2 in 3 CIOs and CTOs Are Accountable for AI They Don’t Fully Control
AI adoption is accelerating across the enterprise. But for technology leaders, the bigger challenge is no longer access to AI. It is visibility, governance, cost, and control.
Enterprise AI has entered a different phase.
A few years ago, the question was whether generative AI could deliver meaningful business value. Then came the rush to experiment with copilots, chatbots, automation, and large language models.
Today, organizations are moving into something much more consequential: AI agents that can reason, access enterprise data, call tools, interact with business systems, and execute multi-step workflows.
And as that transition accelerates, a significant leadership gap is emerging.
According to recent research by IBM, two-thirds of CIOs and CTOs say they are being held accountable for AI systems they do not fully control.
That finding should get the attention of every enterprise technology leader.
Because the issue is no longer simply AI adoption.
It is AI accountability without AI control.
AI adoption is moving faster than enterprise governance
The gap becomes even clearer when we look at the broader enterprise environment.
The global study found that 70% of technology leaders say teams across their organizations are deploying technology faster than IT can track it. At the same time, 77% report that AI adoption is already outpacing their existing governance capabilities.
There is pressure coming from above as well.
Research found that 80% of surveyed technology executives have AI transformation mandates coming directly from the CEO.
Yet only 11% believe their organizations are fully prepared for the scale of AI-agent deployment expected over the next year.
Those numbers describe the position many CIOs and CTOs now find themselves in.
The board wants AI adoption accelerated.
Business units want more autonomy.
Employees want access to the latest models.
Developers want to build agents.
Departments are introducing their own tools and workflows.
Meanwhile, IT remains responsible for security, compliance, identity, architecture, cost, availability, and operational risk.
The responsibility remains centralized.
The technology increasingly does not.
That is the enterprise AI control gap.
Agentic AI changes the governance equation
This problem becomes much more important as enterprises transition from AI assistants to AI agents.
A chatbot generally waits for a request and returns a response.
An AI agent can go further. Depending on the system and permissions it has been given, an agent may retrieve internal documents, connect to APIs, analyze records, update applications, invoke other agents, create files, initiate workflows, or perform business actions.
That makes AI dramatically more useful.
It also changes the risk model.
Technology executives expect the number of AI agents deployed in their organizations to increase 38% by 2027. The broader study projects organizations will be running an average of 1,661 AI agents by that point.
Traditional governance was largely designed around software that changed through controlled development and release cycles.
Agentic systems operate differently.
They can make decisions dynamically. They can select tools at runtime. They can interact with multiple systems. They can consume variable amounts of compute and model capacity. And one agent may execute thousands of actions faster than a human governance team could manually review them.
That means governance cannot exist only as a document, approval meeting, or quarterly review.
Governance has to become part of the AI architecture itself.
The cost of losing visibility is already measurable
Weak AI governance is not a theoretical future risk.
Organizations surveyed experienced an average of 54 AI-agent incidents during the previous year in which an unintended or harmful occurrence required human intervention.
Seventeen percent of reported incidents were considered high severity and took more than four hours to contain. Among those high-severity incidents, data exposure or security breaches were reported in 37%, cascading system failures in 33%, and compliance issues in 17%.
It is therefore unsurprising that 59% of surveyed technology leaders identified security and compliance concerns as major barriers to scaling AI agents.
Separate research reaches a similar conclusion.
The latest research into enterprise AI security found that 52% of organizations identify sensitive-data exposure as their leading AI security concern.
It also found that enterprises are no longer operating in a single-model environment. Organizations surveyed were using an average of 2.6 AI models, adding another layer of complexity around access, data handling, monitoring, model choice, and policy enforcement.
This matters because enterprise AI architecture is rapidly becoming fragmented.
A company may have one model supporting developers, another embedded in productivity tools, another powering customer support, several departmental AI applications, external APIs, internal agents, experimental models, and employees independently accessing public AI services.
Without a common control layer, every new system becomes another environment the CIO or CTO is ultimately expected to understand and govern.
Governance does not have to slow AI down
One of the biggest misconceptions about enterprise AI governance is that control and innovation sit on opposite sides of the equation.
The data suggests the opposite.
Organizations that embed control directly into their AI systems experience 25% fewer incidents than organizations relying primarily on manual governance.
More importantly, organizations that engineer control into their systems are not deploying less AI.
The analysis found that they deploy 16 times more AI agents than organizations relying on manual governance and report 18% higher operating margins.
Research into enterprise AI security and governance points in the same direction. Organizations with formal AI governance were twice as likely to adopt agentic AI and three times as likely to train employees on AI security tools.
That changes the conversation.
Governance should not be viewed as the process that tells employees what they cannot do.
Done correctly, governance is the infrastructure that allows an enterprise to confidently say yes to more AI use cases.
The goal is not to restrict intelligence.
The goal is to create boundaries within which intelligence can safely operate.
The AI adoption gap is becoming an ROI gap
There is another reason this matters.
