AI & MCP
2026 is the year of enterprise AI governance
Cameron McClellan
May 30, 2026 - 8 min read
Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 2026. In 2025, that figure was under 5%. Gartner projects the average large enterprise will run more than 150,000 AI agents by 2028 . Every one of those agents is a potential access vector, a potential data exfiltration path, a potential unlogged action on a production system with no audit trail.
The deployment curve is not a surprise. What changed in 2026 is the response. AI governance is the combination of policies, controls, and technical infrastructure that determines what AI agents can access, what actions they can take, and whether those actions are logged and auditable. For the first time, enterprise boards, CISOs, and platform leaders are treating AI governance as infrastructure rather than a project to revisit later. The incident record made the case. The regulatory clock gave it a deadline. The evidence is now consistent across boards, vendors, and regulators: AI governance has moved from optional to essential.
What is the cost of the AI governance gap?
Approximately $1 is spent on AI security for every $735 spent on AI capability , a three-order-of-magnitude imbalance.
IBM’s 2025 Cost of a Data Breach Report , based on 600 organizations globally, put a number on what that imbalance costs. 13% of organizations had already experienced confirmed breaches of AI models or applications. Of those, 97% lacked proper AI access controls at the time. Breaches involving AI systems cost an average of $670,000 more per incident than conventional data breaches.
The incidents behind IBM’s numbers include cases at well-known enterprises:
- In June 2025, security researchers disclosed a zero-click vulnerability in Microsoft 365 Copilot requiring no user interaction: an attacker sends a crafted email, and the next time the victim queries Copilot about anything touching that email, the tool silently exfiltrates prior conversation data to an external server. Tens of millions of enterprise Copilot users were exposed.
- In March 2026, an in-house agent at Meta posted incorrect technical information publicly without human approval and triggered 2 hours of unauthorized data exposure, accessible to employees not cleared to view it. It was the second agent control failure at the company within weeks.
Despite all of this, most organizations are only beginning to implement AI-specific security controls. A Cloud Security Alliance and Token Security study found that 63% cannot enforce purpose limitations on their AI agents, and 60% cannot terminate a misbehaving agent once it is running. By April 2026, 65% of enterprises with deployed AI agents had experienced a confirmed security incident .
Stanford’s 2026 AI Index found that security and risk is now the primary barrier to scaling agentic AI, cited by 62% of organizations. It outranked technical limitations and regulatory uncertainty by 24 percentage points. The bottleneck to enterprise AI is not model capability or cost. It is governance.
How are enterprises responding to the AI governance gap?
The organizational response in 2026 has been concrete and measurable.
Forrester predicts that 60% of Fortune 100 companies will appoint a dedicated head of AI governance in 2026. Sony, Bank of America, and UBS have already done so. Board oversight of AI has increased 84% in public company disclosures. Morgan Stanley and BlackRock are factoring AI governance maturity into company valuations.
JPMorgan Chase and Goldman Sachs followed the same pattern. JPMorgan runs 450+ AI use cases daily across an in-house platform deployed to more than 200,000 employees. Its $1.8 billion AI investment was built governance-first, with a C-suite oversight council and compliance embedded from the start. Goldman runs every model through its Model Risk Management framework, with bias detection, data lineage tracking, and human-in-the-loop controls across all regulated operations. Both banks deployed AI to every employee’s desk. In both cases, governance was what made that scale achievable.
The platform vendors reached the same conclusion:
- ServiceNow made AI governance the centerpiece of Knowledge 2026 in May , launching AI Control Tower and an Autonomous Security and Risk product governing agent identities, permissions, and connected assets.
- Google made governance the central message of Cloud Next 2026 , framing identity and security as core infrastructure and models as a commodity. Bain’s analysis described it as “The agentic enterprise control plane comes into view.”
- Microsoft launched Entra AI Governance, automating access reviews and policy enforcement across AI models hosted on any provider.
