Governance Is Where the Agents Are

The objection is that governance slows deployment. This quarter's research points the other way — and explains why so much governance still produces nothing.

Every PMO Director arguing for governance investment ahead of an AI deployment has heard the same reply: we do not have time for that. The reply is not unreasonable. It is also not supported by what this quarter's research found about where agents are actually running in production. Three organizations surveyed three different populations and produced a picture the objection does not account for. A fourth voice, writing from the transformation consulting side, explains what the surveys cannot: why a governance structure can exist on paper and still deliver none of the benefit. This issue lays out what each source said, and what the PMO owns in the answer.

Executives are not dismissing governance out of ignorance. They are under pressure that governance appears to compete with.

Avalara's Agents of Change report, based on a survey of CFOs and senior finance leaders, found that "71% say the pressure to deploy agents is focused primarily on deployment speed." The same report found that "Only 7% say their organization prioritizes governance over speed," and that "30% have not updated internal controls within the last year to reflect AI agents taking or recommending actions."

That is the environment a PMO Director is arguing into. Not skepticism about controls — a measured priority conflict in which speed is winning.

If governance were the brake the objection assumes, the organizations with the least of it would be furthest along. That is not what an audit firm's survey found.

Schellman's State of AI Governance Report 2026, a survey of U.S.-based professionals involved in AI governance, reports that "Organizations with mature AI governance are significantly more likely to have agents in production (78%) than organizations with developing governance programs (22%)." The same survey found that "46% already have AI agents in production."

The direction of causation is not established by a survey, and we are not claiming it is. Mature organizations may govern well because they are mature. But the association is the wrong shape for the objection. On this evidence, the organizations running agents in production are not the ones that kept governance light.

The harder finding is that having a governance program and having one that produces anything are different states.

Arctera's State of AI Governance 2026, surveying compliance decision-makers in the Americas and EMEA, found that "while more than half (55%) have the core AI policies, training and review steps in place, fewer than one in five (19%) have the logging, retention, detection and scoring controls needed to prove what happened." Arctera's Soniya Bopache states the shift plainly: "Moving from policy to proof means organizations must treat evidence as part of the AI workflow itself, not something to be recreated after the fact."

Writing in the Emergent Journal in June, Jesse Jacoby of Emergent LLC named the mechanism from inside the PMO. His argument is that traditional PMO architecture — sequential phase gates, calendar-cadence steering committees, headcount-based resource models — was built for predictable, linear programs, and that AI-augmented transformations break its assumptions. The result is a governance structure producing "the appearance of control without providing the substance of it." His sharpest line targets the room rather than the roadmap: "when approvers can't evaluate what they're approving, governance becomes ceremony."

Put the two together carefully, because they are doing different work. Arctera measured an evidence gap. Jacoby describes a decision-quality gap. Neither explains the other. Both describe governance structures that pass reviews and produce nothing an auditor, a board, or a delivery team can use.

A note on all four sources. Arctera, Avalara, and Schellman each sell into the market their surveys describe, and Emergent LLC sells transformation consulting. These are interested parties making market arguments. Read the findings as such. The convergence across four vantage points is the observation worth keeping, and it stays a convergence rather than a combined figure: three surveys asked different questions of different populations, and the fourth source is an argument, not a measurement. Each finding belongs to the organization that reported it.

None of these sources make the delivery-level translation. That is the gap.

A governance program that produces the production-side result is not a policy binder and a monthly review. It is an operating structure with four working parts, and a PMO already owns all four.

Intake that classifies. Every AI initiative enters through a defined front door, with a risk classification applied before work starts. Without this, tiering has nothing to act on.

Tiering that routes. Governance weight scaled to exposure, reversibility, and blast radius — not applied uniformly. Brief 04 makes this case: uniform review throttles the harmless and under-examines the consequential.

Decision rights that are written down. Who approves what, at which tier, and who answers when an agent acts wrongly. Defined before deployment, this question has an answer. Defined after an incident, it has a meeting.

Reporting that produces evidence as a byproduct. Delivery artifacts that trace claims to the standards governing them, generated by the work rather than reconstructed for the audit. Brief 03 covers the citation standard behind this.

That sequence is what separates the governance associated with agents in production from the governance that shows up as ceremony. It is delivery work. It is not a purchase, and it is not a policy exercise.

The objection was never wrong about the pressure. It was wrong about which path is slower.

The Clearline Briefing is published monthly. Future issues will cover the agent register as a PMO artifact — governance built from intake discipline rather than purchased as a platform.

If you have not yet read the four foundation briefs, they cover the prerequisites in detail. Read them at clearlineadvisors.ai/resources.

— Clearline Advisors