Enterprise AI deployment is increasing rapidly, but measurable financial impact is not increasing at the same rate.
Recent enterprise AI research found that nearly nine in ten respondents report regular AI use in at least one business function, while 44% now say AI is scaling across their enterprise, up from 38% the previous year.
Large enterprises are moving especially quickly.
Among organizations generating more than $1 billion in annual revenue, 40% report scaling AI agents, compared with 27% a year earlier.
But adoption does not automatically translate into enterprise value.
Only 37% of respondents say AI has made a positive contribution to enterprise EBIT, and just 6% of respondents are classified as AI high performers achieving significant value and at least a 5% EBIT contribution from AI.
Cost visibility is becoming part of the problem.
One in five organizations said AI operating costs, including token consumption, were already constraining AI usage. Despite that pressure, 60% still expect their organizations to increase AI investment over the next year.
An equally important financial-control gap is emerging: 84% of technology executives have not fully operationalized AI financial management, while 85% lack complete real-time visibility into AI spending.
So enterprises are simultaneously deploying more AI, spending more on AI, and being asked to demonstrate more business value from AI.
That makes observability essential.
The next generation of AI platforms cannot simply answer:
“Did the model work?”
They must help leaders answer:
Who used it? What data did it access? Which tools did it invoke? What actions did it take? Which model handled the request? How much did it cost? Was an approval required? What business result did the workflow generate? And can we stop it immediately if something goes wrong?
CIOs and CTOs need an AI control plane
The solution is not another standalone chatbot.
Enterprises need an operational layer between AI capabilities and the systems, people, data, tools, and policies those capabilities interact with.
In practice, an enterprise AI control plane should give technology leaders seven things: a complete inventory of approved models and agents; identity and role-based access controls; clear data, memory, model and tool boundaries; approval gates for sensitive actions; end-to-end logging and observability; real-time usage, cost and performance controls; and the ability to suspend or terminate unsafe agents and automations immediately.
That shifts governance from reactive oversight to governance by design.
Instead of discovering that an AI system accessed the wrong resource after something happens, access is restricted before execution.
Instead of finding unexpected AI costs at the end of the month, usage can be measured continuously.
Instead of relying on individual employees to decide what information can be shared with a model, organizational policies determine those boundaries.
Instead of manually investigating an agent’s actions, administrators have an auditable activity trail.
And instead of forcing departments to choose between innovation and IT approval cycles, enterprises can give teams freedom inside centrally governed environments.
From Shadow AI to governed AI
This is particularly important because restricting AI rarely eliminates AI usage.
It often pushes it outside enterprise visibility.
When employees need AI to perform their work but sanctioned enterprise tooling cannot meet that demand, they may turn to individual AI subscriptions, external applications, personal accounts, or unapproved integrations.
That creates Shadow AI: AI use occurring beyond the organization’s established technology controls.
The better response is not simply to block access.
It is to provide a governed environment that is useful enough that employees do not need to work around the enterprise.
Technology leaders need to know which models are available, who can use them, what information they can access, which external systems agents can interact with, and what actions require human authorization.
That is where orchestration becomes as important as intelligence.
Why Codimite built CommandLyne
At Codimite, we see the next enterprise AI challenge as much bigger than model selection.
Enterprises need to connect intelligence with controlled execution.
That is the thinking behind CommandLyne, Codimite’s enterprise AI orchestration platform built for governed AI operations on Google Cloud.
CommandLyne is designed to create an operational layer around enterprise AI rather than leaving every agent, model, workflow, and integration to operate independently.
The platform provides a secure and auditable AI orchestration environment designed to help teams deploy, govern, and scale AI agents while maintaining visibility and operational control.
Its governance architecture includes Google Workspace SSO, role-based access controls, protected credential management through Google Secret Manager, controlled runtime environments, audit visibility, and approval-based execution.
CommandLyne can log prompts, tool activity, external API calls, and provisioning events, while administrators can define execution boundaries and terminate unsafe sessions or runaway automations when necessary.
That distinction is important.
The enterprise does not need another AI interface.
It needs a way to connect AI models, agents, data, workflows, and business systems without losing visibility when those systems begin to act autonomously.
The new CIO mandate: move fast and remain in control
Enterprise AI adoption is not going to slow down.
Organizations are continuing to increase AI deployment and investment. Technology executives are preparing for significantly more AI agents. And employees and business teams will continue finding new ways to apply AI whether centralized IT programs move quickly enough or not.
The question facing CIOs and CTOs is therefore changing.
It is no longer:
“Should our enterprise use AI?”
It is:
“How do we let the entire enterprise use AI while maintaining security, visibility, accountability, cost discipline, and operational control?”
Two in three CIOs and CTOs being accountable for systems they do not fully control should not become a permanent feature of enterprise AI.
It should be a warning.
AI can move at machine speed.
Enterprise governance needs an architecture capable of moving with it.
Take control of enterprise AI
Bring your AI models, agents, workflows, access controls, auditability, and execution governance into one operational layer with CommandLyne.
