Deloitte: 38% of Australian firms let AI act without sign-off

What Deloitte found in Australia

On 9 November 2026, Deloitte Australia published the Australian findings from its State of AI in the Enterprise survey. The global survey covered 3,500 leaders, from director to C-suite level, across 25 countries and six industries. Fieldwork ran in May and June 2026, according to Deloitte's US release. Deloitte hasn't published the size of the Australian sample, so the Australian percentages are best read as a directional signal.

The headline figure is that 27% of Australian organisations now report revenue gains from AI, up from 20% in Deloitte's January report. Productivity benefits are more common, with 75% reporting efficiency gains, up from 66% (Deloitte Australia). The equivalent global revenue figure is 28%, which puts Australia roughly level with its peers on that measure.

The weaker results sit further down the release. 35% of Australian respondents said their AI investments had delivered less measurable return than expected, against 19% globally. Australian firms also trail on running AI at scale in strategy and operations (23% against 38% globally) and in product development and research (20% against 33%). IT and cybersecurity is the exception: 62% of Australian organisations run AI at scale there, against 54% worldwide (Australian Cyber Security Magazine).

Agents are acting before anyone owns the outcome

For operations leaders, the most useful part of the survey covers AI systems that carry out actions on their own. 38% of Australian organisations let AI execute decisions or actions without human approval to a moderate degree, although none said they do so to a significant degree. 18% said accountability is unclear when an AI system produces a bad outcome (Deloitte Australia). Deloitte's global figures are 40% and 23% (Deloitte US).

Together, those numbers match a pattern we see often. A team switches on an agent that can update customer records or close service tickets, and nobody decides who answers for a wrong action until the first incident forces the question. Around half of Australian respondents reported only a minor change in who holds decision-making authority, even though 39% are redesigning several key processes around AI (Australian Cyber Security Magazine). When a process is rebuilt around an agent and the delegations of authority stay the same, the agent ends up doing work that no manager has formally approved.

David Alonso, Deloitte's National AI Market Lead, said that "being clear about who can intervene and who ultimately owns the outcome will be critical" as AI takes on more responsibility (Deloitte Australia). We agree, and we'd add that the owner needs the authority and the technical means to pause the agent, or the ownership exists only on paper.

Cost tracking stops at the invoice

Most Australian respondents watch the total bill. Far fewer can see what a single AI task costs. 75% track total AI inference and API spend, while only 38% track token volumes and 25% track cost per token or API call (Deloitte Australia). The global figures are 71%, 51% and 44% (Deloitte US), so Australia is ahead on the monthly total and behind on every finer measure.

An organisation that knows only its monthly AI invoice can't tell whether a given workflow pays for itself. Deloitte doesn't link the weak cost tracking to the 35% of Australian firms reporting disappointing returns. We think the link is plausible, because you can't calculate the return on a workflow without a cost per use to set against the benefit per use.

What it means for NZ businesses

Deloitte New Zealand's page on the report doesn't say whether New Zealand was one of the 25 countries surveyed, and no NZ-specific results have been published. For now, the Australian results are the closest available benchmark for NZ organisations, especially those that compete with Australian firms or report to an Australian parent.

The data sovereignty finding is relevant on this side of the Tasman. 64% of Australian respondents rated sovereign AI and in-region compute as moderately or very important to their AI strategy (Deloitte Australia). For a New Zealand business, "in-region" usually means an Australian data centre. Any NZ organisation with residency clauses in customer contracts or public sector agreements should confirm where each AI service processes its data, because an Australian region won't satisfy a clause that requires processing inside New Zealand.

Workforce expectations in the survey are steep. 73% of Australian respondents expect AI to handle most routine knowledge work tasks within three years, and 62% expect the same for customer-facing service, support and sales roles (Australian Cyber Security Magazine). Australian boards holding those expectations will put pressure on their NZ subsidiaries and suppliers to show similar progress, whether or not the technology arrives on that schedule. NZ leaders who can show measured returns per workflow will be in a stronger position in those conversations than leaders who can only point to licence counts.

On training, 75% of Australian organisations give employees AI training and guidelines (Deloitte Australia). Training and guidelines are now standard practice in Australia. The gaps the survey exposes are in who owns AI actions and how AI costs are measured, and those are the areas NZ firms can fix while their deployments are still small. Our AI consultancy page sets out how we approach AI governance and adoption planning.

Practical next steps

• List every AI tool or agent that can take an action without a person approving it, including features switched on inside existing SaaS products, and name one accountable owner for each.
• Give each owner a documented way to pause or roll back the agent, and test the pause before the agent goes into wider use.
• For your highest-volume AI workflow, set a cost-per-transaction measure using the token or API call counts in the vendor console, and compare the cost with the staff time or revenue the workflow produces.
• Report efficiency gains and revenue gains to the board as separate lines, since Deloitte's data shows they arrive on different timelines.
• Record whether each AI service processes data in New Zealand, Australia or elsewhere, and check that record against your contract obligations before your next renewal.
• Where a process has been rebuilt around AI, update the delegations of authority to match. Our process and automation work starts by mapping who approves each step.