CIOs Say AI Risk Is Now Outrunning the Value It Creates

For two years the standard complaint about enterprise AI has been that the value is slow to arrive. The message from this week's Gartner IT Symposium/Xpo in Orlando is less comfortable: while companies wait for the value, the risk is compounding faster. In the opening keynote, Gartner told an audience of more than 7,500 CIOs and IT executives that the job is no longer simply to find returns from AI. It is to make those returns grow faster than the exposure that comes with them.

Risk Is Winning the Race

The headline number is stark. According to Gartner's keynote analysis, 86 percent of CIOs report that AI risk is growing faster than AI value in their organization, and on average they estimate that risk is growing four times faster. The same analysis notes that the average organization increased its number of AI use cases by more than 400 percent in a single year, while the 2026 Gartner C-Suite AI Survey found that only one in five AI use cases delivers positive returns.

That combination explains the imbalance. Every new use case adds data access, vendor dependencies, security exposure and decisions made without a human in the loop. Only a fraction of those use cases add measurable value. When volume grows by multiples and the success rate holds at one in five, risk accumulates on every deployment while value accumulates on only a few of them.

The value is real where it lands. "People are doing more with AI than ever before, and 58% of leaders said they are seeing some positive value from their AI initiatives," said Daryl Plummer, VP, Distinguished Analyst and Gartner Fellow, citing a Q2 2026 survey of more than 1,000 functional leaders in Gartner's keynote release. "While many organizations are seeing pockets of AI success, they are struggling to consistently replicate and scale that value across the enterprise."

Agents Are Arriving Before the Guardrails

The sharpest gap in the research is around AI agents. A Q2 2026 Gartner survey of more than 2,000 CIOs and technology executives found that 71 percent of organizations expect to deploy agentic AI within the next 12 months, yet only 21 percent currently have agentic AI governance capabilities in place. "That imbalance makes it difficult to create value faster than AI creates risk," said Kristin Moyer, VP, Distinguished Analyst and Gartner Fellow. "Managing value and risk is about building the right kinds of momentum while avoiding the wrong kinds of drag."

Agents raise the stakes because they act rather than suggest. A chatbot that drafts a poor answer creates rework. An agent that can update a record, trigger a refund or call another system on its own creates an operational incident. Governance that was designed for assistive tools, where a person reviews every output, does not automatically extend to software that executes work.

The organizational wiring is not ready either. Only 25 percent of CIOs align technology and business risk, according to a Q3 2026 Gartner survey of 303 CIOs and IT risk management leaders. In most companies, the people who own AI tools and the people who own the business processes those tools touch are still assessing risk separately, with different thresholds and different vocabularies.

Spending Is Accelerating Anyway

None of this is slowing investment. Gartner's latest IT spending forecast, released October 21, projects worldwide IT spending of $7.35 trillion in 2027, up 15 percent from 2026 and above $7 trillion for the first time. Data center systems spending is forecast to rise 55.5 percent to $1.366 trillion, and software spending 14.6 percent to $1.679 trillion. Earlier in the week, Gartner's 2027 CIO Agenda survey of 2,002 CIOs found that only 13 percent say their enterprise has realized significant or transformational value from AI so far.

More money flowing into a portfolio where most bets fail and the guardrails lag is how risk outruns value. The question for operations leaders is not whether to keep investing. It is whether each additional deployment arrives with the controls and ownership that let it compound value rather than exposure.

Alignment, Not Centralization

Gartner's prescription is notably not a central AI police force. The firm recommends a Value-Risk Flywheel to map what is compounding and why, and what it calls an AI Central Bank, a virtual control plane for AI decision making across the enterprise. "It's not about centralization. It's about alignment, coordination and collaboration," Moyer said. Plummer was equally direct about the limits of any framework. "What it will not do is eliminate risk, and it will not drive value. The only thing that can do that, is people."

The third recommendation leans on that point: empower the advanced AI users Gartner calls AI artisans to act as entrepreneurs who find and scale new sources of value. The logic is that the value side of the flywheel will not keep pace unless the people closest to the work are given room to reinvent it, inside guardrails everyone has agreed to.

A practical playbook for operations leaders:

• Score risk and value on the same sheet: Review every AI use case against both its measured return and its exposure, so a growing tool with a growing risk profile is visible as one decision, not two separate reports.
• Gate agents on governance, not on demand: Before any agent is allowed to take actions in a production system, define what it may change, who approves its scope and how its actions are logged and reversed.
• Put business owners in the risk conversation: With only a quarter of CIOs aligning technology and business risk, give each use case a named process owner who signs off on the risk tolerance alongside IT.
• Introduce deliberate good drag: Add review steps where errors are costly, such as customer-facing or financial actions, and remove them where AI is proven and the downside is small.
• Prune before you add: With only one in five use cases delivering positive returns, retire weak deployments before launching new ones so that risk does not keep accumulating from tools that produce no value.
• Back the people who find value: Identify the employees already getting real results from AI, give them time and budget to spread what works, and reward them when they do.

The first phase of enterprise AI was measured by adoption. Gartner's message from Orlando is that the next phase will be measured by ratio. Companies that keep adding AI faster than they add oversight will find the risk side of the ledger compounding on its own. The ones that pull ahead will be those that make every new deployment earn its place on both sides of the flywheel.