BCG’s survey hands buyers a number to put in front of vendors. Write the AI agent controls you need into the contract before the pilot starts, not after an agent does something costly.
BCG’s 2026 Applied AI Index, dated September 30, reports that 42% of companies expect to grant AI agents autonomy by 2030, meaning agents deciding without human approval. Only 5% have the full set of critical AI agent controls today. The gap between those two figures is the buyer’s bargaining position, and it closes each time a firm signs first and asks later. Controls only work on clean inputs, so check AI data readiness before you widen access.
Key points
- What did BCG measure about AI agent controls? BCG surveyed more than 1,300 CxOs and senior leaders across 20-plus sectors.
- Which control questions belong in the contract? Five, and they’re ours, not BCG’s. Each one turns a control into a term you can enforce: what the agent may do unasked, what it logs, who can stop it, what it can touch and who pays when it errs.
- What does Ottawa ask of its own systems? The federal Directive on Automated Decision-Making binds departments, not your firm.
- Is a policy worth the paperwork at 40 people? Yes, from the day an agent can send, spend or delete.
What did BCG measure about AI agent controls?
BCG surveyed more than 1,300 CxOs and senior leaders across 20-plus sectors. It found the agentic share of total AI value rose from 17% in the 2025 sample to 22% in 2026, and it expects 39% by 2030. Among “future-built” companies, 44% say they already realize value from agents; among laggards, 2% do.
Companies with all six controls in place generate three times the agentic value of companies with one.
The article never lists the six controls. We checked. Its advice is blunt enough on its own: “Put the controls in before you grant autonomy.”
Read it with the seller in mind. BCG sells AI transformation and governance work, so a finding that governance pays is a finding it’s glad to publish. The “three times” figure compares all six controls against one, and it doesn’t say how value was measured. Mature firms may simply do everything better, and the survey can’t separate that from the controls. The 42% is an expectation about 2030, a forecast and not a plan. The 5% counts firms with the full set, so far more may hold some of the controls. We’d hold every one of those figures a little loosely and still act on the direction.
Which control questions belong in the contract?
Five, and they’re ours, not BCG’s. Each one turns a control into a term you can enforce: what the agent may do unasked, what it logs, who can stop it, what it can touch and who pays when it errs. Ask the vendor for written answers before the pilot date is set.
- What can the agent do without human approval, and can we change that list?
- Where is every action logged, and for how long can we read the log?
- Who can switch the agent off, and how fast?
- What access does it hold, and can that be limited to named files and systems?
- What does the contract say when it makes a costly mistake?
Vendor paperwork is where these answers live. The FTC probe piece covers the auditors that paperwork leans on, and a one-page permissions list is the starting point for any agent that touches company systems. Question five is the one vendors dodge. If the answer is a refusal, you’ve learned what the pilot would cost you.
What does Ottawa ask of its own systems?
The federal Directive on Automated Decision-Making binds departments, not your firm. According to the Government of Canada’s guide to its scope, it requires impact assessment, transparency, quality checks, recourse and public reporting, and it applies even where a human in the loop or an officer makes the final decision.
That’s a government setting a floor for itself. We read it as a ready-made template for a private buyer: recourse becomes an incident clause, and transparency becomes a log you can read. It’s our reading, not a legal requirement on you.
Is a policy worth the paperwork at 40 people?
Yes, from the day an agent can send, spend or delete. Before that, a light touch is fine. An agent that only drafts text can run on a one-page note. After that, you want an agent register naming each agent, its owner and what it can touch, and a rule that no agent gets new permissions without a named approver.
Google is handing agents their own inboxes, so Gemini coworker agents need an owner before they start sending.
The sceptic’s case is that governance slows the pilots that would prove value, and small firms should move first and tidy later. If agents at your firm stay confined to drafting for the next two years, the sceptic wins and you’ve lost an afternoon. But once an agent holds a login, the job is finding out what happened and stopping it. Our agent incident plan walks through one, and our explainer on agentic AI for business covers what agents mean for a firm your size.
One gap in the evidence stays open. BCG’s respondents skew toward senior leaders at larger firms, and the article gives no breakdown for companies under 500 staff. If one showed no link between controls and value, we’d soften the case for front-loading contract terms. We’d still want the five answers on paper.
Send the five questions with your next vendor proposal. The 42% is a forecast, and the 5% is today’s count, so ask the vendor which side of that line its product sits on.
Frequently asked questions
What are AI agent controls?
They’re the rules and technical limits that govern what an AI agent can access and do, and who can stop it. BCG’s survey says only 5% of companies have the full set of critical controls in place today. Agent controls failed in public once already, and the OpenAI Medicare incident is the case to study.
How many companies expect autonomous AI agents?
In BCG’s 2026 Applied AI Index, 42% of companies expect to grant their agents autonomy, meaning they decide without human approval, by 2030.
What should a business ask a vendor about AI agents?
Ask what the agent can do without approval, where its actions are logged, who can switch it off, what it can access, and what the contract says when it makes a costly mistake.
Does BCG say which controls matter?
BCG refers to six controls and says firms with all six report three times the agentic value of firms with one, but its published article doesn’t name them.
BCG sells consulting services in this area. Backdated to October 7, 2026. Written and fact-checked on October 8, 2026. Sources are linked on the claims they support.
