The CIO's AI agenda for 2026: an architect's read

Capgemini publishes "when IT meets AI: the CIO perspective" pieces; Bain runs its CIO conversation series; McKinsey publishes its CIO-track work. Each piece is calibrated to the executive audience. The architecture function's read of the same agenda is specific: which workstreams the CIO has to fund, who has to own them, and what the architecture function has to deliver.

This piece is that read, organised around the seven workstreams I think the CIO actually has to land in 2026.

Workstream 1: the agentic AI platform

By far the largest single line in the IT budget for 2026 in firms taking AI seriously. The platform components (registry, tool gateway, observability, policy engine) covered in the platform strategy piece and the reference architecture piece.

Ownership: architecture function, with engineering delivery.

What goes wrong: the platform is under-funded relative to the use cases it has to support. The use case teams build their own and the firm ends up with multiple incompatible stacks.

Workstream 2: the AI governance regime

Model risk management, agent risk management, AI incident response, model and agent registries, audit support, regulatory engagement.

Ownership: shared between the architecture function, the model risk function and the compliance function. The CIO's job is to fund the shared infrastructure.

What goes wrong: each function builds its own AI governance. The firm has three governance regimes that do not reconcile and three teams duplicating effort.

Workstream 3: the legacy modernisation portfolio

The pre-existing modernisation programme, which has not gone away. ERP transformations, core banking modernisations, legacy mainframe migration, end-of-life software replacement.

The agentic shift has changed the integration demands and the data demands of these programmes. The modernisation portfolio has to be re-baselined.

Ownership: each programme's own leadership, with architecture function oversight.

What goes wrong: the modernisation programmes proceed on their original assumptions and have to be re-cut mid-flight. The cost of mid-flight re-cuts is materially higher than the cost of upfront re-baselining.

Workstream 4: the cyber and identity uplift

The agent population is, structurally, a population of non-human identities. The legacy identity treatment does not work for them. The cyber control surface for agent-driven workflows is different from the human- driven equivalent.

Ownership: CISO and architecture function jointly.

What goes wrong: the cyber uplift is treated as incremental to the existing cyber programme. The specific agent-driven threats are not designed for. See Non-human identity in the age of AI agents and Cyber guardrails for AI agents in regulated workflows.

Workstream 5: the data platform consolidation

Integrated reporting, ESG data, operational analytics, the agentic AI workloads all require a coherent data platform. Most firms are running multiple incompatible data platforms accumulated over the last decade.

Ownership: architecture function and the data function, where the data function exists.

What goes wrong: the consolidation is deferred because the immediate cost is visible and the benefit accrues gradually. The firm ends up paying both the legacy cost and the new platform cost concurrently for years. See Integrated reporting and the enterprise architecture function.

Workstream 6: the vendor and outsource discipline

Foundation model vendors, AI tool vendors, SaaS vendors with embedded AI features. Each is, in regulated firms, an outsource arrangement. The vendor selection has to apply the outsource discipline rather than the technology procurement discipline.

Ownership: architecture function, supplier management function, regulatory function.

What goes wrong: the vendor selection happens in procurement on standard procurement terms. The outsource discipline is applied retroactively, often after the contract is signed. The renegotiation is expensive and sometimes infeasible.

Workstream 7: the cost discipline

Agent workloads can become expensive quickly. The foundation model costs, the inference compute costs, the observability storage costs, the audit retention costs all compound. Without cost attribution and cost control, the firm finds out about the cost surprise after the fact.

Ownership: CIO, FinOps function, architecture function.

What goes wrong: cost attribution is built after the cost surprise rather than before it. The use case teams have no incentive to manage their consumption.

The funding shape

A 2026 IT budget that does these seven workstreams well looks materially different from a 2024 budget. Three shifts.

More platform investment, less use-case investment. The platform components above pay back across many use cases. Funding them properly is more efficient than funding each use case to build its own.

More governance investment. The model risk function, the regulatory function and the architecture function all need more capacity than the 2024 baseline.

More observability and cost discipline. The operational characteristics of the agent estate require investment in the run-time discipline, not just the build-time delivery.

Where this leaves the CIO

The CIO that funds these seven workstreams well in 2026 puts the firm in a position to capture the agentic AI value the consultancy commentary points at. The CIO that funds the use cases without funding the underlying workstreams will spend 2027 and 2028 rebuilding.

The architecture function's job is to make the case for the underlying workstreams clearly and defensibly. The CIO's job is to back the case.