AI agents can decide what should happen. In banking and healthcare, scaling AI depends on controlling whether, when, and how that decision becomes an action in the system of record.
Most regulated contact centers no longer need convincing about AI. They have run the pilots. Virtual agents answer routine questions, copilots summarize calls, and intent models route interactions with real accuracy. What most have not done is let AI finish the work.
The gap isn’t AI capability. It’s enterprise execution.
An AI agent can determine that a credit union member needs a replacement card, or that a patient needs to move a follow-up visit. That is a decision. Execution is what happens next: the action completing in the core banking system or the EHR, in the right sequence, under the controls the institution is accountable for, with a record of what was done.
In banking and healthcare, that second step is where many AI programs stall. It is also the step that decides whether AI scales.
What McKinsey’s 2026 Data Shows
McKinsey’s latest State of AI survey shows the same pattern at a broader level. The survey, fielded in May and June 2026, drew 1,719 respondents across 97 countries.
Adoption is close to universal. Nearly nine in ten respondents report regular AI use in at least one business function, and 44% say AI is scaling across their enterprise, up from 38% a year earlier. Agents are moving too.
Among organizations with more than $1 billion in annual revenue, the share scaling AI agents in one or more functions rose from 27% to 40%.
Financial impact has not kept pace. Only 37% of respondents report that AI has contributed to EBIT, essentially unchanged from 2025, despite growth in the share of organizations scaling AI.
The organizations that are seeing value deploy AI differently. McKinsey defines AI high performers as respondents who attribute 5% or more of EBIT to AI and describe its impact as significant, and they make up about 6% of respondents.
Nearly three-quarters of these high performers report fundamentally redesigning workflows because of AI, compared with about one-quarter of other respondents. They are also much more likely to report working to mitigate unauthorized or unintended actions.
McKinsey doesn’t draw these conclusions about contact centers specifically. Our interpretation for regulated contact centers is this: more AI deployment does not produce more value on its own.
Value appears when AI is built into how work actually completes, and when the organization controls what AI is allowed to do. Both are questions of execution.
Deciding Is Not Executing
Most AI investment in the contact center has gone into the decision side of the interaction. That means understanding intent, pulling context, and choosing the next step. That work matters, and it has improved quickly.
| Download Whitepaper | Deciding Isn’t Executing. Healthcare’s Deadline Is 2027. |
A decision changes nothing, though, until it becomes an action in a business system. For a bank or credit union, that system is the core. For a health system, it is the EHR. Execution means the action actually completes there, in the right order, within the required controls, and leaves a record the organization can stand behind.
The AI agent determines what should happen. The execution layer determines whether, when, and how it happens.
Why Execution Is Different in Regulated Contact Centers
In most industries, an AI agent that takes the wrong action creates a poor customer experience. In banking and healthcare, an out-of-scope or improperly executed action can lead to fraud losses, privacy incidents, patient safety issues, and questions from auditors and examiners.
Two examples show the difference.
Banking: An Address Change Followed by a Replacement Card
A credit union member calls and tells the AI agent they have moved and need a new debit card sent to their new address.
The decision.
The AI agent correctly identifies two requests: update the mailing address, then issue a replacement card to it.
-
The controls.
An address change followed immediately by a card reissue can warrant additional verification, because the combination can increase account takeover risk. The credit union’s own policies determine which checks are required before either action executes.
In this case, the member passes step-up authentication, and the account is also checked for conditions that call for review, such as fraud flags or recent changes to contact details.
-
The action.
Only then does the address update in the core banking system. The card order runs only after that update is confirmed. If the address change fails, the card order does not run at all.
-
The record.
The interaction leaves a record of how the member was verified, which actions ran, in what order, and with what outcome. It is captured to the credit union’s own audit requirements.
Executed without those controls, the same two actions could send a live card to a fraudster. The interaction would look flawless right up to the loss.
Healthcare: A Family Member Rescheduling a Visit
A caller contacts a health system to move her father’s cardiology follow-up to next week.
-
The decision.
The AI agent identifies the request: reschedule an existing appointment for a patient other than the caller.
-
The controls.
The caller is not the patient. The question is not only who she is but whether she is authorized to act on his behalf, so the health system’s authorization or proxy-access rules are checked.
The system also checks whether this visit type is one the AI is permitted to reschedule, or whether the health system requires clinical staff to review timing for a post-procedure follow-up.
-
The action.
If both checks pass, the appointment moves in the EHR with the right provider, location, and visit type, and the original slot is released. If they don’t, the interaction routes to a staff member with the context already assembled.
-
The record.
The patient’s record and the interaction log reflect who requested the change, what authorization was confirmed, and what changed. The record is built to the health system’s requirements.
Executed without those controls, the AI agent might confirm appointment details to someone with no right to them, or push a follow-up past a clinically important window. That is a privacy incident or a patient safety issue, not a satisfaction score.
Connectivity Moves Data. CCIP Controls Execution.
NovelVox CCIP is built for this layer. It isn’t another way to connect a contact center to a system of record. CCIP controls whether, when, and how an action executes once the AI agent has made its decision.
The AI agent stays on the contact center platform the organization has already chosen. The systems of record stay authoritative for the underlying records: Epic, Jack Henry, and other core platforms continue to hold the data, while CCIP governs how AI-initiated actions reach and operate across those systems.
CCIP exposes the same governed actions to AI agents through MCP and to IVRs and applications through REST, so every channel executes under the same controls.
This is what turns a successful AI pilot into a production deployment that a bank, credit union, or health system can approve. And it already runs at scale: 1.2B+ Governed Enterprise Executions Annually.
For SI and CCaaS Partners
- Your banking, credit union, and healthcare customers are ready to move AI agents from pilot to production. What their risk, compliance, and IT teams need to see is how every AI-initiated action will be authorized, sequenced, and recorded in the core or the EHR.
- CCIP adds that execution layer alongside the CCaaS platform and AI agent you already deliver. It extends your delivery scope in regulated accounts rather than competing with it.
The Question Is No Longer Which AI to Deploy
Regulated contact centers will keep getting better AI agents. They will understand more, reason better, and handle more of each conversation. None of that closes the gap on its own. Deciding what should happen and making it happen correctly in a core banking system or an EHR are separate jobs.
In regulated industries, the second job is where the organization must be able to show what happened, under what controls, and with what result.
That is why AI in regulated contact centers scales only when an execution layer controls whether, when, and how each decision becomes an action.
Your AI Agent Decides. CCIP Executes.
