October 17, 2026

Who Owns the Decision to Adopt AI Agents? CEO vs CIO

Written by Christos Papadimitriou October 17, 2026 · Updated October 20, 2026

Who owns the decision to adopt AI agents, the CEO or the CIO? The CEO owns the yes. Agents change how work gets done and what risks the company carries, so this is a business decision first. But the CIO owns the how: whether an agent can be connected safely, under which identity, with which logs and with which off switch. Around them, three supporting roles complete the decision: the process owner proposes the use case and proves the result, the CFO signs the budget, and data protection and security can say stop. One yes, one accountable name: the rest of this post follows from that rule.

This post is for CEOs of mid-sized and large European companies hearing three versions of one sentence. IT: “we need to control this”. A department head: “we need this now”. A vendor: “just switch it on”. All are partly right. The trouble starts when nobody knows who actually decides.

In this post: the five decisions inside “adopting agents”, a CEO vs CIO split you can copy, how company size changes it, warning signs, the EU AI Act and a 30/60/90-day plan.

Everyone claims the decision, nobody answers for it

That is the problem in one line. Ask different people who decides on AI and each group points at itself.

CEOs say the decision is theirs. In BCG’s AI Radar of January 2026, 72% of chief executives said they are now the main decision makers on AI, twice the share of a year earlier. Half of them believe their job is on the line if AI does not pay off.

IT says the committee is theirs. Foundry’s State of the CIO 2026 finds that company AI steering committees are led by the CIO or IT leader in 38% of organisations, by a chief AI officer or equivalent in 26%, and by corporate leadership (the CEO or the board) in only 18%. IT sits on 84% of those committees.

And when a decision goes wrong, the names run out. KPMG’s Global AI Pulse for Q3 2026, with 2,131 respondents in 20 countries, found that only 18% of organisations place accountability for AI-informed decisions with the CEO or executive committee, and 35% with another named executive such as a COO, chief AI officer or CIO. Asked who is accountable when an AI-informed decision turns out to be wrong, only 53% could name that person.

Meanwhile, in an April 2026 CIO.com report on Foundry’s research, 24% of IT leaders said they were uncertain which department is responsible for meeting AI goals or ROI expectations.

One caution: these surveys mostly measure “AI” in general, not agents, and each group tends to report itself as the one in charge. Read them as signals, not a census. The signal is still clear: many people claim the decision, far fewer answer for it.

The decision matters more for agents than for chatbots because an agent acts. A weak chatbot answer wastes a minute; an agent that emails the wrong offer to 400 customers or books a duplicate invoice creates real cost and sometimes liability. If the difference is fuzzy, our guides on what an AI agent is and AI agents vs chatbots explain it in five minutes.

Adopting an agent is five decisions, not one

“Should we adopt AI agents?” sounds like one question. In practice, every agent that enters a company passes through five decisions, and they do not all belong to the same person:

Yes or no, and which process first. Do we bring agents in at all, and where do we start?
The limits. What may an agent never do without a person?
The safe how. Which systems and data may it connect to, and can we see and stop what it does?
The money. What is the budget, and what is the monthly cap?
The stop. Who can halt it, today, if something goes wrong?

Think of how you approve a new hire. Leadership decides the role is needed and what the person must never do without asking; the department head asks for the hire; IT decides which access the job justifies; finance approves the cost. Nobody lets IT decide alone whether the company needs a new sales team. Agents deserve the same clarity. We call this an AI workforce: agents adopted and managed like staff.

The limits decision has a concrete form. At theagency47 every agent gets one of three autonomy levels, written into its spec before it is built:

Suggests. It drafts and recommends; a person decides and sends.
Acts with approval. It prepares the action; a person approves before anything goes out.
Acts on its own inside written limits. It handles routine cases by itself and escalates anything outside its limits.

Every action is logged, whatever the level. The more an agent may do alone, the more senior the person who must say yes: an agent that only suggests replies can be approved by a team lead; one that acts on its own with customers or money needs the limits agreed at the top. See bounded autonomy and human-in-the-loop.

