broad, financial returns are improving slowly, and the organizations pulling ahead are those with stop rules, role redesign and governance in place [1], [2].
Workforce change is moving from pilots to cost-base decisions, with uneven redesign. Barclays cut roughly 5% of staff while reporting a 12% profit rise [9], [10]. It also named its first chief AI officer, joining HSBC, Bank of Ireland and ANZ [11]. Gartner finds organizations with plans to redesign roles for human-agent teams are 2.4 times more likely to be top performers [2]. Deloitte says 60% have redesigned jobs but only 15% report a real shift in decision authority [3]. Microsoft reportedly offered buyouts to up to 60,000 staff while funding its AI build-out [28]. Banks and healthcare firms are meanwhile outbidding tech companies for software engineers [27]. The pattern is simultaneous cuts in support and developer roles and rising pay for AI-capable engineers. That is a skills-mix shift, not a simple headcount story.
[Enterprise GenAI Adoption × Safety, Assurance & Governance] Shadow AI has direct survey evidence this cycle, and the research response is still conceptual. In a practitioner survey, widespread shadow-AI use was half as common under comprehensive policies as under basic ones [26]. The scholarly candidates offer a quantification model, a six-step pipeline and a health-system commentary, but none is validated on incident data [35], [36], [37]. McKinsey notes that approval of early use cases takes six to eight months while monitoring stays unresolved [4]. Slow approval is a plausible driver of unsanctioned use, though no source here tests that link. A detection and policy program should be measured by the fraction of AI use it can see, not only by the tools it has approved.
Vendor Landscape
- Microsoft (FY27 Q1, Oct 28): The CEO said Foundry customers exceeded 120,000 and customers with more than 50,000 Copilot seats rose more than eightfold year on year. Volkswagen plans to deploy Copilot to over 330,000 employees, and customers consuming usage-based credits rose over 75% in the quarter [29]. Microsoft did not disclose total paid seats [28]. These are company-reported figures with no independent validation.
- ServiceNow (Q3, Oct 28–29): It raised its 2026 AI net-new ACV target to $1.7B or more and said production agentic consumption is up 13x year to date. Management said customers prefer hybrid seat-plus-consumption pricing over outcome pricing [30]. Company-reported.
- Google Public Sector (Oct 20): Gemini for government services is an agent add-on with agency-IT-controlled, prescreened agents. HHS and the State of Missouri have been testing it [31]. It is a private preview with no public price or general-availability date, and the launch materials do not name an authorization level [32].
- GSA OneGov: A small-business vendor, (US)AI, became GSA's first direct OneGov contract. It offers up to 30% software discounts and $1 two-week pilots, through September 2028 [40]. USAi, the shared federal platform, is no longer free. Agencies now pay a platform fee plus pass-through usage costs [14].
Sources
- Gartner, "Gartner Survey Finds Only 13% of CIOs Say Their Enterprise Has Realized Significant or Transformational Value from AI" (Oct 19, 2026) — https://www.gartner.com/en/newsroom/press-releases/2026-10-19-gartner-survey-finds-only-13-percent-of-cios-say-their-enterprise-has-realized-significant-or-transformational-value-from-ai [Tier 1 — analyst research]
- eWeek, "Only 13% of CIOs See Major AI Value, Gartner Finds — Few Have Exit Rules" (~Oct 24, 2026) — https://www.eweek.com/news/gartner-cio-ai-value-rules/ [Tier 2 — enterprise tech news]
- Deloitte, "Enterprise AI Enters an ROI Reckoning: More Use, Uneven Value" (Oct 29, 2026) — https://www.deloitte.com/us/en/about/press-room/enterprise-ai-enters-an-roi-reckoning.html [Tier 3 — consultancy survey, vendor marketing]
- McKinsey, "Agentic AI in financial-crime prevention: Lessons from winners" (Oct 26, 2026) — https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/agentic-ai-in-financial-crime-prevention-lessons-from-winners [Tier 1 — analyst research, first-party only]
