Ten things companies should be thinking about in AI right now

Every few months the AI conversation resets around a new model. Underneath, the questions that decide whether a company gets value have been shifting more slowly, and in a clear direction: from "can it do this?" to "can we trust it, run it and afford it?"

Here are the ten I would put in front of a leadership team at a 20 to 500 person company today. I have kept the numbers to sources I could check, and said where a figure comes from a vendor's own survey.

1. Agents need their own identities and permissions

Agents are moving out of pilots and into real systems, and most of them run on a person's login or a shared API key. That means no record of which actions the agent took, and access far broader than its job needs.

Standards bodies have caught up with this. In February 2026 NIST's National Cybersecurity Center of Excellence published a concept paper on identity and authorization for software agents, and OWASP published a Top 10 for agentic applications covering tool misuse, identity and rogue agents.

What to do: give every agent its own credentials, scoped to the job, with an audit trail. Treat it like a new hire, not like a macro.

2. Prompt injection is not going away

The UK's National Cyber Security Centre put it bluntly: language models do not enforce a security boundary between instructions and data. An agent that reads an email, a document or a web page can be steered by what is written in it, and there may never be a complete fix.

That changes design, not just security review. If an agent can both read untrusted content and take actions, assume someone will eventually try to hijack it.

What to do: limit the blast radius. Least privilege, human approval for anything irreversible, and separate the agents that read from the ones that act.

3. Agent integrations are a new supply chain

The Model Context Protocol, the standard way to connect agents to tools and data, now sits with the Linux Foundation's Agentic AI Foundation, backed by the major AI vendors. Thousands of public MCP servers exist. Security has not kept pace: a July 2026 research preprint that audited 414 production servers found most lacked proper authentication, and hundreds of tools exposed shell access with no access control.

What to do: connecting an agent to a third-party server is installing a dependency with access to your data. Vet it, pin the version, and keep an allow-list.

4. Your staff are already using AI you have not approved

In a June 2026 survey commissioned by PagerDuty of office workers at large companies, 66% said they had used AI tools they believed were against policy, and 88% had shared work information with public AI tools. The same survey found 75% would likely look for an employer with better AI skills development.

The sample is large companies, but the pattern is everywhere. Bans push use underground, where you cannot see it.

What to do: provide a sanctioned set of tools, a one-page rule on what data can go into them, and training. It is a security decision and a retention decision at the same time.

5. Adoption is up, business results are flat

McKinsey's 2026 State of AI, as reported by FM Magazine, found the share of organisations reporting any EBIT impact from AI holding at about 37%, roughly where it was a year earlier. Large companies scaling agents rose from 27% to 40%; smaller organisations stayed flat at 22%.

People feel more productive. The P&L mostly does not notice. The gap is the work between "everyone has a tool" and "this workflow now runs differently, with an owner and a metric."

What to do: stop measuring adoption. Pick one or two workflows, redesign them around AI, and measure the business outcome they were supposed to move. This is the core of becoming an AI-native company.

6. In software, checking is now the bottleneck, not writing

Stack Overflow's 2026 developer survey found 73% of developers who use AI coding assistants or agents use them daily. Writing code is no longer the constraint. Trusting it is: Veracode's 2026 GenAI code security report found AI-generated code compiled almost every time but passed security checks only 56% of the time on its benchmark, barely changed from its first report.

That is a lab test of raw models, not a measure of code in your repository. The direction is still clear: more code, arriving faster, needs better review, testing and security gates than the old process had.

What to do: redesign the delivery lifecycle around verification. I wrote up what that looks like in practice.

7. Evals are the new QA

If you run anything built on a language model, you need a repeatable way to measure whether it is getting better or worse. Anthropic's engineering team describes teams without evals as flying blind: regressions show up in production, and every model upgrade is a guess.

Keep evals as your own asset. OpenAI's deprecation schedule includes retiring its own hosted evals dashboard in November 2026, which is a good reminder of why.

What to do: before anything AI-powered goes live, write down twenty real examples of what good looks like and check every change against them.

8. Models change under you

The same deprecation page lists retirements in nearly every month of the second half of 2026, including a whole API that was popular a year earlier. Every vendor works this way. Anything built in 2025 directly against a specific model or a vendor's hosted agent features will need migration work.

What to do: keep model choices in configuration, not scattered through code, avoid preview models in production, and lean on your evals to make a switch a one-day job instead of a project.

9. AI running costs are the new cloud bill

Agents multiply model calls per task, and costs follow. In Stack Overflow's survey, organisations are responding by limiting usage, reviewing spend, and using different models for different jobs. McKinsey's respondents named operating costs as a constraint on AI use about one time in five.

What to do: route simple work to cheaper or smaller models, set a budget per workflow, and make spend visible to the people who own the work.

10. The junior pipeline is thinning

Stanford's Digital Economy Lab, using payroll data, estimates that employment of 22 to 25 year olds in the most AI-exposed occupations was about 19% below where it would otherwise be as of June 2026, mostly through fewer hires rather than layoffs. There is no comparable gap for experienced workers.

Hiring fewer juniors saves money this year and leaves you without seniors in five. Combined with item 4, training is now part of why people join and stay.

What to do: keep hiring juniors and train them to work with AI from day one. The skill that matters is judging AI output, and it is learned by doing real work.

One to know about, then ask your advisers

If you hire in Ontario: since January 1, 2026, employers with 25 or more employees must disclose in public job postings if AI is used to screen, assess or select applicants, including when a recruiter does the screening. I am not a lawyer; your HR adviser or counsel can tell you what it means for you.

Where to start

Most of this list comes back to one question: do you know where AI already sits in your company, who owns it, and what it is allowed to touch? If not, that is the first job. It is what our AI readiness assessment does in a week.