Q1 2026 is the quarter enterprise agentic-AI crossed three thresholds simultaneously — the first at-scale in-the-wild exploits, the first vendor-shipped governance infrastructure, and the first hard ROI data — and programmes designed around only one will not make the 28% that pay off.

60-day cadence because the Gartner Q2 I&O update lands inside the window. Secondary interpretation (that Q1 governance frameworks are shaped by EU AI Act compliance requirements first and threat-model completeness second) is reviewable alongside the primary claim.