McKinsey Found the Problem. Then It Applied for the Job.

McKinsey just told CEOs to stop handing AI governance to vendors. McKinsey is a vendor.

Sit with that for a minute, because it is the most honest sentence you can write about "Is that AI agent worth it?

Agentic economics and the modern operating model," the July 2026 McKinsey Quarterly piece from 5 QuantumBlack partners. The report is smart and parts of it are genuinely useful. And the whole thing is built on a conflict of interest so large the authors had to walk around it in every paragraph.

I read all 9 pages, so you don’t have to. Here’s what holds up, what falls apart, and what the report refuses to say out loud.

What the report gets right

I will always give credit where credit is due. There are 3 findings in this report deserve a permanent spot in your board deck.

Tokens are the bill, not the value. The report quotes David Tepper, CEO of Pay-i: "Tokens are not value; tokens are the bill." That line is so spot on, and most enterprises have it backwards. Token cost for GPT-3.5-level capability fell from $20/million tokens to $0.07 through 2024, per the Stanford HAI 2025 AI Index. A 285x price collapse. And enterprise LLM spending still tripled in 12 months, per Menlo Ventures' December 2025 enterprise survey. Economists have a name for this - Jevons paradox: when a resource gets cheaper, total consumption of it goes up, not down. McKinsey describes the pattern accurately without naming it.

However, one cautionary note before you put that contradiction on a slide. Prices down, spend up proves nothing by itself. A CFO can answer it in one sentence: usage grew faster than prices fell, and the usage is working. Spend growth can be rational value capture but pathology isn’t the size of the bill. It’s that most organizations can’t state value per dollar, error rate per outcome, or drift from validated behavior. And do not take McKinsey's word for that; take the practitioners'. In the FinOps Foundation's 2026 survey, respondents ranked determining AI value and ROI among their top challenges, and one practitioner summed up the field: "Is your AI providing value? PSSST…no one can answer that question yet." If you cannot answer it, the tripled bill is a symptom. If you can, it might be your best investment. The commentators waving this statistic around as self-evident dysfunction have no response to the skeptical CFO.

You should.

Refinement is the sink. The report cites research finding that roughly 60% of an agentic task's spend sits in checking, repairing, and reverifying the answer, not generating it. Hold that number and hold it loosely. Because when I pulled the primary paper, it says something narrower than what McKinsey claims, and we come back to both facts below.

Cost behaves as a distribution. Runs of the same programming task can differ by up to a factor of 30 in total tokens, per the arXiv research McKinsey cites. Agents take different paths, call different tools, retry in different ways. Average-cost budgeting fails against that variance. And that same paper carries a finding McKinsey skipped entirely: higher token usage does not buy higher accuracy. Accuracy often peaks at intermediate cost. Spending more does not mean getting more right. Sit with what that does to a cost-only dashboard.

And now, the not so good part.

Read the footnotes before you quote the headline

The report's most quotable leading statistic is that 93% of surveyed enterprises exceeded their AI budgets. And as a result of this report, I can promise you that number will show up in a hundred conference keynotes by September. Here’s footnote 3: the Enterprise AI FinOps Survey, May 2026, had 120 participants, of whom 75 qualified.

75 respondents. The 93% headline rests on maybe/approximately/roughly 70 companies. Meanwhile the claim that AI will consume roughly 25% of enterprise IT budgets within several years carries no footnote at all. None. But it sits in the text as revealed truth.

Let me be crystal clear about what the 93% is and isn’t because the critique only lands if it’s fair. Directional executive surveys are standard research practice. McKinsey disclosed its sample in the footnote, and a 75-respondent benchmark is a legitimate way to spot a trend early. The number is not invalid. It’s a different class of evidence and the class matters. "93 percent of respondents to our survey reported exceeding their AI budgets" is an observation. Stating "93 percent of enterprises blow their AI budgets" is a verified market-wide fact. The report says the first. The keynotes will say the second. Watch the caveats fall off in transit, because that transit, from directional observation to quoted market fact, is where the damage happens, and no one along the chain thinks they did it.

The FinOps Foundation's State of FinOps 2026 shows what the other evidence class looks like: 1,192 respondents, more than $83 billion in annual cloud spend, published methodology, public data. The 2 surveys are not substitutes and it would be unfair of me to pretend that they are. The Foundation never asked the budget-overrun question. McKinsey's smaller instrument did. Quote either one but carry the label with the number: public dataset or private benchmark, verified fact or directional observation. The label is the discipline. Strip it, and a snapshot of 70 companies becomes the state of the market by the third retelling.

The rest of the evidence base is a closed loop. McKinsey cites a McKinsey survey, a forthcoming McKinsey survey nobody can check yet, and McKinsey's own internal token consumption. 5 trillion tokens a month, 10% of users driving 65% of consumption, "caveman language" prompts cutting token use 30 to 40%. Those are some interesting numbers, plausibly true, and worth digging into. Also, self-reported and independently uncheckable, which by no means make them wrong. It does however make them a lower evidence tier, and the report never says so. The text carries the confidence of audited data on the sourcing of a field notebook.