- McKinsey, "The rise of the agentic coworker: A banking CIO's guide to the next wave of AI" (Oct 26, 2026) — https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/the-rise-of-the-agentic-coworker-a-banking-cios-guide-to-the-next-wave-of-ai [Tier 1 — analyst research]
- McKinsey, "Agentic AI in transaction monitoring: How banks can scale AI in compliance" (Oct 26, 2026) — https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/agentic-ai-in-transaction-monitoring-how-banks-can-scale-ai-in-compliance [Tier 1 — analyst research]
- ANI, "Agentic AI could strengthen financial-crime prevention, but governance, cost hurdles limit adoption: McKinsey" (Oct 27, 2026) — https://www.aninews.in/news/business/agentic-ai-could-strengthen-financial-crime-prevention-but-governance-cost-hurdles-limit-adoption-mckinsey20261027125134/ [Tier 2 — news coverage of analyst report]
- McKinsey, "Where AI agents pay off: A practical guide to the economics of agentic workflows" (Aug 24, 2026, context) — https://www.mckinsey.com/capabilities/quantumblack/our-insights/where-ai-agents-pay-off-a-practical-guide-to-the-economics-of-agentic-workflows [Tier 1 — analyst research]
- CNBC, "Barclays to slash 5,000 jobs in AI efficiency push" (Oct 22, 2026) — https://www.cnbc.com/2026/10/22/barclays-ai-jobs-cuts.html [Tier 2 — news]
- Fast Company, "Barclays layoffs today: Bank slashes 5% of workforce, attributing 5,000 job cuts to AI" (Oct 22, 2026) — https://www.fastcompany.com/91628263/barclays-layoffs-today-bank-slashes-5-of-workforce-attributing-5000-job-cuts-to-ai [Tier 2 — news]
- QA Financial, "Barclays names AI chief as testing challenges grow" (Oct 30, 2026) — https://qa-financial.com/barclays-names-ai-chief-as-testing-challenges-grow [Tier 2 — trade press]
- GSA, "GSA, Anthropic Reach OneGov Agreement on Discounted, Consumption-Based Pricing for Claude" (Oct 27, 2026) — https://www.gsa.gov/about-gsa/newsroom/news-releases/gsa-anthropic-reach-onegov-agreement-on-discounted-consumptionbased-pricing-10272026 [Tier 2 — government press release; primary announcement of the deal, not independent research]
- FedScoop, "GSA expands OneGov agreement with Anthropic, touting steep discounts" (Oct 27, 2026) — https://fedscoop.com/gsa-onegov-deal-claude-anthropic/ [Tier 2 — trade press]
- FedScoop, "What do agencies get now that USAi isn't free?" (Oct 27, 2026) — https://fedscoop.com/usai-gsa-shared-services-platform-cost/ [Tier 2 — trade press]
- Gartner, "Gartner Identifies the Top AI Trends in Infrastructure and IT Operations for 2027" (Oct 26, 2026) — https://www.gartner.com/en/newsroom/press-releases/2026-10-26-gartner-identifies-the-top-ai-trends-in-infrastructure-and-it-operations-for-2027 [Tier 1 — analyst research, prediction]
- Gartner, "Gartner Says AI Risk is Rising Faster Than AI Value" (Oct 19, 2026) — https://www.gartner.com/en/newsroom/press-releases/2026-10-19-gartner-it-symposium-xpo-keynote-release-2026 [Tier 1 — analyst research]
- Gartner, "Gartner Identifies the Top Strategic Technology Trends for 2027" (Oct 20, 2026) — https://www.gartner.com/en/newsroom/press-releases/2026-10-20-gartner-identifies-the-top-strategic-technology-trends-for-2027 [Tier 1 — analyst research, prediction]
- Forrester, "Forrester's 2027 Technology And Security Predictions" (Business Wire, Oct 21, 2026) — https://www.morningstar.com/news/business-wire/20261021251120/forresters-2027-technology-and-security-predictions-ai-will-account-for-20-of-all-business-technology-spend [Tier 1 — analyst research, uncorroborated predictions]
- GitHub, rxbynerd/stirrup issue #774, "track semantic-conventions-genai renames" (opened Oct 13, 2026) — https://github.com/rxbynerd/stirrup/issues/774 [Tier 2 — practitioner tracker]
- Fiddler AI, "OpenTelemetry for AI Observability: What It Covers and Where It Stops" (updated Oct 21, 2026) — https://www.fiddler.ai/blog/opentelemetry-ai-observability-guide [Tier 3 — vendor content, vendor marketing]
- OpenTelemetry, semantic-conventions-genai repository and releases page (retrieved Oct 31, 2026) — https://github.com/open-telemetry/semantic-conventions-genai/releases [Tier 1 — standards body repository]
