Agents by the Hundred Thousand: CIOs Learn to Retire What They Deploy

Gartner predicts Fortune 500 companies will run an average of more than 150,000 AI agents by 2028. Microsoft already deploys more than 500,000 internally, and UKG's chief transformation officer Prakash Kota says his company now has more agents than employees. The build was never the hard part, it turns out. The hard part is what comes after.

At Fujifilm Biotechnologies, an agent that helps the legal department read contracts moves from sandbox to full production in early December. The CDMO, which partners with pharma and biotech firms on vaccines and therapies, built the agent to review contracts, check standards around terms and conditions, and propose edits for lawyer review.

"That's a perfect use for a set of agents," says Fujifilm Biotechnologies CDIO Mike Tomasco.

What does the agent sprawl change for CIOs?

The conversation among IT leaders has moved on, according to DaVita CIO Madhu Narasimhan.

"The conversation among CIOs has shifted from how do we build agents to how do we make sure they continue delivering value," she says. "Getting an agent into production is no longer the hard part."

Kevin McDonald, principal consultant at Hylaine, advises treating agents as products rather than projects. "Treat an agent like a product with an owner, not a project with an end date," he says. He tells leaders to define the agent's job narrowly and build it with narrow permissions.

Kota recommends balancing IT visibility with employee autonomy through a playground for experimentation. He also wants dedicated identities for agents, separate from user credentials, with a narrower scope of access.

How do you govern the build phase?

Tomasco, working in a highly regulated industry, declined to give staff unfettered access to Claude Code. Instead his team built Genki Studio, an isolated sandbox with enterprise security controls, restricted network access, role-based permissions and auditing.

All 5,000 Fujifilm Biotechnologies employees can apply to join. The company prioritizes applicants with a relevant use case, strong AI interest, and data or analytics experience. About 50 employees currently work in the studio, prototyping agents with leading AI models and the same tools developers use.

The path to production runs through several gates:

• A build in the sandbox using approved models.
• An invitation for coworkers to test the agent.
• A domain-based review covering regulatory compliance and duplication checks against the existing roadmap.
• Release into production, typically six to eight weeks after the original idea.

How do you measure an agent that already runs?

Fujifilm Biotechnologies assesses utility over the weeks after launch, using adoption metrics and KPIs tied to manufacturing, such as faster time to market for a pharmaceutical treatment. The company also checks agents throughout their lifecycle. "Agents can drift from the guardrails that you set up for them," Tomasco says.

DaVita spent over a year building a security and governance foundation before launching a company-wide AI platform this spring. Employees have since created more than 10,000 agents, including ones that field questions on benefits and regulations. "We assess compliance, cybersecurity, governance and business value before broader adoption," Narasimhan says. Reviewers come from clinical, legal and cybersecurity teams, among others.

DaVita's KPIs cover accuracy, reliability, adoption and business impact. Redundant or unloved agents face decommissioning. "I don't believe in technology for technology's sake," Narasimhan says.

McDonald suggests measuring time savings, cost per task, and how often humans override an agent's output. Climbing override rates, or an agent that costs more than the work it replaces, signal time to sunset it. He also wants a registry of every agent with its permissions, versioned prompts and tools, so retirement can fully revoke access and prior context.

"Forgotten agents with live credentials are a real risk," McDonald says.

Tomasco agrees an agent that misses its metrics should simply be shut down. "There's no sense in having something run that's not creating value," he says.

What counts as business value?

Kota argues the focus has shifted from adoption counts to outcomes. Employees experimenting in sandboxes do not automatically produce productivity. "If we don't impact the top line or reduce the bottom line impacts, what's the purpose?" he says.

For DaVita and Fujifilm Biotechnologies, efficiency gains can save time for biopharma customers and patients. "It's exciting to be a part of it when you can help bring medicine to market faster for people," Tomasco says. "It can be life-changing."