AI Everywhere, Governance Nowhere: My Takeaways from CIO Summit 2026
By Roy Robinson, Activate Senior Automation Architect and Head of Customer Success.
Everyone at the 2026 CIO Summit in Auckland last week was talking about AI solutions - but almost nobody is governing it.
That was the main impression I had amidst the vendor stands, customer conversations, presentations and on the Executive Roundtable I attended. Almost every exhibitor had some form of AI capability bolted on — though plenty of it still felt like early-stage prototype rather than mature enterprise product..
Everyone's Building AI. Almost No One's Governing It.
From cyber security vendors pitching AI-driven threat detection, to Oracle's session on scaling AI, to Halo ITSM's genuinely impressive service portal, the pattern was the same: rapid AI feature development, heavy marketing, light discussion of what happens after go-live.
A few standouts:
Halo ITSM was the most interesting product I saw — a UK-based platform combining a modern service portal, ticketing, API integrations, AI search and automation connectors. It's comparable to parts of the Activate portal combined with an ITSM layer, though it's still missing dynamic form generation — something customers like 2degrees have been asking us for.
Flowingly sits between workflow automation and RPA, with AI as the headline but orchestration, not identity, as the real focus.
One managed services provider demoed an "AI discovery platform" that's really just consulting dressed up with AI recommendations — not far from the automation discovery workshops we already run.
The Executive Roundtable was where the real conversation happened
The executive roundtable at 1:30pm — around twelve CIOs, architects and MSPs — was the most valuable session of the day. The discussion centred on AI adoption, automation and governance, and one thing became clear fast: most organisations are restricting enterprise AI rollout to Microsoft Copilot purely because of licensing and governance concerns — while staff are already experimenting with multiple AI agents and tools on their own desktops. Shadow AI, or "DarkOps," is already here.
I raised the topic of AI Agent Identity Management, and it landed. Most attendees currently see this as a minor operational issue because only a handful of technical staff are using AI agents today.
My point was - that changes fast once organisations move from managing 10 AI agents to hundreds or thousands. At that scale, you need identity lifecycle management, automated provisioning, credential management, policy enforcement, compliance reporting, audit trails and offboarding — exactly the space Activate operates in once customers move beyond proof-of-concept into production.
Auckland Transport and Mitre 10 added a sharper edge to this: their websites already use AI for customer enquiries and bookings, and the next step is letting AI agents transact directly on customers' behalf — making bookings, placing orders, negotiating purchases. That raises a genuinely new question: who is the identity — the human, the agent, or both? And what happens operationally if thousands of agents hit the same service at once?
The Gap and the Opportunity
Almost every conversation today was about building, integrating or securing AI. Almost none were about provisioning AI identities, managing their lifecycle, rotating credentials, or deprovisioning them properly. We've seen this movie before with human identities — dormant accounts, missed offboarding, orphaned access — because lifecycle automation was never designed in from the start. AI agents are on track to repeat the same mistake, just faster and at greater scale.
That's the opportunity for Activate: not as another AI platform, but as the operational automation layer that governs AI identities throughout their lifecycle — provisioning, privileged access integration, credential and token management, compliance workflows, audit reporting and offboarding.
My recommendation coming out of today: we should run our own executive roundtable on Automation vs AI — making the case that automation delivers repeatable, governed process while AI adds reasoning and decision-making, and that combining the two safely requires identity governance from day one. The technology is moving fast. Governance isn't keeping pace. That gap is where Activate can lead.
One Unexpected Bonus
I also won a spot in the rally car driving experience at Whitford Park. Small group, informal setting — the kind of environment where conversations tend to go a lot deeper than they do on an exhibition floor. Suffice to say, it definitely blew the cobwebs away!
Want to talk to Roy about enterprise identity operations or non-human identity governance in your own environment? Book a demo or explore Activate Identity Operations.