Presented by Box
Content access, governance, and platform flexibility are emerging as the dividing lines between AI leaders and laggards, according to the new State of AI business report from Box, which surveyed 1,640 IT decision makers across the US, UK, France, and Japan. Another finding of the report is the pace of change: the combined share of organizations that describe themselves as advanced or advanced rose from 8% to 64% over the past year, while the share that described themselves as early adopters or early adopters fell from 53% to 9%. 80 percent of organizations reported a significant return on their AI investment, defined in the survey as an improvement of at least 10%, and more than half saw a measurable business impact within six months of project approval.
The swing is largely due to the way businesses are now planning their use of AI rather than any single technological breakthrough, says Olivia Nottebohm, Box’s COO.
"We have moved from independent testing at the individual level to planned, integrated agent activities, agents that are generated and can be used in a repeatable way," Nottebohm says. "This is where the impact comes from."
Why AI leaders are getting higher ROI than early stage companies
The division between classes is a matter of execution. Notably, half of the leading companies reported that AI-driven ROI is greater than 25%, compared to only 11% of emerging companies, with the advanced (33%) and developing (16%) categories falling slightly in between. But Nottebohm says the real difference was not whether companies embraced AI, but how well they integrated and managed it.
"What sets the leading edge apart is the operational muscle they have built: the right teams to deploy agents, the legal governance to manage them, and consistency in the content layer those agents work on," he explains. "Early stage companies approach it in an ad hoc, experimental way, letting people play with it without a common goal or formal design."
Content access is the biggest obstacle to business AI ROI
Content, rather than model quality, is the 2026’s defining feature. Ninety-six percent of organizations say agents need access to company-specific content, but only 36% have agents connected to trusted content across most use cases. It’s a matter of trust rather than raw power.
"We started this journey thinking that business AI is about getting to the latest model," Nottebohm says. "But the question now is whether the agents are able to access the right content, and whether that content is protected, because those agents are only as good as the content they can refer to, and only as safe as the surrounding security."
Getting that content layer right has a secondary benefit beyond security, as it’s also what ultimately allows agents to work across departments that used to work separately from each other. And while nearly a quarter of organizations point to data being segregated across systems, 24% cite the difficulty of integrating AI into existing systems, 21% say they don’t have enough permissions and access controls, and 18% describe their content as too disorganized to be accessible at all. Among mature organizations, 63% now treat unstructured documents, contracts, and reports as a competitive advantage rather than dead weight sitting in a digital filing cabinet.
To reduce the general incidence of exposure to AI data
Almost half of all organizations say they have already experienced an AI-related data exposure incident. That figure rises to 60% among leading companies, which may face greater exposure from multiple agents and connected systems – but may also be better equipped to detect it.
The share of organizations reporting established or improved governance structures has increased from 24% in 2025 to 73% this year, but real gaps remain: only 39% have full visibility of all authorized and unauthorized AI uses, 34% have legal standards for how agents access company data, and 27% are still defining their governance. But those incidents serve as a deterrent rather than a deterrent, Nottebohm said.
"Governance used to be seen as something that slows people down, but 93% of respondents told us that better governance is what allows them to move faster," he explains. "It makes scaling AI survivable. Once the content is secured and widely allowed, you can use multiple agents across multiple processes and get the result of real replication."
One practical effect of that change is that the consent frameworks created for human workers are now being re-evaluated with agents in mind, a process that many businesses are only part of.
"Permit businesses established in the past two years need to be reviewed," he explains. "Until recently, people didn’t put permissions in a document about how an agent might use it in mind, but now they’re being more deliberate about it. It leaves them with a lot of unstructured data that has to go back and be cleaned or allowed."
That’s part of a broader shift away from governance designed for people and toward governance designed for agents from the start.
"Businesses need to make the transition from governance derived from human workflows to governance built directly for agents," Nottebohm says. "That means tracking what an agent has touched, what permissions they’ve used, and what resources they’ve used, and all of that is now shaping how governance is used."
Businesses need to avoid being locked into a single AI vendor
"Gone are the days of token promotions," Nottebohm says. "Now it’s about responsibility to deliver effective AI. Organizations want to use the cheapest model that meets the quality bar they need, not necessarily the most expensive, because different model families keep jumping around and companies want to maintain that choice."
That means businesses are avoiding lock-ins more than ever. Sixty-eight percent say they are worried about going to a single AI provider, the average number of officially adopted AI tools has risen to 3.3, and 79% now consider it essential or important that agents work without a head, connecting directly to systems and APIs without human interaction in between.
It’s a trend similar to the shift to multi-cloud infrastructure, and driven by a similar reluctance to give any single vendor more bargaining power.
"A flexible architecture designed for cross-platform," Nottebohm says. "It works on multiple models, works out of the box, and keeps every part of the AI stack flexible, so organizations don’t have to bet on which tool wins, and that’s part of a broader shift from automation to the biggest, most expensive model available."
Next steps for AI success
Over the next three years, businesses should prioritize organizing, segmenting, and cleaning up unstructured content, proactively recruiting and building teams for emerging roles, and adopting a unified token budget model, where IT owns the core infrastructure and token budgets while business units manage spending. And right now, it’s easy to get up early.
"You don’t have to start at early maturity and gradually move up," Nottebohm says. "If you build in a management, content layer, and multi-model system from scratch, you can go in as a leading company and capture that much bigger impact."
Sponsored articles are content produced by a company that pays to post or has a business relationship with VentureBeat, and is always clearly marked. For more information, get in touch sales@venturebeat.com.
