Agentic AI got real in Q1 2026. Most enterprise charters were written for a different quarter.

Gartner reported on 7 Apr 2026 that only 28% of AI infrastructure projects in enterprise deployments fully pay off, and that 57% of I&O leaders who faced a failure said they had “expected too much, too fast” (Gartner; The Register coverage). Eight days later, OpenAI shipped an Agents SDK update aimed explicitly at helping enterprises deploy safer, more capable agents (TechCrunch, 15 Apr 2026). Between the two, Unit 42 documented the first large-scale indirect prompt-injection attacks observed in the wild, including ad-review evasion and system-prompt leakage on live commercial platforms, not in a lab (Unit 42, Palo Alto Networks).

Three signal sets in one nine-day window. Covered separately by the industry-analyst cycle, the AI trade press, and the security press. Read together, they are the same story: Q1 2026 is the quarter enterprise agentic-AI crossed three thresholds simultaneously, and most governance charters were written for a different quarter.

Why the three thresholds crossed this quarter and not last

Anyone expecting this convergence on this timeline would have been reading one specific dataset. Stanford HAI published its 2026 AI Index this month, and two of the charts do more work than the text around them. On OSWorld, the benchmark that tests agents on real computer tasks across operating systems, the best model went from roughly 12% success in early 2024 to 66% in 2026, within 6 percentage points of the 72.35% human baseline (Stanford HAI AI Index 2026). Agents handling cybersecurity tasks moved from 15% to 93% success in the same window. Capability curves that bend this quickly are the precondition for everything else in this piece. Governance infrastructure ships when the underlying capability is deployable. Attack patterns cross from research to production when the agents they target are good enough to be worth compromising. ROI data becomes measurable when deployments reach scale.

Stanford’s other headline number is the one that explains the ROI gap. 62% of organisations named security as the primary blocker to scaling agentic AI, 24 percentage points ahead of the next-closest factor. Not skills, not cost, not regulatory uncertainty. Security. The cited reason organisations could not scale is exactly what Unit 42 has now published evidence of.

What the vendors shipped, and what the shape of the shipping tells us

In the same window, the major vendors shipped their first serious governance layers. OpenAI’s 15 Apr 2026 Agents SDK update added enterprise safety controls at standard API pricing. Microsoft released Agent Framework 1.0 GA with stable APIs, long-term support, and full Model Context Protocol built in; Microsoft’s Agent-to-Agent Protocol now lists 150+ participating organisations including AWS, Salesforce, SAP, and ServiceNow. Databricks shipped Unity AI Gateway GA, extending its Unity Catalog permissions and audit model to agent tool-use (Databricks). In February, Anthropic donated MCP to the Linux Foundation; OpenAI and Block are now co-contributors.

The shape of what got shipped matters more than the fact of the shipping. Three different vendors defined “governed agent” three different ways in three weeks. Microsoft framed it as agent-framework-plus-protocol. Databricks framed it as extension of Unity Catalog’s existing data-governance model. OpenAI framed it as SDK-level guardrails. All three have legitimate answers to the problem. None of them is a standard.

Our read on why the timing looks the way it does

The conventional read is that the Q1 2026 convergence is organic category maturation, the agentic-AI market simply reaching the stage where all three signals had to surface. A closer look at the calendar suggests otherwise. EU AI Act high-risk obligations went live 2 Feb 2026; enforcement activates 2 Aug 2026 with meaningful penalties for governance failures, especially where personally-identifiable information or financial operations are involved (overview). Every major governance framework that shipped in Q1 2026 did so inside that regulatory window, the same quarter vendors needed to be able to tell European customers they had an answer.

The shape of the governance layer being shipped, specifically the permissions models, audit surfaces, and policy hooks, reflects EU compliance requirements first and threat-model completeness second. Enterprises outside the EU compliance perimeter are being given a compliance tool and asked to use it as a security tool. These overlap. They are not the same. CISOs evaluating agent governance frameworks this quarter should test whether the framework solves their top three threat-model priorities or the EU’s top three filing requirements, and notice when those answers diverge. The 62% of organisations naming security as a scaling blocker are, in many cases, being handed a governance layer that was optimised for a different problem.

This observation is our interpretation of the calendar evidence, not a cited third-party finding. It is reviewable alongside the main claim of this piece.

