Enterprise AI readiness reads 58.7 of 100, in the Operational band

This week the index moves on volume of consistent evidence, and the story it tells is a widening gap between capability and control.

The organization category advanced on hard numbers. Enterprises now run 4.2 AI models in production on average, up from 1.9 in 2023 (Alice Labs / Gartner), Fortune 500 CAIO adoption roughly doubled year-over-year (Value Add VC), and 80% of enterprises report measurable returns from agent investments (BeamSec). The product category moved in parallel: ~47% of enterprises now have at least one agent in production (AI Business Weekly), Cooley and OpenAI shipped domain-specific legal assistants with real controls, and Doctolib turned agents into a 40% shipping-speed gain.

Set that against one number that did not move and should have. Only 38% of organizations have a formal AI governance policy and just 12% have mature governance processes (EverythingCloud; Elementum AI). Half of enterprises are running agents in production. One in eight can govern them. That is the imbalance this issue is built around, and it is why the Governance dimension holds rather than rises even as everything near it climbs.

The reconciliation of the week's contradictions runs through the Compiled Corporation. The MIT NANDA finding that 95% of genAI initiatives showed no bottom-line impact (DeployedLabs) sits next to BeamSec's 80% measurable-return figure without contradiction once you look at where value lands. Value appears where a workflow was rebuilt around the agent. It vanishes where AI was bolted onto legacy process. Cooley rebuilt its IPO workflow so the assistant surfaces issues earlier and lawyers spend judgment where it counts. That is process redesign, and it is why that deployment produces value while the median initiative does not.

The brand category, still the laggard, moved on infrastructure and orchestration. The UN System Data Commons (Google) and OpenAI's Sponsored Agents with HubSpot and Shopify (OpenAI) point at the same shift: content and marketing are increasingly read and executed by agents. The Decision Surfaces reader is no longer human, and few brands write or operate for that reader.

Every product and organization gain this week reopens the same governance question one dimension over. An agent buying media is a non-human identity with a budget. An agent running an IPO workflow is a non-human identity touching confidential filings. An agent in production at half of enterprises is a fleet of identities acting without the access controls that 97% of breached organizations were found to lack. This is the Identity Control Surface problem, and it is arriving as a governance emergency dressed as a productivity win.

The editorial call: capability is compounding faster than the ability to govern it, and the firms that will hold their gains are the ones treating agent identity and workflow redesign as the same project. The rest are accumulating deployment they cannot yet answer for.

Access holds. The 72% production-workload figure from McKinsey confirms that AI tools now sit in daily workflows for a majority of enterprises, concentrated in customer service, IT, and marketing. Distribution remains uneven by firm size: 83% of companies with 5,000 or more employees have deployed versus 42% of mid-market. No signal this week moves the composite. The Decision Surfaces question stays open: access to a tool is not the same as a governed human/agent interface, and most of this access is still assistant-grade rather than agentic.

Scaling maturity moves up a point. The evidence this week is quantitative and consistent: enterprises now run 4.2 AI models in production on average, up from 1.9 in 2023, and more than half deploy agents in multi-stage workflows. The 95% no-measurable-impact finding from the earlier MIT NANDA study still shadows the category, so the move is measured. Under the Compiled Corporation lens, running four production models is not yet compiling the firm's core decisions: it is instrumenting adjacent processes. Cross-functional deployment at 16% is where genuine scaling begins, and that number is still small.

Governance holds, and the hold is deliberate. This week's data cuts against the score: only 38% of organizations have a formal AI governance policy and just 12% have mature processes, while agentic deployment is already in production at scale. That gap is the central risk of 2026. The score stays because this dimension tracks the leading edge of governance capability among AI-mature organizations, where continuous runtime enforcement and lifecycle governance are being built against the EU AI Act deadline. The Identity Control Surface framing is now the operative question: 97% of breached organizations lacked proper AI access controls. Non-human identity governance is the unbuilt layer. If next quarter's data shows deployment continuing to outrun controls, this score falls.

Talent moves up a point. The CAIO role has roughly doubled in Fortune 500 adoption year-over-year, and a fresh appointment landed this week at Masco. The honest read: the IBM 76% figure is inflated by companies counting VP-level leads, and the harder LinkedIn dataset puts Fortune 500 adoption near 43%. Even the conservative number is a real structural signal that firms are building AI leadership benches. Executive fluency at the top is necessary and insufficient. Workforce reskilling depth is still thin, which caps the move at one point.

ROI moves up a point, cautiously. The evidence is genuinely split. BeamSec's survey reports 80% of agent investments delivering measurable returns, concentrated in coding and data analysis where value proves quickly. Against that, the MIT NANDA finding that 95% of genAI initiatives showed no bottom-line impact remains the most sobering number in the index. The reconciliation: value is real where workflows were redesigned around the agent, and absent where AI was bolted onto legacy process. The move is one point because the credible upside is now concentrated and demonstrable in specific functions, even as the aggregate picture stays hard.