For “which process first”, we sort agents into three organisational levels: Executive (briefings and decision support for leadership), Operational (departmental flows such as sales, support or finance) and Task (repetitive, bounded work such as email triage or data entry). Most companies should say their first yes at the Task level, where results are easy to measure. The three-tier AI workforce model explains why.

CEO vs CIO: who decides what

Here is the split we recommend. Each row is a decision in the adoption process. Decides means the final say. Signs off means the role must agree before it happens. Proposes means the role brings the case. Informed means the role sees the outcome.

Adoption decision	CEO / owner	CIO / IT	Process owner	CFO	DPO and CISO
Do we adopt agents at all, and why	Decides	Signs off	Informed	Informed	Informed
Which process gets the first agent	Decides	Signs off	Proposes	Informed	Informed
What no agent may do without a person	Decides	Signs off	Proposes	Informed	Signs off
Starting autonomy level of each agent	Signs off where customers or money are involved	Signs off	Proposes	–	Signs off
Which systems and data it may connect to	Informed	Decides	Proposes	–	Signs off
Budget and monthly spending cap	Signs off	Signs off on run costs	Proposes	Decides	–
Go-live	Informed	Decides (technical readiness)	Decides (business readiness)	–	Signs off
Stopping an agent	Can stop	Holds the switch	Can stop	–	Can stop
After 90 days: scale, fix or retire	Decides	Signs off	Proposes, with numbers	Signs off	Informed

Two rules make it work: every adoption decision ends with one accountable name, a person, not a committee; and several roles can stop an agent, but one holds the switch and has tested it.

The CEO: the yes, the first process and the limits

The CEO’s part is small in hours and large in effect, and none of it is technical:

Say yes to a process, not to a tool. Name the two or three processes where agents should go first, and why.
Write the limits. List what no agent in the company may do without a person: move money, change prices, make commitments to customers above a set value, decide anything about an employee or applicant, touch health data. That list becomes the base for every agent’s escalation rules.
Set the day-90 test. Before the first agent goes live, write down what it must show after 90 days (hours saved, error rate, response time, cost per case) and what happens if it doesn’t.

This attention pays. In McKinsey’s March 2025 State of AI survey, CEO oversight of AI governance was one of the elements most correlated with higher self-reported bottom-line impact, and at larger companies it was the element with the most impact on EBIT attributable to gen AI. It is a self-reported correlation, not proof. The same survey found that only 28% of respondents say their CEO oversees AI governance, and fewer than one in five organisations track KPIs for gen AI. The day-90 test is the cheapest fix for that.

Models, platforms and integration methods are for IT and the process owner, inside the CEO’s limits. On where chief executives stand today, our sister research team at House of 47 published Are CEOs ready for AI agents?

The CIO: the safe how, the go-live check and the off switch

The CIO, or whoever runs IT, does not decide whether the company adopts agents. The CIO decides whether a given agent can be adopted safely, and on what terms:

A separate identity per agent. Its own account, never a shared password or a colleague’s personal login, so you can see what it did and remove its access in one step.
The narrowest access that does the job, read-only wherever possible. See our AI agent security guide.
Logs of every action: what came in, what the agent decided, which tool it used and what went out.
The off switch. One documented way to stop an agent within minutes, tested on purpose at least once before go-live.
The register. A single list of every agent that is live, what it can touch, its autonomy level and who approved it.
Integration standards. How agents connect to company systems. We prefer API-based workflow automation with n8n, because the workflows stay visible and can run on infrastructure you control.

Most companies are not there yet: in KPMG’s Q3 2026 global survey, the share of organisations with basic AI controls in place (data access controls, output monitoring, cost and usage tracking, human review, evaluation and testing, policy enforcement) ranged only between 30% and 43%, depending on the control.

