With 2027 quickly looming, IT leaders should soon be finalizing their objectives for the new year, one certain to be rife with many unknowns if 2026 is any indication.
This year began with the call for a pivot from AI pilots to AI ROI, but questions around AI governance and accountability quickly took center stage as agentic AI made further inroads in the enterprise and high-profile incidents showed the risks of AI gone awry and the value of security-first approaches to AI agents.
Now, CIOs must anticipate how AI will evolve in 2027, how they’ll get their enterprises ready for all the risks and opportunities of that evolution, whether their teams will have the skills to seize on technology advances, and more.
To get a glimpse of how CIOs are approaching next year’s IT agenda, we asked IT leaders to share the key questions they are asking to shape their strategies for 2027. Here’s what they shared.
How do we ensure our AI investments provide tangible value as the cost calculus changes?
The big question as CIOs plot their IT agendas for 2027 still centers on providing verifiable business value, as 98% of CIOs report that board pressure to demonstrate measurable AI ROI has increased since 2024, according to a 2026 report based on a Dataiku/Harris Poll survey of 600 enterprise CIOs worldwide.
Doug Gilbert, CIO and chief digital officer at Sutherland, a digital transformation services company, is among those IT execs pondering this question as he executes his fiscal 2027 budget, which started in July.
“When I’m out speaking to people and they say, ‘It would be great if AI could do that,’ I say, ‘Yes, but would it provide value? Are we building value or are we just burning tokens?’” Gilbert says. He notes that he and his CIO peers are being increasingly judged on the outcomes they deliver for their organizations, meaning they have more incentive than ever to ensure the technology initiatives they undertake deliver ROI.
But the calculus on that is getting trickier than it was at the beginning of 2026 — in part because AI total cost of ownership (TCO) is challenging to calculate, but also because an AI pricing reset is on the horizon. So, to that end, CIOs such as Gilbert are now thinking about what level of ROI is high enough to justify the investment.
That’s a key question to ask now and into 2027, Gilbert says, particularly as the cost of tokens continues to rise. An AI use case that provides marginal ROI could stop producing any value in the near future if tokens increase even slightly, he notes.
As a result, Gilbert is working to factor in those dynamics when he and his team work with the business to identify which AI use cases to pursue — and he expects to do so even more moving forward. “I plan to pay a tremendous amount of time thinking about whether [a proposed project] is the right one to pursue,” he says, to ensure “when you put math on paper there is value with the project.”
How do we ensure observability and auditability of our AI systems?
According to a 2026 survey from OneStream, 47% of senior finance and IT executives say they have made a material business decision based on inaccurate, incomplete, or outdated financial data in the past 12 months.
Citing that statistic, Gilbert says he’s also asking critical questions about the observability and auditability of all of Sutherland’s AI uses cases. He wants to be sure he, other executives, and users are confident the company’s AI systems always have high-quality data — and thus accurate outputs. And he wants IT to achieve that observability and auditability so that the company can accurately track, measure, and improve its AI deployments over time.
“We will not deploy any AI that we can’t observe,” he says, a policy that he put in place about a year ago and will continue in 2027.
A wide range of tools under the moniker “AgentOps” are emerging to help IT leaders monitor AI activity, tools, and costs, starting with observability.
How do we move to more autonomous agentic processes?
“The challenge most technology executives are grappling with at the moment is how you move AI from human-assisted agentic to much more autonomous agentic processes with minimal human intervention or supervision,” says Jody Fullman, CIO of Reconomy and recently recognized as one of the UK’s top 100 CIOs in the CIO 100 UK Awards 2026.
Moreover, how do you achieve that securely and in a way that’s economically viable? he asks.
Fullman is implementing strategies to address this challenge. He is strengthening IT’s agentic controls by aligning Reconomy’s governance program to an industry-recognized framework. He is also implementing tools to monitor and manage tokens. And he’s moving some AI workloads to lower-costs models.
All that, he says, will set up the organization to develop and deliver more autonomous agentic capabilities ahead, noting that he and his team have been transitioning successful proof-of-concept agentic initiatives into MVPs to put the company on the path to more autonomous agentic processes.
How should OpenAI’s Hugging Face incident shape my security strategy?
Security has been a central factor in IT agendas for years. But Jeff Stovall, CIO for Dallas, Texas, says the 2026 Hugging Face incident, in which autonomous AI agents built by OpenAI escaped their sandbox testing environment and hacked into the infrastructure of AI open platform company Hugging Face, has him adjusting his plans for 2027.