Gartner projects the AI governance platform market will reach $492 million in 2026 and exceed $1 billion by 2030. Organizations that deploy dedicated AI governance platforms are 3.4x more likely to achieve high effectiveness in their governance programs than those that do not.
How did Uber build enterprise AI governance at scale?
The most thorough public case study of enterprise AI governance at scale is Uber. By early 2026, 84% of Uber’s developers were using agentic coding tools daily. AI was generating between 65% and 72% of all code written inside the company’s IDEs. A single background coding agent called Minions was generating 1,800 code changes per week , used by 95% of the engineering organization.
Uber reached that scale because it built 3 governance layers before scaling adoption: an LLM gateway handling PII redaction, access control, and audit logging across every model interaction; an MCP gateway and registry governing every agent-to-tool connection across Uber’s 10,000+ internal services; and an agent identity system extending the company’s existing Zero Trust infrastructure to multi-agent workflows, with cryptographically attested lineage on every tool call.
Uber’s governance stack took years to build and required a dedicated platform engineering team whose sole mandate was AI infrastructure. It was assembled on top of service foundations that took a decade of operating at scale to develop. Most enterprises have neither the foundations nor the timeline to replicate it.
What AI governance compliance deadlines do enterprises face?
The regulatory pressure compounds the urgency. The EU AI Act’s full enforcement provisions for high-risk AI systems take effect August 2, 2026 , covering credit scoring, employment, insurance underwriting, and other regulated domains. Fines reach €15 million or 3% of global annual turnover for non-compliance.
The NSA released its own MCP security guidance, signaling that federal regulatory requirements are a matter of when, not whether. The organizations not forced to act by incidents will eventually be forced by regulations anyway.
How Speakeasy closes the governance gap
The Speakeasy AI control plane is the governance infrastructure enterprises need in 2026, available as a product. It provides:
- An MCP gateway with policy enforcement at the tool-call boundary
- Agent identity and access management extending enterprise SSO to AI agents
- PII redaction and prompt inspection at the infrastructure level
- Audit logging that makes compliance evidence possible
It is the architecture JPMorgan and Uber built internally, without the dedicated platform team and multi-year build.
The enterprises successfully deploying AI at scale in 2026 spent years building the governance infrastructure first. With the Speakeasy AI control plane it only takes weeks to catch up.
Further reading
- What is AI security?: a primer on enterprise AI security and what it takes to govern AI deployments at scale.
- How Uber built the enterprise AI security playbook: the full account of the governance stack Uber built before scaling to 1,800 AI-generated code changes per week.
- Where Claude falls short in AI security: what enterprise AI security controls actually need to cover, and where built-in platform controls stop short.
- The NSA MCP security baseline: what the NSA’s May 2026 guidance means for enterprise MCP deployments.
- The OWASP Agentic Top 10, explained: the threat categories driving enterprise AI governance investment.
Frequently asked questions
What is AI governance? AI governance is the combination of policies, controls, and technical infrastructure that determines what AI agents can access, what actions they can take, and whether those actions are logged and auditable. It covers identity and access management for AI agents, tool-call policy enforcement, audit trails, and PII handling at the infrastructure level.
What does the EU AI Act require of enterprises? The EU AI Act’s full enforcement provisions for high-risk AI systems took effect August 2, 2026, covering credit scoring, employment decisions, insurance underwriting, and other regulated domains. Organizations operating non-compliant high-risk AI systems face fines up to €15 million or 3% of global annual turnover.
How long does it take to implement AI governance? Enterprise programs built from scratch, like Uber’s, took years and required dedicated platform engineering teams. Purpose-built products like the Speakeasy AI control plane compress that timeline to weeks by delivering the MCP gateway, agent identity, audit logging, and policy enforcement layers as a single product.
What is an AI control plane? An AI control plane is the infrastructure layer that sits between AI agents and the systems they operate on. It enforces which agents are authorized, what they can access, what actions they can take, and creates a complete audit trail of every interaction. It is to AI agents what identity and access management is to human employees.