The UK government’s AI Opportunities Action Plan has produced measurable results. Since January 2025, it has driven £68 billion in AI investment pledges and a tenfold increase in public compute capacity, and it has established the UK as the leading AI market in Europe. But the challenge limiting progress inside enterprises is one that policy cannot solve alone. Most organisations have adopted AI coding tools faster than they built the infrastructure to govern them.
A recent study of more than 1,500 developers and technology leaders found that 78% say their teams are writing and committing code faster since adopting AI tools, but only 21% report productivity gains beyond code generation itself.
When Adoption Outpaces Governance
Research shows that 82% of organisations report AI-generated code risks are creating a new form of technical debt they are not prepared to manage.
Across every function, employees use provisioned AI tools to generate production-grade code, build automated workflows and deploy agents to support business processes. That experimentation is happening without visibility into what others have built, or the structural risks accumulating as a result. This is evident in the operating bottleneck currently playing out inside large enterprises. Teams need AI support, but the formal channel is slow, backlogged or unclear, so they build something independently instead. The instinct makes sense; the lack of structure is what creates the risk.
The costs from this kind of inefficiency can add up quickly. Effort gets duplicated across departments with no visibility into each other’s work, siloed tooling emerges with no shared standards and security and data handling practices diverge. A misconfigured tool that made it through review is a governed risk; a production workflow a finance team built over three weekends with no oversight is still invisible. At most organisations, this category of unseen work is growing. By 2028, Gartner predicts the average Fortune 500 enterprise will use more than 150,000 agents.
The UK Governance Challenge
For UK enterprises, that risk carries compliance weight. Unlike the EU, the UK has no single AI Act. Instead, organisations sit across five overlapping regulatory regimes, with obligations that vary by sector. Only 28% of organisations say their software development lifecycle tools are fully integrated with shared data and workflows. In a compliance environment this fragmented, that gap is a liability.
The organisations treating AI governance as a gatekeeping function have missed the point. AI needs governance, but how we see the role of governance needs to change. The biggest risks live in the work that never enters the queue, and the only way to govern that work is to be present where it happens, before it compounds into something much harder to fix.
What Agentic Engineering Requires
Agentic engineering has two requirements: agentic coding, which most organisations already have and agentic infrastructure, which most do not. Agentic infrastructure covers four areas working in concert: execution, context, governance and orchestration.
The execution layer is the first place the gap between human-scale and machine-scale infrastructure becomes visible. Development platforms built for human-paced work were never designed for the concurrency that agents introduce. Git backends, CI/CD pipelines and deployment systems need to handle millions of agent sessions without degrading, and for organisations running mission critical software, the path from a production incident back to its origin needs to be measured in minutes, not days.
Context is the second requirement. Chris Hutchison, Enterprise Toolchain Director at Barclays, has noted that in a highly regulated environment, the concerns about data privacy and security around AI are more acute than in other industries, and that the governance infrastructure underneath AI tools matters as much as the tools themselves. A context graph that connects code, work items, pipelines, security findings and production signals gives agents the grounding they need to be genuinely useful rather than a source of new risk.
Governance is the third layer, and in the UK’s disjointed regulatory environment it carries the most compliance exposure. Agent actions need an identity, a policy and an audit trail. Across the UK’s overlapping regulatory frameworks, that is not optional.
Governance That Travels With The Work
To scale governance effectively without creating new problems, organisations need to accommodate AI experimentation. Establish a central team focused on policy and standards: setting technical guardrails, owning vendor selection and creating reusable patterns that every function across the organisation can draw from. Its job is to make responsible AI work the default so individual review becomes the exception rather than the rule.
But central policy alone is not enough. Leaders must embed AI transformation owners inside each function. These owners work day-to-day inside a function but report to a centralised governance team. Their position inside the function gives them the context to act, and their reporting line gives them the authority to apply controls consistently. Instead of teams building in isolation, there is always someone who can triage, prioritise and connect the work back to what already exists elsewhere.
A good signal that governance is enabling sanctioned AI experimentation is how much work across the organisation is compounding in value: a pattern built for finance getting picked up by operations, a workflow proven in one team becoming the default in three others. A dropping volume of IT requests combined with visible AI usage tells you experimentation is both maturing and staying visible.
Where the Investment Pays Off
Orchestration ties this all together. The orchestration layer determines which agents run, in what sequence and how failures and handoffs are resolved across the full software lifecycle. In practice, it means low-risk changes move fast and higher-risk changes get human review, without slowing the whole system down. Without it, the other three are independent capabilities rather than a working system. Organisations that have all four in place are operating at a fundamentally different level than those still running agents on infrastructure built for humans.
Eighty-five percent of respondents agree that the next phase of AI in software will focus less on generating code and more on governing it. The UK has built the investment foundation. The organisations that build the governance infrastructure to match will be the ones that actually deliver software that moves at the pace agents make possible, with the control that mission critical environments require.