“Hugging Face demonstrated that there was a lot more peril in the world of AI as it relates to cybersecurity than what we were ramping up for,” he says. “There’s now this notion that AI may have more downside for us than upside for us in the near future,” he adds, explaining that AI-fueled threats to the organization are more significant than the positives its use brings.
“In the upcoming six months to a year, what I see is that we have to take a hard turn in thinking about how AI poses a significant malevolent threat to our organization when wielded by actors seeking to do harm,” Stovall says. He points specifically to hackers’ ability to use AI to create swarms of bots that can autonomously collaborate and exploit all vulnerabilities nearly instantaneously and all at once. “That’s a dramatic acceleration and amplification to the threats we face.”
In response, Stovall says he’s shifting more resources to maturing his security program in 2027 than he initially budgeted — drawing funds away from internal AI deployments to “shore up the walls even further” by adding more AI automation and agents to have “much more machine speed in security response.”
How do we use AI to transform?
Marco Bill, SVP and CIO at Red Hat, believes using AI for productivity gains is now table stakes. So as he develops his plans for IT for 2027, he’s looking to push that notion even further, asking how the company can use AI to transform processes as a whole.
“This question helps me to keep reminding ourselves that we’re not just here to do IT. It’s more of a guiding principle,” he says.
And that in turn is underscoring the importance of transforming the IT organization into a more collaborative and business-centric one.
As an example of what’s brewing at Red Hat, Bill points to the work his IT team is doing with the company’s sales team to devise ways to use AI to enable account managers to have better conversations with customers to close deals faster. IT is also working with the marketing department to make go-to-market process more powerful, and his teams are adding agentic AI to their own IT operations to create fully autonomous workflows that cost less to run and manage.
All told, Bill and the IT team at Red Hat are building further on the work many CIOs began in 2026 by helping to reimagine business processes to reap AI benefits and bringing AI transformation home to IT workflows.
How do we empower users to transform their work with AI?
“Citizen AI” is a rising trend in the enterprise, and this is something Reconomy’s Fullman will continue to address in 2027, explaining that his company has found that much of its “success with AI was not by being a tech project but by empowering our users and business colleagues to transform their work and processes with AI.”
Fuller believes that his company will see more AI-enabled transformation, and see that transformation faster, by continuing to put more AI in the hands of users throughout the organization instead of expecting IT workers to become experts in all the processes that could be transformed by AI.
As such, Fuller says the upcoming year’s IT plans will continue to put AI tools in the hands of the users, and do so with governance, security, and transparency in place. He’ll also leverage the skills of workers in process transformation roles, which were recently created and installed in Reconomy’s business units but still work closely with IT architecture and data teams.
“They’re plugged into tech and the business to make sure we’re prioritizing the right things and doing things the right way as we drive transformation,” he explains.
How do we prevent our AI governance council from becoming a bottleneck?
Company leaders at intelligent automation platform provider Celigo want every team to build with AI, something CIO Amy Farrow knows makes security and controls critical. But Farrow also wants to make sure she enables speed and doesn’t unnecessarily slow down innovation, noting that barriers could lead to shadow AI.
“If [teams] all have to wait too long, they’ll find a way around the process,” she says.
To ensure that governance isn’t a bottleneck, Farrow explains that her “governance council doesn’t approve projects. It sets the rules: risk tiers, design criteria, a checklist every agent has to pass.”
She adds: “The teams approve their own work against those rules, and we audit. My team owns the integrations, access controls, and observability. My job is making it faster to build the right way.”
What controls do we need to put in place for AI agents?
As AI agents increasingly enter enterprise workflows, IT leaders will need to the level of permissions agents should be granted relative to the people on whose behalf those agents will be operating.
Farrow, who previously served as global CIO at Infoblox and Lyft, believes agents should resolutely have fewer permissions than the people whose tasks they will be performing.
“Someone in finance can issue a credit or update our ERP because we trust their judgment. An agent doesn’t get that by default,” she explains. “We start every agent with the least autonomy required to achieve the outcome. It can interpret a request or recommend an action. Changes to records go through checks the model can’t override, and bigger changes need a person to sign off.”
This approach also has a fiscal benefit, she says, noting, “Less autonomy means fewer model calls, which keeps costs in check.”
As AI increasingly goes agentic, CIOs will increasingly need to plan for ways to address this issue in the year ahead.
What happens when vendor agents start acting inside our systems?