Checkbox theater is not running a small survey. Small surveys are honest tools. Checkbox theater is letting a directional benchmark wear the costume of verified market data and never correcting the record as the number spreads. I invite you to hold that standard against the report, against this article, and against every keynote that quotes either one.

Governance got defined down while you were reading

The report's 3rd competitive implication is the one I’ve been arguing for the last several years: AI governance becomes a new basis of competition. The organizations that learn to govern machine work, measuring it, allocating it, improving it, will create more value than competitors spending the same money. McKinsey Quarterly just validated the founding thesis of my firm.

Except read what McKinsey means by governance.

• Cost per outcome.
• Vendor performance.
• Model routing.
• Learning cadence.

Every single governance mechanism in this report is a spend-management mechanism. And guess what doesn’t appear anywhere in those 9 pages?

The word audit.

The word assurance.

The word liability.

The EU AI Act, which imposes binding obligations on deployers of exactly the high-risk systems in McKinsey's own workload table, go unmentioned.

ISO 42001, the international standard for AI management systems, the thing you can actually be certified against, goes unmentioned.

However, regulation does appear twice. Both times as a routing variable, a reason to pick a private cloud region. Never as a set of obligations with penalties attached.

That’s not governance. That’s FinOps wearing governance's jacket and the conflation runs wider than McKinsey. The FinOps Foundation's own 2026 survey reports that 98% of practitioners now manage AI spend and describes the trend as AI spend governance going mainstream. The discipline's flagship survey uses governance to mean cost, and its top requested tool capability is granular monitoring of tokens, requests, and GPU utilization. Better bill visibility. And nothing in that wishlist verifies a single output. Governance answers a different question: who is accountable when the machine is wrong, who verified the controls, and who checks the checker. A cost dashboard? A cost dashboard answers none of those.

The incoming commentary wave and LinkedIn posts will make this considerably worse

Watch what happens over the next few weeks. This report will spawn hundreds of LinkedIn posts and conference keynotes, and most of them will adopt governance vocabulary while keeping finance content to support FinOps offerings and Office of CFO services.

They will say accountability and mean spend ownership.

They will say stopping rules and mean budget caps.

They will compress McKinsey's six cost drivers into one tidy mechanism that leads back to their offering and quote the 93 % without reading footnote 3.

Here’s a three-question test that separates governance from renamed cost management. Run it on every post, pitch, and deck that quotes this report.

• One: does it name a standard you can be certified against?
• Two: does it name an error metric, anything measuring whether the machine was right, alongside the cost metric?
• Three: does it name who verifies the controls, and whether that party has revenue riding on the answer?

Zero for three is FinOps in a tuxedo jacket. Three for three is governance. I haven’t yet seen a repost of this report score above zero.

The 60% confession

Now, let’s go back to the buried statistic, and to what I found when I pulled McKinsey's source. The primary paper is Salim and colleagues at Concordia University, accepted at the MSR 2026 mining software repositories conference. Here’s its actual scope: 30 software development tasks, one agent framework (ChatDev), one model (a GPT-5 reasoning model). The finding: the iterative code review stage consumed an average of 59.4% of tokens. The authors label their own results preliminary.

McKinsey turned that into "about 60% of an agentic task's costs are tied to refining answers."

Watch what happened in that sentence. Tokens became costs. One framework on one model became every agentic task. A 30-task coding study became the enterprise. While the direction of the finding is real, the generality is not. McKinsey did to its source exactly what the LinkedIn reposts are now doing to McKinsey, and THAT’S the whole case for reading footnotes in one nested example.

Scoped honestly? That finding still matters and here’s the honest translation.

Refinement covers checking, repairing, and reverifying.

Some of that spend is fixing wrong answers.

Some of it is paying to confirm right ones.

You can’t tell either of the two apart from the bill and THAT’S exactly the point. Either the machine errs often or you can’t know when it errs without paying to find out. And both are governance findings. McKinsey frames the statistic as a budgeting insight: leaders should factor rework into process costs. Ok, fine, but if the majority of your agentic spend is spent establishing trust in the output, trust is your scarcest input, and not a single line item on the FinOps dashboard measures it.

Now put that next to McKinsey's own workload placement table. One of the five scenarios is regulated workloads: banking transactions, healthcare claims. Medium-high sensitivity, medium-high quality threshold. The recommended fix is private cloud for data residency.

Residency addresses where the data sits and does nothing about whether the claim decision was correct, whether the denial pattern discriminates, or whether anyone can reconstruct why the agent did what it did when a regulator asks. A wrong answer in a healthcare claims workflow is not a cost overrun; it’s a person who did not get care, and a liability event with a docket number attached. I’ve written to the FTC about exactly this category of harm. The report prices the error. It never weighs it.

