Gartner: Fortune 500 Firms Will Average 150,000 AI Agents by 2028

By 2028, Gartner expects Fortune 500 companies to run more than 150,000 AI agents on average — and Microsoft has already deployed over 500,000 internally, while HR platform UKG now has more agents than employees, according to its chief transformation officer, Prakash Kota.

The numbers explain why the CIO conversation has flipped. "The conversation among CIOs has shifted from how do we build agents to how do we make sure they continue delivering value," says Madhu Narasimhan, CIO of healthcare organization DaVita. "Getting an agent into production is no longer the hard part."

The hard part is the lifecycle: advancing agents from development to production, measuring them against KPIs continuously, and sunsetting them when they stop earning their keep.

At Fujifilm Biotechnologies, an agent built to help the legal department read contracts is set to move from sandbox to full production in early December. The CDMO — which partners with pharmaceutical and biotech companies on vaccines and therapies — has legal staff using the agent to review contracts, check standards around terms and conditions, and propose edits for human review.

"That's a perfect use for a set of agents," says the company's CDIO, Mike Tomasco.

How do you govern agents before they exist?

Lifecycle management starts before the build. Kevin McDonald, principal consultant at tech consulting firm Hylaine, tells leaders to define the agent's job narrowly: "Treat an agent like a product with an owner, not a project with an end date."

Kota recommends balancing IT visibility with employee autonomy through a designated playground for experimentation, and assigning each agent its own identity — separate from user credentials, with a narrower scope of access.

Tomasco took the deliberate route. Working in a highly regulated industry, he refused unfettered access to Claude Code like some companies allow, and instead built an isolated sandbox called Genki Studio. It's a bring-your-own-data environment with enterprise security controls, restricted network access, role-based permissions, and auditing.

All 5,000 Fujifilm Biotechnologies employees can apply, though only a small portion have the interest and skills for AI development. The company prioritizes applicants with a relevant use case, strong AI interest, and data or analytics experience. About 50 employees currently work in the studio, prototyping agents with leading AI models and the same tools developers use.

The pipeline after that is disciplined: coworkers test the agent, then a domain-based review checks that it follows regulations and doesn't duplicate something that already exists or is on the roadmap. If everything lines up, the agent ships. Idea to release typically takes six to eight weeks.

How do you measure whether an agent earns its keep?

Once an agent is live, Fujifilm Biotechnologies assesses its utility over the following weeks, using adoption metrics plus KPIs tied to manufacturing — such as faster time to market for a pharmaceutical treatment. It also checks agents throughout their lifecycle. "Agents can drift from the guardrails that you set up for them," Tomasco says.

DaVita spent over a year building a security and governance foundation before launching a company-wide AI platform this spring. Employees have since created more than 10,000 agents, including ones that field questions on benefits or regulations. "We assess compliance, cybersecurity, governance and business value before broader adoption," Narasimhan says. A review team spans clinical, legal, cybersecurity and more.

DaVita's success KPIs: accuracy, reliability, adoption, and business impact. Redundant or low-engagement agents get decommissioned. "I don't believe in technology for technology's sake," Narasimhan says.

McDonald adds practical kill criteria: time savings, cost per task, and how often humans override the agent's output. When override rates climb, or the agent costs more than the work it replaces, sunset it. He also urges a registry of every agent with its permissions, versioned prompts, and tools, so CIOs can fully revoke access and prior context at retirement. "Forgotten agents with live credentials are a real risk," he says.

Tomasco is blunt about the endpoint: "There's no sense in having something run that's not creating value."

Does any of this move the business?

Kota frames the stakes: employees experimenting in sandboxes doesn't automatically produce productivity. "If we don't impact the top line or reduce the bottom line impacts, what's the purpose?" he asks.

For Tomasco, the payoff is concrete: efficiencies that help bring medicine to market faster for patients. "It can be life-changing," he says. As agent counts climb toward the hundreds of thousands per company, the product managers and CIOs who thrive will be the ones who can retire an agent as confidently as they launch one.