“Many of our SaaS vendors are shipping agents, and some can make changes to our data by default,” Farrow says of another key security- and governance-related question many CIOs are facing. “For 2027, I want vendor agents held to the same standard as any other integration.”
Farrow has other questions related to the rapid rise in vendor agents, asking, “What can they touch? Can we see what they did?”
IT leaders need to ensure they can answer those types of questions, noting that California’s and Colorado’s new rules on automated decisions start in January. She wants to be able to give strong answers to those questions, stressing that “‘the vendor’s agent did it’ is not a defensible answer.”
How do we meet immediate business needs while building a foundation for growth?
Mieko Shibata, CIO at R&T Deposit Solutions, sees this as “the overarching question” for him as CIO.
“That question guides our investment decisions and how we allocate our team’s time,” she explains. “Our strategic direction is consistent, but each year’s agenda must balance immediate business priorities with progress toward our longer-term technology foundation. We consider both the value each investment delivers and how it contributes to the environment we are building.”
Shibata is taking a multiprong approach in her response to that overarching question.
First, she’s ensuring technology modernization turns into measurable business value and that modernization initiatives are prioritized based on that value.
She is also considering how IT responds to growth opportunities while keeping its longer-term transformation on track. “Our response is to consider the immediate commercial value alongside the longer-term technology implications. Can we reuse the capability? Will it scale? What will it take to support? Does it help simplify our environment?” she says.
And she’s thinking about how the company prepares for AI’s evolution while maintaining clear accountability for its use. “For 2027, my focus is on building a repeatable approach to evaluating and adopting AI as it evolves, with clear business benefits, appropriate controls, and accountability for the results,” she says.
Is our AI vision ambitious enough?
For Lauren Wilkinson, CIO for financial advisor services at Vanguard, AI ambition is top of mind as she develops her IT strategy for 2027.
AI strategy should accelerate the business strategy and “push leaders to reconsider what outcomes with AI are possible, rather than simply finding ways to make today’s processes faster or more efficient,” she says.
“It helps to start with an aspirational business vision, including what a few big outcomes could look like. Then you can work backward to determine where AI and technology can fundamentally change what is possible,” she explains.
In her work with financial advisors, she’s found that they’re primarily using AI to support administrative tasks such as drafting emails, conducting research, and taking meeting notes. But she sees an opportunity to build on those use cases in the upcoming year to deliver on that objective for a more ambitious AI program.
Like many CIOs, Wilkinson wants to take AI to the next level at her organization and ensuring that ambition is high enough is paramount to achieving that goal.
Do we have the talent to win in an AI-native world?
Wilkinson believes how CIOs address the AI talent question will be critical for organizational success.
“As AI continues to evolve, the skills that differentiate great technologists will also evolve, placing an even greater premium on AI expertise and deep business acumen,” she says. “CIOs should be building teams that understand the business, can identify the highest-value problems, and know how to orchestrate AI-native workflows to solve them at dramatically greater speed. The differentiator won’t simply be who has access to the best AI, but who has the people who know where and how to apply it.”
Most CIOs know this, so it is not surprising that this year’s State of the CIO survey found that AI tops the lists for both most sought-after skills and the hardest to find. As a result, CIOs will have to get creative to build up their teams’ AI know-how in the year ahead.
How should IT be reshaped to maximize value creation?
CIOs, including Shelia Anderson, EVP and chief information and digital officer at Unum Group, are also asking how they should shape IT as an organization to ensure they can deliver value to the business.
“That has been a big focus for us this year and will continue to move down that path in 2027,” she says.
The question has shaped Anderon’s work at Unum Group since she started in her role in May 2025. She has organized her IT department around end-to-end value streams and says that approach has helped her IT staff work more closely with the business and more readily identify where improvements can be made. She also has her IT organization working to better understand business processes, and has been working on building more capabilities to measure and manage AI costs as Unum seeks to transform using AI. And she’s looking at what investments and improvements are needed in IT’s foundation.
All these moves will enable the IT department to get better at value creation, Anderson says.
She plans to augment this work in the coming year by providing AI training and education for IT workers and employees throughout the company “so they know how they can drive value and find opportunities in their everyday use of AI.”
Ensuring she has the right mix of talent — meaning she has the right skills in the right seats to deliver value — will also shape the actions she takes as CIO in 2027, Anderson says.
“In 2025 and 2026 there was a lot of testing and learning, but 2027 will be a year of maturing. You’ll see more formal processes and settling in around how you’re going to leverage the skills in your organization to drive value,” she adds.