Variance is Tokyo drift wearing a cost costume

The factor-of-30 finding deserves more respect than McKinsey gives it. The primary paper, from a Stanford Digital Economy Lab and University of Michigan team including Erik Brynjolfsson, ran 8 frontier models on SWE-bench Verified coding tasks. Runs of the same task differed by up to 30x in total tokens, and the 1,000x agentic multiplier holds up in the paper too, so again, I’m giving credit where credit is due. The report treats that variance as a budgeting nuisance: same task, wildly different bills, so build tail-cost visibility. Correct as far as it goes.

But the better ask is to ask why the costs vary. Because the behavior varies. The agent took a different path, called different tools, retried differently, reasoned longer or shorter. Cost variance is the financial shadow of behavioral variance. And behavioral variance in production systems has a name: drift. The agent that behaves differently on Tuesday than it did in your April evaluation is not a line-item problem but a control failure. Your validation testing described a system that no longer exists.

This is the exact failure mode continuous behavioral monitoring exists to catch, and almost nobody instruments for it. McKinsey's own data proves the phenomenon is real and large.

Factor of 30.

Then the report routes the entire finding to the CFO's spreadsheet. Watching the money move is not the same as watching the machine change.

The report does get one sentence spot on: no autonomous system should operate without a defined mandate, budget, and stopping rule. Print that sentence into a wall poster. Then ask the question the report will not: verified by whom?

A mandate the operator writes, monitors, and grades for itself is a diary entry, not a control.

The vendor wrote the exam

Which brings us back to where we started. The report's fifth imperative says the agentic operations capability should not be outsourced to vendors by default.

Solid advice.

But QuantumBlack, the McKinsey unit whose partners wrote this article, sells AI implementation, AI operating model design, and AI transformation services. The document is a 9-page argument that you need a new management discipline, published by the firm that bills by the hour to install said management disciplines.

Let me be crystal clear. I’m not saying the analysis is wrong because of who wrote it. Most of the analysis is right. But what I am saying is the incentive shapes what got left out. A firm that implements your agents cannot be trusted to grade your agents, and it will reliably define governance in ways that generate implementation work (routing layers, gateways, operating committees) rather than verification work (independent audit, external validation, certification against a published standard). Every omission in this report points the same direction. And that is NOT a coincidence. That’s a business model.

And the fix? It fits in one sentence: the auditor cannot be the vendor.

Whoever verifies your agentic controls should hold no revenue stake in the answer, and certification against a published standard such as ISO 42001 exists for exactly this reason.

What to actually demand before your agents scale

McKinsey's CEO list is a decent start. Here’s what it leaves out and what I would put in front of any board this quarter.

• Demand a common unit of risk alongside the common unit of cost. McKinsey wants cost per outcome so you can compare human, machine, and hybrid work. OK. Now add error rate per outcome, harm severity per error, and reconstructability per decision. If your agentic dashboard prices the work but can’t explain the work, you have productivity accounting, not accountability.
• Treat behavioral variance as a control signal. The factor-of-30 cost spread is telling you the system's behavior is unstable. Instrument the behavior itself, then the bill. Continuous drift monitoring against a validated baseline, with alert thresholds and a human owner (not committee) who answers for exceptions.
• Map your workload table to your regulatory exposure. Take McKinsey's five scenarios then and add a sixth column: which laws apply. Healthcare claims workloads carry HIPAA and, in Europe, EU AI Act high-risk obligations with conformity assessments and post-market monitoring. Banking workloads carry SR 11-7, the Federal Reserve and OCC model risk management guidance that has required independent model validation since 2011. Supervisors did not wait for agents to demand this. If your placement decision considered residency but not these obligations, you placed the data and misplaced the liability. Most organizations discover this after deployment instead of before, when the discovery costs the most.
• Verify the stopping rules independently. Mandate, budget, stopping rule: yes. Then have someone with no revenue stake test whether the stopping rule actually stops anything. Self-attestation is how every governance failure in history got its head start.
• Keep humans as a design requirement, not a repair cost. The report's only sustained mention of people is as supervision expense, the humans who check and fix machine output. That framing quietly treats human judgment as overhead that needs to be engineered away. Measure whether your operating model preserves human agency and capacity to question, override, and understand the systems making decisions, and measure it before the readiness gap becomes an incident report.

The bill is not the risk

McKinsey ends by warning that companies which fail to govern machine work may scale a new cost pool faster than they learn to manage it. Ok, that’s true. But here’s the straight no chaser version: they will scale a new liability pool faster than they learn to see it, and the cost dashboard will look fine the entire time.

So, go ahead and read the report. Steal, I mean leverage, the good parts. Then ask the question it spent 9 pages avoiding: when your agent is wrong, in the 60%, in the factor of 30, who is accountable, and who checked?

The auditor cannot be the vendor, and McKinsey just spent 9 pages proving why.