Enterprise AI is paying off at scale

A 0.3-point maturity bump is not an EBIT victory lap. McKinsey's 25 March 2026 AI Trust survey puts average RAI maturity at 2.3, up from 2.0. About 30% of organizations reach level 3 or higher on strategy, governance, and agentic AI controls.

Quoted claim

The claim treats generative and agentic AI as a market-wide profit engine: EBIT lifts above five percent, headcount substitution captured, and "AI maturity" treated as synonymous with realized financial returns. Buyers hear it in copilot ROI spreadsheets that map seat licenses directly to margin expansion, in consulting pitch decks citing aggregate survey momentum, and in press summaries that conflate pilot productivity with audited P&L impact at enterprise scale.

Where made

Technology vendor ROI models; earnings-call AI narratives; internal business cases that equate drafting speed or automation demos with EBIT attribution. Counter-source: McKinsey & Company, "State of AI trust in 2026: Shifting to the agentic era," published March 25, 2026 (Gabriel Morgan Asaftei, Roger Roberts, Abby Sticha, Cécile Prinsen). The 2026 AI Trust Maturity Survey gathered responses from approximately 500 organizations between December 2025 and January 2026, from respondents with direct responsibility for AI governance, risk management, or AI investment decisions.

Supporting number / method

Average maturity — progress, not arrival. McKinsey reports average responsible-AI (RAI) maturity increased to 2.3 in 2026, up from 2.0 in 2025, on a four-level scale from foundational practices to a comprehensive proactive program. That is measurable improvement. It is not evidence that most enterprises have converted AI deployment into audited EBIT at scale. Level 2 on a 0–4 scale implies organizations are "still in the process of integrating responsible AI practices," the same framing McKinsey used when the 2025 global survey average was 2.0.

Governance dimensions lag — ~30% at level 3+. McKinsey's headline finding for the agentic era: "only about 30 percent of organizations reach a maturity level of three or higher in strategy, governance, and agentic AI governance." The 2026 framework adds agentic AI governance and controls as a fifth RAI dimension, reflecting that governing autonomous systems is a distinct discipline from governing chatbots. Technical and risk-management capabilities score higher; strategy, governance, and agentic controls trail. McKinsey's own framing: "while technical and risk management capabilities are advancing, organizational alignment and oversight structures are struggling to keep pace with the rapid expansion of AI use."

Security barrier — not ROI proof. Nearly two-thirds of respondents name security and risk concerns, not regulation or technical limits, as the top barrier to scaling agentic AI. AI-related incident rates hold at about 8%. Roughly 60% of organizations that experienced an incident report dissatisfaction with their response. McKinsey reframes the risk shift: in the gen-AI era the hazard was AI "saying the wrong thing," catchable before action; in the agentic era the hazard is AI "doing the wrong thing," where the action may have already executed. That is a maturity and control gap, not a market-wide EBIT victory lap.

EBIT linkage is conditional, not universal. McKinsey finds organizations investing $25 million or more in RAI report significantly higher maturity and are "far more likely to realize material AI benefits, including EBIT impact above 5%." The report frames RAI investment as "not a tax on innovation but a key enabler of sustained value creation." Read carefully: the EBIT-above-5% figure attaches to the highest RAI-investment tier in a correlation, not to the median respondent at 2.3 average maturity with ~70% below level 3 on governance dimensions. McKinsey does not publish a market-wide percentage of enterprises achieving 5% EBIT lift from AI.

Accountability gap. Organizations with clearly accountable RAI ownership, an AI-specific governance role or internal audit and ethics ownership, score average maturity 2.6 versus 1.8 without clear accountability. Naming an owner is the largest differentiator in the data. Most organizations at 2.3 average maturity have not made that organizational commitment. Another reason aggregate "paying off at scale" overreads the survey.

Spreadsheet test for buyers. A vendor deck that divides annual labor cost by copilot seat price and labels the quotient "EBIT gained" fails McKinsey's own maturity framing. The institute measures RAI maturity across strategy, risk, data and technology, governance, and agentic controls, not a formula that converts drafting latency into margin without correction rates, review labor, incident response cost, or governance investment. McKinsey ties realized value to maturity and RAI investment. It does not certify that enterprise AI is paying off at scale for the typical firm in the sample.

Agentic deployment ahead of control. McKinsey added agentic AI governance because organizations are deploying agents faster than they govern them. Only about one-third reach adequate maturity on the dimensions that matter most for autonomous systems. Claiming market-wide EBIT impact while two-thirds of organizations lack level-3+ governance on strategy, oversight, and agentic controls conflates early adopters and heavy RAI investors with the median enterprise.

What would have to be true

Most enterprises would need level-3+ RAI maturity on strategy, governance, and agentic controls, not an average score of 2.3 with ~70% below that bar on the dimensions that govern autonomous action. Material EBIT impact would need to be measured and audited at the firm level, not inferred from aggregate maturity movement of 0.3 points on a four-level scale. Security and incident-response gaps would need to be closed before scaling, yet two-thirds of respondents cite security as the top scaling barrier. The $25M RAI investment tier's EBIT correlation would need to describe the median buyer, not a minority subset.

Verdict (supported | overstated | unsupported | too_early)

overstated as a market-wide enterprise EBIT claim. Supported only for organizations with high RAI maturity, explicit accountability, and firm-level ROI measurement, not as a general 2026 market condition.

Language we will use instead

"We treat McKinsey's 2.3 average maturity and ~30% level-3 governance rate as a market baseline, not an EBIT proof point. We track firm-level correction rates, incident response, and governance investment alongside pilot productivity, and we do not extrapolate vendor ROI decks to P&L without audited attribution on our own books."

McKinsey's survey does not publish firm-level EBIT by company. Buyer-specific P&L impact is UNKNOWN from this source alone.