There is a structural catch, too. Foundry reports that CIOs reporting directly to the CEO fell to 40%, from 48% a year earlier, yet boards discuss AI with the CIO or CTO in 72% of cases and with the CEO in only 52% (Deloitte, Governance of AI). So the board often hears about agents from the person furthest from the business result. Better: the CEO reports why and what it delivered, the CIO reports the controls.

Supporting role: the process owner proposes and proves

The process owner (head of accounts payable, customer service lead, sales operations manager) does not make the final call, but no good adoption decision happens without them. They:

bring the use case, with today’s volumes, error rates and hours as a baseline;
propose the starting autonomy level and what the agent must escalate;
decide whether the team is ready for go-live;
run the agent day to day and report the numbers against the day-90 test.

They know what “good” looks like, and the gains come from changing the work around the agent: McKinsey found workflow redesign had the biggest effect on bottom-line impact, yet only 21% of organisations had fundamentally redesigned even some workflows.

Supporting role: the CFO signs the budget

Agents cost money per run. The CFO decides the budget and a monthly cap per agent, with an alert before it is reached. Large US companies are moving this way: in KPMG’s Q3 2026 US pulse (firms with $1B+ revenue), 74% include cost reviews in AI approvals and 43% set usage or token budgets. Boards are further behind: only 8.9% of US public-company boards have approved an annual budget for AI projects, according to NACD’s 2025 survey.

On funding, Foundry finds 36% use IT budgets for AI infrastructure while business units pay project-specific costs: IT pays for the rails, the process owner’s budget pays for the agent. Before the budget decision, try our ROI calculator, the guide to what an AI agent costs and our data on payback by function; for falling run costs, see House of 47’s research on the collapsing cost of intelligence.

Supporting roles: the DPO and the CISO can say stop

Data protection and security do not decide whether the company adopts agents, but each should sign off before go-live and keep the right to pause an agent at any time. The DPO checks personal data, impact assessments and whether employee representatives must be informed. The CISO checks access and tests for attacks such as prompt injection. Bringing them in before the decision costs a meeting; after launch it can cost the project.

Where a chief AI officer fits

IBM’s CAIO study found that 26% of the organisations it contacted in 2025 had a chief AI officer, up from 11% in 2023 (25% in Germany, 22% in Spain, per IBM’s country cut), and its 2026 follow-up saw that share reach 76% among surveyed enterprises. A CAIO can prepare the CEO’s decisions, but does not replace the CEO’s yes or the CIO’s safety check. Most mid-sized companies need the roles above, not the title—see our breakdown of whether you need a Chief AI Officer in 2026.

Company size changes who says yes

Mid-sized companies: the owner decides

In a company of 50 to 500 people, the honest answer is usually simple: the owner-CEO decides. Bpifrance found that in 73% of French PME and ETI it is the company head who drives AI projects, while only 43% have an AI strategy.

That is not a problem, as long as the owner does three things:

Keeps the yes, the first process and the limits, as above.
Names a process owner before saying yes, even if that person also has a full-time job. Especially then.
Makes sure someone inside the company, not only the vendor, can switch each agent off. If IT is outsourced, write access to the logs and the off switch into the contract before the decision, not after.

Agents also need know-how that often lives in a few people’s heads written down; see our sister research on the agent-readable second brain. Our country guides show how the owner’s decision plays out locally: Greece, Italy, France and Germany, where the works council has a say over monitoring technology.

Large companies: the CEO sets priorities, a committee sets the rules

In larger groups a CIO-led AI committee is the common pattern. The risk is a bottleneck that approves every agent one by one, or a forum that approves nothing. A better rule:

the CEO and executive committee decide the priorities: which processes and business results agents should go after;
the committee sets the standards once: identity, logging, risk classes, spending caps, the register;
process owners adopt agents inside those standards without coming back each time;
the executive committee reviews the portfolio quarterly: what is live, what it delivered, what was stopped.

