I went to Gartner IT Symposium expecting to spend my week in sessions and manning our booth. Asmo, our CTO, was speaking, and the agenda was full of talks I wanted to listen to. I ended up spending most of my time somewhere else: at CIO roundtables, in hallway conversations and in the small meetings that happen between everything else.
CIOs’ focus has shifted completely from whether to use AI. They’re asking: can I trust what AI touches? They are also trying to figure out whether their organizations are ready for the moment AI starts acting on their behalf.
Here’s what I heard, what Gartner told the room and why I think 2027 is the year CIOs need to act on their AI strategy.
The worries came up in different words at every table, but usually followed the same pattern.
An AI assistant that drafts an email is easy to govern but one that updates a customer record, pays an invoice or reroutes a shipment is a lot more challenging. Gartner made the point that agent autonomy has to be earned, through reliability, accountability and security: the agent does the right thing repeatedly, every action traces back to an owner and access stays at the minimum the job needs. Every CIO I spoke with agreed. Very few could say where in their architecture those three things would be enforced.
Gartner put it simply: policy is becoming code. A governance document won’t stop an agent from calling the wrong system. Rules have to run where the agent acts, every time it acts. Gartner was clear that doing the work upfront isn’t enough. Value at scale needs management at runtime, all the time.
The topic had also been central at our Talkflows Copenhagen the week before the Symposium, when we asked a philosopher to push the boundaries of AI and how we think about control.
Gartner described the current moment as a trust recession, and said enterprises are more exposed than they think they are. This matched the conversations I had throughout the week. Several CIOs told me they had done the data residency work years ago and assumed this was it, the job was finished. Then they started mapping where their automated decisions run, and the picture changed all of a sudden.
One message from the conference I’ve heard and even talked about deserves more attention than it got.
Most organizations probably should not try to be AI-first. The point I’ve been getting across to CIOs is that it might be simply better to choose your ambition, invest narrowly and reuse relentlessly while refusing one-off projects.
There was one number I saw in one presentation that was surprising. It was one of those things that kept me thinking: organizations getting high returns from AI spend twice as much on foundations as their peers.
The risk for most CIOs is building AI on top of foundations that can’t carry it. And the foundation that matters most for agents is the one they act through: integration.
A few presentations also argued that the death of enterprise applications is exaggerated, at least through 2032. Applications won’t vanish.
They’ll become headless, with more of the work flowing through APIs and MCP tools and less through screens. If that’s right, the integration layer becomes the place where agents meet your systems of record, and the place where you can see, control and prove what they did.
This is where being a European company shapes how we think.
An AI agent doesn’t hold data. It calls a tool, and the tool moves money, changes a record or files a return. Each of those actions happens on some infrastructure, under some jurisdiction. Europe spent years debating where data is stored. Now the question evolved to where decisions are executed, and who holds the evidence after the fact.
Our own research shows how wide the gap is. 61% of European decision-makers call digital sovereignty critical. 12% have built for it, and you can read more in our State of Integration & AI report.
We built Frends so customers can choose where their integrations run, and change that choice later. The standard cloud service runs on Microsoft Azure. Frends Sovereign Cloud runs from a StackIT data center in Frankfurt, with no US entity anywhere in the operating or ownership chain.
And the full platform, control plane included, can be deployed on customer infrastructure, including air-gapped. Many of our customers mix these. Sensitive workloads stay in their own network, everything else runs in the cloud.
The same flexibility applies to AI, and our recently launched capabilities.
You can expose a Frends Process as an MCP tool, so an AI agent calls an integration you already govern instead of reaching into a system directly. Access is denied until a policy allows it. Every call lands in the same audit trail as the rest of your integrations. That’s what policy as code looks like in practice: the rule sits where the agent acts.
The largest US cloud and software providers have taken European sovereignty seriously. They’ve built sovereign regions, separate legal entities and EU-only operations. Just the fact they’ve invested so much is the clearest sign the problem is real.
But there’s one thing they can’t change by contract. In June 2025, Microsoft’s French subsidiary confirmed under oath before a French Senate hearing that it could not guarantee protection of data from US authorities, even for data held in France under a French-marketed sovereign offering. When a vendor’s parent company sits under US jurisdiction, a European data center doesn’t remove that reach.
For a bank, a utility, a hospital or a public body working under NIS2 and the AI Act, this has become a board question. It gets sharper once agents start taking actions, because every action inherits the jurisdiction of the infrastructure running it.
I’ll be fair about the limits. Choosing a European integration vendor doesn’t make an organization’s setup sovereign. Your ERP and CRM may still run on American software, and the model your agent calls may sit in another jurisdiction entirely.
But a European, deployment-flexible integration layer gives you something narrower and still valuable: control over where your automated decisions run with a complete record and the freedom to move when circumstances change.
Simply put: optionality has to be paid for in advance to be real. You can’t buy it in the middle of a crisis.
BizTalk Server 2016 reaches end of life on January 11, 2027. BizTalk Server 2020 is the final release, and Microsoft expects sales to end March 31, 2027.
Mainstream support continues through April 12, 2028. Integration migrations take quarters, not just a few weeks. A CIO who starts planning in 2028 will be migrating under pressure, with less choice about where to go.
Custom-built integration has its own clock. It usually works, until the person who wrote it leaves or an AI use case needs it to do something it was never designed for. Most custom code can’t be exposed to an agent safely without being rebuilt.
Gartner’s timeline for enterprise applications points the same way: Agents start absorbing simple point solutions now.
Over the next few years, application interfaces lose their importance and the value moves into data, APIs and the connections between systems. The organizations that sort out their integration layer in 2027 will be ready for that shift. The rest will be rebuilding while their competitors take the lead.
The CIOs who stay on BizTalk or custom tooling with no way to bring AI into their integrations probably won’t be fired for it. Legacy systems rarely cost anyone their job. They’ll just watch their peers deliver agent use cases they can’t support, and the gap will grow every quarter.
If I were a CIO walking out of Symposium, I’d make 2027 the year of migration and AI readiness for every integration and automation.
In practice, that means five things.
None of this requires an AI-first strategy, but it requires solid foundations. As Gartner has shown, this will separate the organizations that are getting returns from AI from the ones still waiting for them.
If you want to go deeper on where your automated decisions run and how to test any vendor on it, including us, do read our paper on runtime sovereignty.
Jukka Rautio is CEO at Frends. You can read this and other articles in his monthly LinkedIn newsletter "Between the Lines of Code".