Gartner says CIOs must apply the brakes on AI to balance value and risk

CIOs are getting more value from AI but many are struggling to replicate and scale that value across the enterprise, according to Gartner.

During the opening keynote of the Gartner IT Symposium/Xpo 2026, analysts told IT leaders that they must balance AI value and risk to safely drive results. Daryl Plummer, distinguished VP analyst at Gartner, opened the keynote by likening enterprise IT and AI strategy to car racing.

“Value and risk are all about building the right kind of momentum and avoiding the wrong kind of drag,” he told the audience. “We don't put brakes on cars so they can go slow. We put brakes on cars so they can go fast safely.”

For CIOs, he said these brakes could include “more strict AI data usage policies, or limiting model access”.

Current Gartner data shows that only one-in-five AI projects succeed. While that figure remains unchanged from last year, 58% of executives say they’ve had positive ROI from AI. However, Plummer said that rising prices have meant success has come at a cost.

“That means that the one project that succeeds drives the bulk of ROI value gain, but you're spending 18 times more to get it than just two years ago,” he told the audience.

“We are in a period of AI inflation during a trust recession. That's bad economics. We don't trust AI, and while token costs are falling rapidly, AI is inflating the cost of everything else.”

While demand for AI is “skyrocketing”, it’s also boosting company spending. As such, Plummer argued that lower unit costs of tokens may not drive the cost savings leaders or board members are expecting.

“It matters now more than ever that you pick the right AI projects, because the one thing that you'll never hear a stakeholder say about value is ‘we have enough’.”

The value-risk flywheel

While the need to build AI is strong, Plummer said the ability to govern it is weak – and this is where alignment becomes key.

“As a CIO, the best thing you can do is to align value with risk and to align safety with governance.”

However, while a majority of CIOs said they will deploy agentic AI within 12 months (71%), only 21% have AI governance in place today, according to Gartner data.

“That is out of alignment,” said Kristin Moyer, distinguished VP analyst at Gartner. “In that situation, it's not possible to create value faster than AI can create risk.”

Moyer introduced the Gartner value-risk flywheel, visualizing two interconnected wheels: compound value and compound risk, which are shaped by two forces, momentum and drag.

Moyer said it's a tool designed for leaders to assess their value risk situation, communicate it to others, and take action.

Notably, Moyer recommended the flywheel be managed by “a centralized decision authority with a dotted line structure that borrows from your entire organization,” or ‘flywheel governor’ to keep it in alignment.

“The flywheel governor is essentially that place where joint decision making, not only about spend, but about risk, about technology, about security and safety is going to be made,” Plummer added.

“Aligning safety and governance lets you drift around the turns instead of slowing down.”

Good momentum vs bad momentum

By 2030, Gartner expects AI providers will spend almost $7 trillion on AI infrastructure, but less than half of revenue will be earned from AI data centers.

This exposes vendors to a “massive asset write-down”, Plummer warned, creating an aggressive push to monetize enterprise usage.

“It's no wonder they want you to use agents everywhere,” he told the audience. “They want you to build momentum for their products, or just to buy more tokens. For you, that's bad momentum.”

He added that while technology vendors are reporting productivity surges of 50% or more, Gartner data shows just 16% in actual productivity gains.

“The biggest drag on AI momentum is using AI when you don't need to,” said Plummer. “When vendors encourage you to max out tokens, that creates more waste than value.”

Gartner found that 40% of workers received AI-generated work slop in one month, with each occurrence taking two hours to clean. For the average S&P 500 company, that equates to $52 million dollars lost every year.

“That is careless consumption,” Plummer told the audience, urging IT leaders to move away from volume-driven metrics. “It’s time to shift from tokenmaxxing to valuemaxxing.”

To build solid momentum, organizations need to start looking at applying the brakes on AI, according to Plummer.

“Start by limiting careless consumption before it limits your critical use cases,” he told attendees. “Institute a schedule of use cases for AI, maybe even like they do for controlled substances. You should need a prescription to use AI for things that eat tokens for lunch.”

Aligning safety and governance

While managing costs and momentum is important, CIOs need to be attentive to bigger threats, especially as the threat landscape becomes more unpredictable.

“Before AI, your security risk was like having dogs,” Moyer said. “You just had to leash them, fence them in, and watch them.” But Plummer argues shadow AI has turned security risk into cats.

“You wake up one morning, they're into everything: in the laundry basket, shredding the furniture, and breaking into the snack cabinet.”

Much like their real counterparts, Moyer said these agentic cats can be hard to track, and that this is creating further risk from shadow AI, which she said “is invading your enterprise inside an upgraded product you already own”.

“Security has to be paired with governance,” said Plummer, as where security looks at stopping threats coming in, problems are actually coming from people who are using AI and “don't know any better”.

Moyer described these people as “hero innovators”. She said that while bad actors use AI to intentionally cause harm, “hero innovators inside your organization do cool stuff with AI and unintentionally cause harm”, which can lead to huge problems for companies if exploited.

Plummer urged leaders to start treating dark AI as crime prevention over incidence response.

“Stop seeing sovereignty as only a control issue,” he told the audience. “Start seeing it as an issue of continuous operation and optionality.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.