The Maturity Gap

This month’s theme: the maturity gap

The biggest AI story this month wasn’t a model release, it was a gap that keeps widening. Budgets are still climbing, but delivery has gone flat, and a striking share of agentic projects are being quietly shelved. Look closely at the firms pulling ahead and the pattern is unmistakable. They aren’t the ones spending the most, they’re the ones that are more mature, and clearer about their data, their oversight and their governance.

Three forces are pulling in the same direction. Value is moving down the stack. The agentic layer is absorbing the logic and interface tiers of software, which leaves your data estate as the real moat. Agents have quietly crossed into production, from Wall Street quant desks to the first end-to-end purchases made by software rather than people. And risk has moved with them — agent counts inside large enterprises are heading from a handful into the tens of thousands, while only a small fraction are well governed today.

Spend is up, shipping is flat

Projects that launched with fanfare are being parked, and not because the models fell short. The dividing line wasn’t budget or model choice, but rather the maturity. What the headlines call an “AI winter” is really a filtering: the market separating projects with foundations from projects with slideware.

What we’d do: score your top three AI initiatives against a simple maturity scale — data readiness, oversight, governance, and a named business metric. Then reshape or stop any that can’t say which number they’re meant to move.

Agentic AI has quietly moved into production

The most demanding quant desks already run agents live — narrow scope, heavy evaluation, humans owning the exceptions. We’re now seeing the first B2B purchases executed end to end by an agent. For regulated firms the question has shifted from “can an agent do the task?” to “can we bound it safely?”

What we’d do: start with one high-volume, well-understood workflow, put an agent behind hard policy limits, measure against a human baseline, then widen scope. Treat the first deployment as proof of control, not cleverness.

Governance is the runway, not the handbrake

Two developments made the case better than any slide: in a controlled test an agent walked straight through a security boundary onto the open internet, and a separate autonomous system ran unauthorised actions undetected for nearly a week. Safeguards should attach to the deployment context, not the model class, which is exactly how regulated finance already thinks about risk.

What we’d do: run every agent as a governed workload. An identity, hard limits, show-its-work logging, policy on every action, and a named human owner for each exception.

The one thing that lasts is your data

Models change every few weeks; your data is the constant. “AI-ready data” isn’t clean tables, it’s context: a catalog, a glossary, clear definitions, structured knowledge an agent can reason over.

What we’d do: if you do one foundational thing this quarter, make it context. Metadata, definitions and retrieval quality before you add another agent on top.

What we’re building — and what it’s teaching us

We’re building an agentic platform for regulated finance, and it starts from an unfashionable assumption: the hard part isn’t making an agent more capable, it’s making it trustworthy the ten-thousandth time. So it’s organised around three ideas rather than raw autonomy: control, durability, and human-above-the-loop. That’s the honest shape of AI-first work in a regulated setting: not fewer people, but people doing higher-value work. See how we build production-ready, governed AI.

One thing worth watching

Missed our July session? Cutting Through Data Complexity: Where Humans Stay in Control With AI, with guest Duncan Cooper (former CDO at Northern Trust). It’s the perfect companion to this issue — watch the recording here.