Gartner’s 15% Agentic AI Forecast Is Back in Circulation. The Employment Rules It Runs Into Are New

A forecast that AI agents will make “at least 15% of day-to-day work decisions” by 2028 is now circulating again, this time as the opening statistic of a new employment-law report. Littler, the labor and employment firm, published Agentic AI in the Workplace Report 2026 on November 3, 2026. It argues that agentic systems, which can break a goal into steps, call other software and complete tasks with limited human direction, are moving workplace AI “from recommendation to action,” and that most employment rules were written on the assumption that a human makes the decision.

The headline number deserves a closer look before it ends up in a board deck. Some coverage has described the 15% figure as a finding of Gartner’s 2026 CIO and Technology Executive Survey. That is not quite right. The 2026 survey is the source Littler cites for a different statistic, that AI agent deployment is expected to grow from 17% of organizations in 2026 to more than 60% within two years. The 15% figure is a Gartner prediction first published in a June 25, 2025 press release, which said that at least 15% of day-to-day work decisions would be made autonomously through agentic AI by 2028, up from 0% in 2024. The same release predicted that more than 40% of agentic AI projects would be canceled by the end of 2027 because of cost, unclear value or inadequate risk controls.

That distinction matters. A forecast from an analyst firm is not a survey result, and the two figures describe different things: one counts companies deploying agents, the other estimates a share of decisions. Neither tells you which decisions will be automated, and for privacy and employment counsel that is the only question that matters.

Not every “work decision” is a regulated decision

Most of the decisions an agent will make in a typical week are mundane: which ticket to route where, when to schedule an interview, which policy document answers an employee’s question. Many of the new AI laws deliberately leave those tasks alone. Colorado’s replacement for its AI Act, SB 26-189, signed on May 14, 2026 and effective January 1, 2027, applies only where automated decision-making technology “materially influences” a consequential decision, including one about employment. Its exclusions list scheduling, administrative routing and workflow management, along with tools used only to summarize, organize or present information for human review. The rebooted Colorado law also dropped the earlier version’s impact assessment and risk management policy requirements in favor of notice, post-decision explanations and record keeping.

So a large share of Gartner’s 15% may fall outside AI-specific employment law entirely. The trouble is that agents do not stay neatly in one lane. An agent that schedules interviews may also rank which candidates get the earliest slots. An agent that answers HR questions may decide whose leave request is escalated. The point at which a workflow tool starts shaping who gets hired, paid, disciplined or let go is the point at which the regulated rules switch on, and agentic systems are designed to blur exactly that line.

The rules that apply when the decision matters

For employers with US and European workforces, the main regimes look like this:

• New York City Local Law 144. Automated employment decision tools used to screen candidates or employees for hiring or promotion need an independent bias audit within the past year, a public summary of the results and advance notice to candidates, including how to request an alternative process or accommodation. An audit of one screening model may say little about a multi-step agent that changes its sequence of questions or pulls in new data sources.
• California CCPA regulations on automated decisionmaking technology. Businesses using ADMT to make significant decisions about California consumers, a term that covers employees, applicants and contractors and includes hiring, work allocation, pay, promotion and termination, must comply by January 1, 2027. That means pre-use notices, opt-out and access rights and risk assessments. The California ADMT requirements fall away only where there is genuine human involvement: a reviewer who knows how to interpret the output, actually analyzes it with other relevant information, and has authority to change the result.
• California FEHA regulations. Separate civil rights rules make it unlawful to use an automated decision system that discriminates on a protected basis, treat anti-bias testing as relevant evidence and require retention of automated decision system data.
• Illinois. Amendments to the Illinois Human Rights Act that took effect on January 1, 2026 prohibit AI uses that have the effect of discriminating across the employment lifecycle, bar the use of zip codes as a proxy for protected classes and require notice when AI is used.
• EU AI Act. AI systems used for recruitment, promotion, termination, task allocation based on behavior or personal traits, or monitoring and evaluating workers are high-risk under Annex III. After the Digital Omnibus on AI (Regulation (EU) 2026/1744), the high-risk obligations for Annex III systems apply from December 2, 2027 rather than August 2026. Emotion recognition in the workplace has been prohibited since February 2, 2025, with narrow medical and safety exceptions.
• GDPR Article 22. Decisions based solely on automated processing that produce legal or similarly significant effects are restricted, and an agent that acts without meaningful review can trigger it today.