The contrarian position that the evidence supports

Most procurement advice in the trade press this quarter comes down to “pick a governance framework and adopt it now.” The counter-read, worth taking seriously: a meaningful minority of the 28% that pay off over the next twelve months will be programmes that explicitly did not adopt a governance framework in Q2 2026.

Not because governance is wrong. Because every Q1 2026 framework is a vendor’s answer to a category-level question the industry has not yet settled. Microsoft Agent Framework, Databricks Unity AI Gateway, and the OpenAI Agents SDK are three different theories of what “governed agent” means. Picking one in Q2 commits the organisation to that theory’s threat model, permissioning model, and observability model before the category converges. The safe bet is not the framework. It is the footprint. Programmes that keep agent scope narrow enough to not yet need a framework retain optionality when the category settles. Programmes that adopt a framework without the deployment scale to justify it inherit that vendor’s bet on the shape of the problem, then discover twelve to eighteen months in that the category settled somewhere else.

The middle zone is the risky one. Organisations that adopt for the compliance appearance without the deployment to earn the overhead pay twice: once for the framework, and again when they re-platform.

How MTTD-for-Agents frames the exploit evidence

The MTTD-for-Agents discipline sets a canonical detection-time target of under four hours for high-risk agent deployments. The Q1 2026 exploit evidence reframes what that target means operationally. EchoLeak, the zero-click prompt-injection disclosed this quarter, can exfiltrate enterprise data through Microsoft 365 Copilot’s agent surface in seconds to minutes, not hours. Against that attack profile, four hours is an outcome metric, not a detection window.

Detection has to happen via upstream anomaly signals: unusual outbound data volume to domains the user did not initiate, tool-use frequency spiking outside the user’s working-hours pattern, output-length Z-score on agent responses diverging from the baseline profile. Or it happens by post-mortem. Most enterprise SOCs are not measuring these at the agent layer today. The Q2 action is to get the signal sources instrumented, not to adjust the four-hour target.

What Q2 procurement posture should look like

Three positions worth writing into the Q2 2026 leadership agenda.

Re-date the charter. Pull the agent governance charter and check its drafting timestamp. If it predates the Unit 42 disclosures (March 2026), the MCP Linux Foundation donation (Feb 2026), or the first-wave vendor framework launches (Q1 2026), it is a document describing a market that no longer exists. Not wrong. Out of date. Q2 is the window to update before an incident forces the revision.

Separate the compliance question from the security question in procurement. Every vendor now has a governance page. The specific question to ask is which of two problems the vendor is optimising for: EU AI Act high-risk filing coverage, or the CISO’s top threat-model priorities. A framework that does both is rare; most do one well and the other by adjacency. Knowing which is being offered changes the negotiation.

Instrument for MTTD at the agent surface, independently of framework adoption. The March 2026 attack evidence is not contingent on which governance framework the organisation chose. Agent-surface telemetry (outbound data flows, tool-use cadence, cross-agent delegation rate, output-length drift) is independently valuable, and is a workload the security team can own without waiting for a framework decision. Organisations that will be in the 28% are the ones that built this telemetry layer early.

Holding-up note

The primary claim of this piece, that Q1 2026 is the quarter enterprise agentic-AI crossed three thresholds simultaneously and that programmes designed around only one will not make the 28% that pay off, is reviewable on a 60-day cadence. The secondary interpretation, that the Q1 governance frameworks are shaped by EU AI Act compliance requirements first and threat-model completeness second, is reviewable alongside. Four kinds of evidence would move the verdict:

• Gartner Q2 2026 I&O payoff update showing the 28% figure holding, rising, or falling by more than 5 percentage points. A meaningful move in either direction revises the ROI frame.
• A second named-vendor in-the-wild prompt-injection disclosure on a commercial platform with more than 1M monthly active users, reported through a published security-research channel before 17 Jun 2026.
• A named Fortune-500 or FTSE-100 published charter revision that scopes attack evidence, governance infrastructure, and deployment footprint as distinct procurement questions. The first public example will be worth naming; the count across the 60-day window is the more informative measure.
• Any of the three Q1 2026 vendor frameworks shipping a non-EU-compliance-oriented threat-model update that materially changes the compliance-versus-security separation described above.

If any of the four land, the verdict moves to Partial and the correction log captures what changed, dated. If the evidence moves decisively against the claim, the verdict moves to Not holding and the original sentence stays visible, annotated. Nothing is quietly removed.