McKinsey outlines four steps to scale agentic AI on quality data

McKinsey has issued recommendations for companies that are trying to scale agentic AI and are hitting a wall that is not the models but the data. The core thesis is simple: without a shared data foundation, clear workflows and strict governance, agents do not make it out of pilots and into real business processes.

Why pilots stall

According to McKinsey, almost two-thirds of companies have already experimented with AI agents, but fewer than 10% have managed to take them to a scale that delivers noticeable business value. In eight cases out of ten, the barrier is data: it sits in fragmented systems, carries different context, does not pass uniform quality checks and is poorly suited to autonomous decisions. As long as a person manually stitches sources together and double-checks the output, a pilot can still work. When the same actions have to be performed constantly and in real time, the whole construction starts to fall apart.

The problem sharpens as autonomy grows. A single agent can walk through several systems in sequence and make decisions based on fragmented information, while a group of specialized agents can also pass errors on to one another. That is why McKinsey puts the focus not on the model itself but on a company's ability to give agents stable access to data, clear definitions, traceability and access rules. Otherwise the automation looks impressive in a demo but breaks at the first serious volume of operations.

Four first steps

McKinsey suggests not rebuilding the entire company at once but starting with four linked steps that connect strategy, architecture and the operating model. The logic: first choose the processes where autonomy genuinely pays off, then prepare the infrastructure, and only after that increase scale. This approach is meant to avoid spending months on expensive pilots with no repeatable effect, and to avoid dragging old data problems into the new agent layer.

• Choose 1-2 high-impact workflows and assess them on value, feasibility and strategic effect
• Update the layers of the data architecture so agents can safely exchange context
• Move from one-off cleanups to continuous quality control of structured and unstructured data
• Introduce an operating model and governance: roles, access rights, logs, policies and human approval points

McKinsey places particular emphasis on carrying out all four steps in a coordinated way. If a company picked the right use case but kept the old architecture, the agent will run into incompatible systems. If the architecture is already modern but there are no access rules or action logging, scaling quickly turns into a risk to security, compliance and the quality of business decisions. McKinsey also advises testing the approach on targeted pilots with clear metrics and immediately looking for data that can later be reused in neighboring workflows.

What foundation is needed

By an agent-ready architecture, McKinsey means not a new monolith but a set of modular layers. Data should enter the company once and then be used for analytics, machine learning and generative AI alike, without separate parallel pipelines for each task. The semantic layer plays an important role: it describes what each entity means, how objects relate to one another and which business rules apply. In practice this leads to ontologies, knowledge graphs and data products with a clear owner, quality level and access interfaces.

McKinsey separately stresses work with unstructured data: documents, images, correspondence, support history. For agents to use such content reliably, it must be tagged, classified, indexed via embeddings and linked to the rest of the corporate data model. For structured data the priority is different: not periodic manual cleanup but constant quality monitoring, automatic validation, anomaly detection and lineage storage. The same standards should apply to the data that agents themselves create.

The last layer is governance around the agent lifecycle. A company should define in advance what an agent is allowed to do, which data it can access, where human confirmation is required and who is responsible for the result. This includes issuing credentials, telemetry, action logs, performance monitoring and automatic policy-compliance checks. Under this scheme, business teams own their workflows and domain model, while central data and AI teams own the shared platforms, guardrails and oversight.

What this means

The market is gradually shifting from the question "which model to choose" to "which data and processes will it act on." That is bad news for quick demos, but good news for companies prepared to build agentic AI as part of the business's operating system rather than as an isolated experiment.