Littler also describes a 2026 Connecticut law with notice and disclosure duties for employers deploying automated employment decision tools from October 1, 2027. Employers with Connecticut staff should confirm the final text before relying on that date.

The privacy problem is access, not just outcomes

The most practical part of the Littler report is its discussion of data. An agent that can search across systems will find things that human employees technically had access to but never stumbled on. The report’s example is an incorrectly permissioned folder of employee medical information: harmless while nobody knew it existed, exposed once an agent can surface it in seconds. A compromised agent credential, it notes, can open several repositories rather than one application.

Agents also create new employee data. A system that learns a worker’s writing style, voice or routine can generate profiles that did not exist before, and voiceprints or face geometry can fall under Illinois’s Biometric Information Privacy Act. Those profiles are personal information under the CCPA and the GDPR, which means they are reachable by an employee access request. Most HR teams cannot yet search inside an AI tool’s memory, logs or vector store to answer one.

Meetings are another exposure. Agents that join calls to transcribe and act on what was said can implicate wiretap and recording laws, especially where the vendor uses the content for its own purposes. Lawsuits over AI transcription services turn on exactly that question, and the answer often sits in the vendor contract rather than in the product settings.

A five-step review before agents touch HR decisions

Employers piloting agents in recruiting, HR service or workforce management can work through a short sequence:

1. Map each agent’s decision points. For every workflow, list the actions the agent can take on its own and mark any that affect hiring, pay, scheduling that changes hours, discipline, leave or termination. Those are the steps where Colorado, California, NYC and the EU AI Act may apply.
2. Define what human review means. Write down who reviews, what they see, how long they have and whether they can override. A manager clicking “approve” on a ranked list without the underlying data will not meet California’s human involvement test.
3. Constrain data access. Make agents inherit the permissions of the user they act for, not a broad service account. Run an access review before go-live to find sensitive folders an agent could reach.
4. Keep the record. Log inputs, outputs, model versions and configuration changes for each consequential step. Colorado requires deployers to keep compliance records for at least three years, and plaintiffs in AI hiring disputes increasingly seek this material in discovery.
5. Update notices and contracts. Revise employee and applicant privacy notices to describe new processing, set a rule for when agents must identify themselves as AI, and confirm in vendor agreements whether the provider may use workforce data for its own purposes.

None of these steps proves an agent is lawful. A completed risk assessment shows that someone thought about the risks, not that the controls work in production. Testing the agent against real cases, and checking the logs afterward, is what turns paperwork into evidence.

Frequently asked questions

Where does the 15% agentic AI figure come from?

It is a Gartner prediction from a June 25, 2025 press release: at least 15% of day-to-day work decisions will be made autonomously through agentic AI by 2028, up from 0% in 2024. It is a forecast, not a measured survey result.

Does Colorado’s new law cover AI scheduling tools?

Generally not. SB 26-189 excludes low-stakes tasks such as scheduling, administrative routing and workflow management from “consequential decisions.” It applies when automated technology materially influences decisions about access to, selection for or compensation for employment.

When do California’s ADMT rules apply to employers?

Businesses subject to the CCPA that use ADMT to make significant decisions, including employment decisions, must comply by January 1, 2027. Businesses that start using such a tool after that date must comply before first use.

When do EU AI Act high-risk rules apply to HR systems?

For Annex III systems, including employment uses, from December 2, 2027, following the Digital Omnibus on AI. The ban on workplace emotion recognition has applied since February 2, 2025.

Can a human sign-off take an agent outside these laws?

Only if the review is real. California requires a reviewer who understands the output, analyzes it with other relevant information and has authority to change the decision. Under GDPR Article 22, token involvement does not stop a decision from being solely automated.

The decision nobody signed

The forecasts may be wrong, as Gartner’s own cancellation estimate suggests. But employers do not need 15% of decisions to be automated to have a problem. They need one consequential decision, made by an agent that was only supposed to schedule, route or summarize, with no record of who reviewed it. When a rejected applicant or a dismissed employee asks who decided, “the workflow did” will not be an answer any regulator in Denver, Sacramento or Brussels is likely to accept.