Messaging holds. The signals this week are vendor-led: Salesforce's Koa announcement and OpenAI's advertising push show the platform layer setting the vocabulary. No aggregate evidence this week indicates that enterprise brands broadly closed the gap between AI claims and AI substance. The Janus Brands tension persists: the risk is AI messaging that outruns the legacy brand's demonstrated competence. Held at the low end of Operational until market-wide evidence of substantiated messaging appears.

Infrastructure moves up a point. Two signals point the same direction: the UN System Data Commons makes population-scale statistics machine-searchable, and enterprise platforms are pushing native structured-data grounding, with Gemini connecting directly to BigQuery. Agent-ready infrastructure depends on structured data and APIs that machines can consume, and both the public-data and enterprise-platform layers advanced this week. This is the Identity Control Surface precondition: before non-human identities can act, they need governed, machine-readable data to act on. The plumbing is arriving faster than the governance around it.

Perception holds. Limited direct evidence this week. The most relevant signal remains the credibility gap: with 95% of initiatives showing no measurable impact, the market's distinction between AI-competent and AI-washing stays sharp and unforgiving. Vendor announcements are loud, substantiation is quiet. Held at the low end of Active until evidence shows perceived competence broadening beyond the platform companies.

Content readiness moves up a point. The consumption shift is the driver: genAI usage is moving into embedded search, which means content read by an assistant rather than a browser. Content structured for machine consumption gains reach; unstructured content loses it. The UN Data Commons is a template for what AI-ready content looks like at scale. The move is small because most enterprise content is still authored for human readers first. The Decision Surfaces implication: the surface that reads your content is increasingly an agent, and few brands write for that reader yet.

Orchestration moves up a point. OpenAI's Sponsored Agents and HubSpot/Shopify integrations put agentic systems directly into the marketing and commerce stack. This is the first concrete signal that brand and marketing operations are being managed through agents rather than dashboards. The move is one point because integration availability is not the same as adoption at scale, and the orchestration layer is vendor-supplied rather than enterprise-owned. The governance question follows immediately: an agent buying media on your behalf is a non-human identity with a budget, and that is an Identity Control Surface problem before it is a marketing one.

Interaction layer moves up a point. Two production deployments this week, Cooley's GO Public and Astra for Law, show the interaction layer maturing from generic chat to domain-specific, workflow-embedded assistants with connected data and legal-grade controls. This is the assistant-to-agent spectrum advancing in the direction of governed, high-stakes work. The Decision Surfaces design is explicit in the Cooley framing: the assistant surfaces issues earlier so lawyers focus judgment where it matters. That is a well-placed human/agent interface, and the deliberate keeping of human judgment in the loop is why the move is measured rather than large.

Agentic deployment moves up a point, the strongest-supported move in the product category. Roughly 47% of enterprises now have at least one agent in production, rising to 67% at the largest firms, and Microsoft's Orchard framework lowers the cost of training and evaluating agents from smaller models. Deployment is broadening structurally. The gap this reopens is governance: agents in production at nearly half of enterprises, against 12% mature governance, is the central imbalance of the index. Under the Compiled Corporation lens, agents that plan and execute multi-step tasks are the first real compiling of workflow decisions. The score reflects capability, and the risk lives one dimension over in Governance.

UX maturity moves up a point. The trust layer advanced this week: Astra for Law's legal-grade controls put confidentiality and reliability into the product surface, and MIT's HardFlow addresses outputs that must obey strict constraints rather than land close. Both point at the harder problem in AI UX, which is error recovery and trust in high-stakes contexts. The move is one point because these are early and domain-specific. Broad explainability and graceful error handling across consumer and enterprise products remain uneven.

Process redesign moves up a point. The Cooley case is the clearest example: the IPO workflow was rebuilt so the assistant surfaces issues earlier, changing where human judgment enters rather than just adding a tool. BeamSec's pattern, organizations proving value in coding then expanding to research and reporting, is the redesign trajectory. The move is one point because most deployment is still surface automation on top of legacy process, and the 95% no-impact finding is largely a redesign failure. Where value shows up, workflows were rebuilt. Where it does not, they were not.

Value delivery moves up a point. Doctolib's 40%-faster shipping is a concrete product-level result, and improving inference economics from NVIDIA's MLPerf leadership lowers the cost basis for delivering AI features. The Berkeley observation that inference prices are falling 9x to 900x per year reinforces the direction: value per dollar of product AI is rising. The move stays at one point because measurable value remains concentrated in software engineering and data functions, and the aggregate ROI picture is still contested. Value is real and demonstrable where it appears; it is not yet broad.