AI incidents are reaching senior leaders more often than they are prompting changes to formal governance, according to an IBM-commissioned survey. Eighty per cent of respondents said an incident had reached their board or C-suite in the preceding year. Among those organisations, 40% changed their AI governance policies or frameworks in response.[1]
Censuswide interviewed 3,221 executive-management respondents at organisations with at least 1,000 employees between 14 and 24 September. The sample covered the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE. The findings describe executives’ reports of incidents, including agent failures, decision errors and exposures; they are not an independently audited breach register.[1]
Agent deployment is moving ahead of controls
IBM says 35% of respondents already had agentic AI in production and 75% expected agents to take on some autonomous decision-making by 2027. Only 37% considered their governance systems designed to scale with that deployment. An agent’s permissions matter because it can move beyond producing an answer to changing a record, calling a tool or advancing a workflow.[1]
Governance indicators in the survey
| Indicator | Reported share | Population or scope |
|---|---|---|
| Incident escalated to board or C-suite | 80% | Surveyed organisations |
| Policy/framework changed after escalation | 40% | Organisations reporting escalated incidents |
| Board-level AI risk responsibility assigned | 98% | Surveyed organisations |
| Board-reviewed financial risk quantified | 37% | Formal assessment reported by respondents |
| Governance designed to scale with agents | 37% | Respondents’ assessment of readiness |
| Gaps in third-party AI oversight | 54% | Reported limits covering suppliers and partners |
The third-party figures reveal another gap in the chain. Only 21% reported continuous monitoring of third-party AI risk, and 13% required independent assurance or certification. An organisation can assign responsibility internally while having limited visibility into a supplier’s systems, particularly when those systems can act on shared information.[1]
Turning responsibility into operating decisions
For an agent that can change business records, governance becomes a set of concrete decisions: which systems it can access, which actions require approval, what is logged and how activity can be stopped. These controls connect a board’s risk appetite to the behaviour of the deployed system. The survey’s accountability and monitoring figures measure different parts of that connection.
When pressure to deploy outpaced governance, 56% of respondents said they proceeded within agreed risk limits while adapting controls; 33% delayed deployment. IBM’s UK release also reports a lower post-incident governance-change figure of 35%. Those differences show that organisations are making different trade-offs rather than following a single regional pattern.[1][2]
The practical issue raised by the survey is the distance between receiving an incident report and changing how the next deployment operates. A policy owner can identify responsibility; permissions, monitoring and an effective interruption mechanism make that responsibility actionable.
Sources & further reading
- IBM Study: Eight in Ten EMEA Enterprises Escalate AI Incidents to Board or C-Suite as AI Agents Test Governance IBM Newsroom · 14 Oct 2026 · Accessed 25 Oct 2026
- Eight in Ten UK Businesses Struggle to Keep Pace with AI Governance, IBM Study Finds IBM UK Newsroom · 14 Oct 2026 · Accessed 25 Oct 2026