McKinsey found that on average two leaders share AI governance, which works if each knows which half is theirs. Boards need help too: 66% of board members in Deloitte’s survey say their board has limited or no AI knowledge or experience. For multi-department programmes with procurement, SLA and compliance requirements, see our Scale package and OS47, where the kill switch stays with your team.

Seven signs nobody really owns the decision

If two or more of these are true, settle who decides before you add another agent:

Nobody can produce a list of every agent running in the company today, or say who approved each one.
An agent uses a person’s login or a shared password.
“Who can stop it?” is answered with “the vendor”.
Success was never written down before the agent went live.
The AI bill is a surprise every month, and nobody signed a cap.
IT learned about an agent after it went live, or a department learned about a new IT rule after it blocked their agent.
After a mistake, the meeting was about whose fault it was, not about what to change.

Gartner expects that more than 40% of agentic AI projects will be cancelled by the end of 2027 “due to escalating costs, unclear business value or inadequate risk controls”. Costs (no budget decision), unclear value (no day-90 test), weak controls (no CIO safety check): each is a decision failure before it is a technology failure. More in why AI agent projects fail.

Switched-on vs built agents: the decision nobody notices

Many agents arrive not through a decision but as a new feature in software you already pay for: your office suite, CRM, helpdesk or ERP. These embedded agents can be switched on in an afternoon, which means they are often adopted without anyone deciding. IBM’s 2025 CEO study found that 50% of CEOs say fast investment has left them with disconnected, piecemeal technology.

For embedded agents, the rule is short: the CIO decides which agent features may be enabled, and each enabled one goes on the register with a process owner, like any other agent. The vendor’s default settings are not a decision.

Built agents work across several of your systems and follow your own process. They need all five decisions, plus one: how will they connect? Standard connections (Gmail, Slack, Google Workspace, HubSpot) are quick. Connecting an agent to an ERP, a legacy system without an API or your existing RPA bots is a custom integration, and it needs its own scope, budget and sign-off on the IT side. If you run software bots today, our guide What is RPA? explains how agents and bots split the work. Our framework comparison shows why we usually land on n8n. House of 47’s research on who sells AI agents that stick covers the buy, build or agency choice.

What the EU AI Act expects from the company that decides to deploy

Under the EU AI Act, the company that uses an AI system is the deployer. Three dates matter for whoever makes the adoption decision:

Since 2 February 2025: Article 4 asks deployers to take measures to support their staff’s AI literacy (after the AI Omnibus, without guaranteeing a level for each person).
Since 2 August 2026: Article 50 transparency duties are enforced (Commission timeline). If your agents use the Grok API, see what changes with Grok API output watermarking on 7 November.
From 2 December 2027: after the AI Omnibus, the deployer duties for high-risk systems listed in Annex III apply.

Those duties are in Article 26: use the system according to its instructions, monitor it, keep the logs it generates (where you control them), inform workers’ representatives and affected workers before workplace use, and inform people when it helps make decisions about them. The sentence that matters most for the decision is Article 26(2): deployers “shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.”

Authority is the key word: oversight cannot sit with a junior administrator who has no power to stop the system. In our split, the process owner supervises, the CIO holds the switch and keeps the logs, and the CEO’s written limits give both the authority to act.

Is your agent high-risk? Most back-office agents, such as email triage or invoice extraction, are generally not in the Annex III categories. Agents used for things like recruitment screening or credit scoring can be. Check each use case with your legal adviser; this post is not legal advice. For the full set of company rules around agents (owners, autonomy levels, approvals, logs and change control), see our AI governance framework.

Making the first decision: a 30/60/90-day plan

You are not late: Gartner’s 2026 Hype Cycle for Agentic AI notes that only 17% of organisations have deployed AI agents so far. There is time to make the first adoption decision properly before the second and third agents arrive.

Days 1 to 30: decide who decides, then decide.

The CEO picks two or three processes and writes the limits on one page.
A process owner is named for the first agent and brings the baseline.
The CIO writes the conditions for a safe yes: identity, access, logging, the off switch, the register.
The CFO signs the budget and a monthly cap. The DPO and CISO review the plan.
Choose a first agent at the Task level, set to “suggests” or “acts with approval”.
Write the day-90 test. Our free AI Readiness Scorecard is a good two-minute starting point.

