Editorial correction — 14 October 2026: We corrected the survey attribution and population, removed unsupported UK-wide adoption and investment claims, and separated our governance assessment from measured results. The original publication date is retained. This is source-based analysis, not a report of hands-on enterprise deployments.
What the available survey actually measures
The 2026 Process Optimization Report is published by Celonis, not Salesforce. Its 1,649 respondents are business leaders across the world. On its report page, 85% say they aim to become agentic enterprises within three years, while 47% identify a shortage of expertise as their leading AI adoption obstacle. These are reported intentions and perceptions in a vendor-sponsored global survey. They do not establish the proportion of UK companies running autonomous agents, or prove that their controls have failed.
That distinction changes the business question. A forecast about adoption cannot tell a buyer whether a particular agent is permitted to change a customer record, approve a payment or contact an external recipient. Those permissions must be established from the actual deployment.
ObvioTech assessment: test authority, not the label
Our recommended starting point is a small permissions record for each workflow. Name the business owner, list the systems it can reach, identify actions it can take without review, and specify what requires a person’s approval. A read-only summariser and an agent with purchasing access should not inherit an identical approval policy merely because both use a language model.
Next, test a deliberately limited task against a known expected result. Record the source data, tools invoked, external effects and final output. Include a failed request and a duplicate request: a successful demonstration alone does not show that a workflow stops safely or avoids repeating a consequential action. These are practical editorial recommendations, not a finding that every business must implement the same architecture.
Existing obligations still depend on the use
The ICO’s automated decision-making guidance addresses decisions based solely on automated processing that have legal or similarly significant effects on people. That is a narrower category than every automated business task. Personal-data processing can attract other data-protection duties even when it does not meet that definition. An agent’s ability to execute a task does not itself determine the lawful basis for the underlying processing.
The Cyber Security and Resilience Bill must also be distinguished from law already applicable to a particular organisation. Its proposed scope and commencement arrangements cannot be reduced to a claim that all agent platforms acquire new duties immediately on Royal Assent.
A useful evidence pack for a business trial
- Document the intended outcome and the actions the agent may take.
- Use narrowly scoped access and keep a record of meaningful changes.
- Test escalation, revocation of access and recovery from an interrupted run.
- Compare the result with a defined baseline, including human review time and corrections.
- Reassess when the model, connected system or permission set changes.
These checks turn a broad governance discussion into observable questions. They cannot guarantee security, compliance or return on investment, and this article does not rank vendors. For a UK team considering agentic AI, the defensible next step is to verify one bounded workflow before expanding its authority.