- Dash0, "OpenTelemetry GenAI Semantic Conventions Explained" (last updated Sep 14, 2026) — https://www.dash0.com/knowledge/opentelemetry-genai-semantic-conventions-explained [Tier 3 — vendor content, vendor marketing]
- Fortune, "'You don't want rogue agents': Jamie Dimon bars outside AI agents from JPMorgan accounts" (Oct 15, 2026) — https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/ [Tier 2 — news]
- Malwarebytes, "Banks are blocking AI agents from customer accounts" (Oct 29, 2026, citing Axios) — https://www.malwarebytes.com/blog/ai/2026/10/banks-are-blocking-ai-agents-from-customer-accounts [Tier 2 — secondary reporting]
- Cybersecurity Dive, "JPMorgan Chase, Goldman Sachs underscore security in AI plans" (~Oct 29, 2026) — https://www.cybersecuritydive.com/news/jpmorgan-chase-goldman-sachs-AI-security/873171/ [Tier 2 — trade press]
- Help Net Security, "Security pros reckon the biggest AI risk comes with an employee badge" (Oct 26, 2026) — https://helpnetsecurity.com/2026/10/26/ai-tools-security-worry-survey [Tier 2 — trade press on vendor survey]
- CNBC, "Banks and healthcare firms are outbidding tech for software talent" (Oct 29, 2026) — https://www.cnbc.com/2026/10/29/ai-jobs-software-engineers-tech-layoffs.html [Tier 2 — news]
- CNBC, "Microsoft stock jumps 4% as cloud growth drives earnings and revenue beat" (Oct 28, 2026) — https://www.cnbc.com/2026/10/28/microsoft-msft-q1-earnings-report-2027.html [Tier 2 — news]
- Yahoo Finance, "What Microsoft (MSFT) Said on Its Q1 Earnings Call" (Oct 29, 2026) — https://finance.yahoo.com/markets/stocks/articles/microsoft-msft-said-q1-earnings-040415977.html [Tier 2 — earnings recap]
- Yahoo Finance, "ServiceNow Q3 2026 Earnings Call Highlights" (Oct 29, 2026) — https://finance.yahoo.com/technology/ai/articles/servicenow-inc-now-q3-2026-070758483.html [Tier 2 — earnings recap]
- Nextgov/FCW, "Google Public Sector unveils Gemini for government services" (Oct 20, 2026) — https://www.nextgov.com/artificial-intelligence/2026/10/google-public-sector-unveils-gemini-government-services/416681/ [Tier 2 — trade press]
- Forkast, "Gemini for Government Services Arrives as a Private Preview" (Oct 21, 2026) — https://forkast.news/gemini-for-government-services-arrives-as-a-private-preview-the-compliance-wrapper-is-whats-for-sale/ [Tier 2 — commentary]
- Harvard Business Review, "The Deployment Failure Holding Back Your AI Investments" (Oct 21, 2026) — https://hbr.org/2026/10/the-deployment-failure-holding-back-your-ai-investments [Tier 1 — independent journalism/academic venue]
- BIS, "BIS Bulletin No 140: Building AI on credit: structures and spillovers" (~Oct 27, 2026) — https://www.bis.org/publications/bulletin-140-building-ai-credit-structures-and-spillovers [Tier 1 — central-bank research]
- Albasry et al., "Shadow AI in organizations: A distribution-based financial risk analysis" (Social Sciences & Humanities Open, 2026) — https://openalex.org/W7220419327 [Tier 1 — peer-reviewed]
- Rader and Brownstein, "Shadow AI and the Limits of Institutional Agility" (JMIR, 2026) — https://openalex.org/W7221812189 [Tier 1 — peer-reviewed commentary]
- Kharabi and Survase, "An Explainable Risk-Aware Framework for Governing and Monitoring Shadow AI" (Zenodo, 2026) — https://openalex.org/W7223455774 [Tier 3 — unaffiliated, unverified preprint]
- Salas, "Managing Shadow AI" (Apress, 2026) — https://openalex.org/W7224119343 [Tier 3 — book chapter, narrative]
- "Shadow AI in Swedish Health Care: Qualitative Analysis of Physicians' Free-Text Answers" (JMIR, 2026) — https://pmc.ncbi.nlm.nih.gov/articles/PMC13411434/ [Tier 1 — peer-reviewed]
- Nextgov/FCW, "(US)AI becomes GSA's first direct OneGov contract with a small business" (Oct 23, 2026) — https://www.nextgov.com/acquisition/2026/10/usai-becomes-gsas-first-direct-onegov-contract-small-business/416789/ [Tier 2 — trade press]
- Investing.com, "Agentic AI excitement runs ahead of results" (Oct 30, 2026, citing McKinsey 2026 survey) — https://uk.investing.com/news/stock-market-news/agentic-ai-excitement-runs-ahead-of-results-4946994 [Tier 2 — news citing analyst survey]