Days 31 to 60: first agent live, with a person approving.

The process owner runs the queue; a 30-minute weekly check-in covers what the agent did, escalated and cost.
Test the off switch once, on purpose, and time it.

Days 61 to 90: the second decision.

Compare the numbers with the baseline you wrote down.
Decide: scale, fix or retire. Retiring an agent that didn’t work is a good outcome.
If you scale, move up one autonomy level only after the tests pass and the process owner signs.
Then make the next adoption decision, perhaps at the Operational level, with its own named owner.

How theagency47 helps

Our 5-phase method runs Discover, Design, Build, Deploy and Optimize. Discover ends with your sign-off on a shortlist of candidate agents. In Design, every agent gets a one-page signed spec listing its tools, the decisions it may take alone, its escalation rules and its KPIs: in practice, the written record of the decisions described above. Each agent must pass 90%+ of our internal eval suite (how we test) before launch, and a person monitors it for its first 14 days.

Where to start depends on how big a first yes you want to give:

Spark: one Task-level agent with one standard integration (Gmail, Slack, Google Workspace or HubSpot), live in 14 days. The smallest decision that still tests the whole process on real work.
Workforce Starter: three agents, one at each level (Executive, Operational and Task).
Workforce Pro: five coordinated agents for one department, with one department head as the natural process owner.
Scale package: multi-department programmes, with an executive sponsor process and SLAs.
AI transformation: the company-wide programme that sequences these packages in four phases, for mid-size and large companies.

Connections to ERPs, legacy systems or existing RPA bots are custom integrations, scoped separately. Weighing an agency against advice only? Read AI agent vs AI consultant.

FAQ

Should the CIO decide whether the company adopts AI agents?

Not alone. Whether to adopt agents, and where first, is a business decision for the CEO. The CIO decides whether a specific agent can be adopted safely: identities, access, logs, the register and the off switch. A CIO veto on how is healthy; a CIO veto on whether usually means nobody else took the decision.

Who decides which process gets an AI agent first?

The CEO, based on a case brought by the process owner: today's volumes, error rates and hours, and what the agent would change. The CIO signs off that the process can be connected safely. Most companies should start with a Task-level process where results are easy to measure.

Who signs the budget for AI agents?

The CFO decides the budget and a monthly spending cap per agent, inside the CEO's priorities. A common model is that IT pays for the shared platform and the business unit pays for each agent; 36% of organisations in Foundry's 2026 data split it this way.

Who can stop an AI agent after it has been approved?

At least three people: the process owner, the CIO or IT and the DPO or CISO, with the CEO always able to order it. One of them, usually IT, holds the documented switch and tests it before go-live. If only the vendor can stop an agent, the decision was never fully yours.

Is our email or invoice agent "high-risk" under the EU AI Act?

Usually not. Back-office agents such as email triage or invoice extraction are generally outside the Annex III high-risk categories, while uses such as recruitment screening or credit scoring can fall inside them. For high-risk uses, the Article 26 deployer duties apply from 2 December 2027. Check each use case with a legal adviser.

We are a 150-person company without a CIO. Who decides on AI agents?

The owner-CEO says yes, picks the first process and sets the limits; a named manager brings the case and runs the agent; an IT provider (internal or outsourced) checks that it can be connected safely. Someone inside the company must have log access and be able to switch each agent off; put that in any outsourcing contract.

From the House of 47 group

theagency47 is part of House of 47, alongside search47, which helps companies get found in Google and in AI answers such as ChatGPT, pixel47, a web design and development studio that builds the fast, conversion-focused sites your agents and customers meet first, and 47HNWI, marketing intelligence for reaching high-net-worth individuals. More analysis on AI and agents is on House of 47 Research.

Written by Christos Papadimitriou, founder of theagency47.