AI-related incidents are increasingly reaching corporate boardrooms across Europe and the Middle East, but many organizations have yet to translate those events into stronger governance policies, according to new research commissioned by IBM. The survey of 3,221 senior executives found that 80% reported an AI-related incident reaching their board or C-suite in the previous year, while only 40% said their organization changed its AI governance policy or framework in response. The findings highlight a growing challenge for enterprises moving from AI assistants to more autonomous systems: establishing clear accountability, monitoring and risk controls as deployment accelerates.
AI incidents are reaching executives, but governance changes lag
The findings point to a widening gap between enterprise AI adoption and the processes designed to manage its risks. In the survey, 56% of executives said their organizations continue deploying AI within agreed risk limits when governance frameworks are not yet ready. Only about one-third said they delay deployment entirely until governance catches up.
That approach allows companies to continue experimenting and implementing AI, but it also places greater pressure on risk controls to keep pace with rapidly changing systems. The reported incidents include failures by AI agents, data exposure, AI-driven decision errors and security breaches. IBM’s research does not establish that every incident resulted in material harm, but the frequency with which incidents reached senior leadership suggests AI risk is becoming a board-level operational concern.
The survey was conducted by Censuswide on behalf of IBM between September 14 and 24, 2026. It covered 3,221 senior executives, including C-level leaders, at organizations with at least 1,000 employees across the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the United Arab Emirates. Its results reflect the views of those surveyed rather than all organizations across the regions.
Agentic AI adds a new layer of operational risk
The governance challenge could become more complex as enterprises move from AI tools that generate recommendations to agents that can carry out tasks and make decisions with less direct human involvement.
Thirty-five percent of respondents said their organizations already run agentic AI in production. Three-quarters expect AI agents to have some degree of autonomy over decisions by 2027. Yet only 37% believe their current governance systems are designed to scale with agentic AI deployment.
An agent may interact with enterprise data, software and workflows across multiple steps. That creates a different oversight challenge from reviewing a single AI-generated response: organizations need to understand what an agent is permitted to do, when it should seek human approval and how its actions can be reconstructed after a failure.
Executives identified several controls they expect to need as agent autonomy increases. Thirty-three percent cited formal legal or contractual frameworks defining vendor liability for agent failures. Another 32% pointed to clear human escalation thresholds, while 30% identified real-time monitoring and audit trails. Twenty-nine percent said they would need the ability to halt agent activity immediately across the enterprise.
These priorities suggest that governance requirements are extending beyond model selection and policy documents into operational controls. Enterprises will need to connect permissions, monitoring, escalation procedures and incident response to the systems that agents actually use.
Board-level ownership does not resolve accountability
IBM’s research found that 98% of surveyed executives said responsibility for AI risk had been formally assigned at board level. Twenty-six percent reported having a dedicated board-level AI committee.
However, formal ownership of AI risk does not necessarily settle who is responsible when an autonomous system causes harm. The chief information officer or chief technology officer was the most frequently cited role assigned responsibility for adverse outcomes from AI agents, but that response represented only 17% of all respondents.
Views on legal liability were similarly divided. Twenty percent supported sharing liability proportionally between the organization deploying AI and its vendor. Nineteen percent said an adequate regulatory framework was still lacking, while 14% believed responsibility should sit with the AI vendor or technology provider.
For enterprises buying AI services, this uncertainty can affect procurement, contracts and operational accountability. Vendors may control models or infrastructure, while deploying organizations determine how systems are configured, what data they can access and which decisions they can make. Responsibility may therefore depend on the specific system, contractual terms and applicable law rather than a single universal allocation.
Third-party AI and financial exposure remain weak spots
Governance gaps also extend beyond systems developed or operated internally. Fifty-four percent of respondents acknowledged limitations in their frameworks for covering AI systems and models used by vendors, technology partners and other supply-chain participants. Only 21% said they continuously monitor third-party AI risk, and 13% require independent assurance or certification.
This matters because enterprise AI deployments can depend on external models, cloud services, data providers and integrated software. A company’s internal controls may be insufficient if it cannot assess changes or risks introduced by those providers.
Financial measurement is another area of weakness. Although respondents reported substantial board-level ownership, only 37% said they had a formal, board-reviewed quantification of the financial risk arising from gaps in AI governance. Without that assessment, organizations may find it harder to compare the cost of stronger controls with the potential consequences of failures, interruptions or regulatory non-compliance.
The survey also found that 54% govern generative AI and agentic AI as separate risk categories with distinct frameworks. A further 38% apply a shared core framework with additional controls for agentic AI. These approaches suggest companies are beginning to recognize that different AI capabilities may require different oversight, although the research does not establish which model is more effective.
Regional regulation shapes governance priorities
Regulatory pressures vary across the markets covered by the research. In the EU, 41% of respondents said they were accelerating governance investment ahead of the EU AI Act’s high-risk obligations scheduled for December 2027, while 35% said they were on track with structured compliance plans.
The European Commission’s published timeline confirms that obligations for high-risk AI systems covered by Annex III are scheduled to apply from December 2, 2027, while certain high-risk AI systems embedded in regulated products have a later application date of August 2028.
In the UK, sector-regulator expectations were the most frequently cited driver of AI governance investment, at 27%. In Saudi Arabia and the UAE, national AI strategy requirements led, cited by 61% of respondents.
The regional differences indicate that enterprises cannot necessarily apply one uniform compliance timetable across every market. Multinational organizations may need common internal controls alongside local procedures for regulatory requirements, risk reporting and accountability.
IBM Senior Vice President and Chair for EMEA and APAC Ana Paula Assis said governance should be integrated into how AI agents operate, with clear limits on their actions, ownership when failures occur and controls that function in real time.
The broader challenge for enterprise leaders is turning formal governance commitments into demonstrable operational readiness. As AI agents take on more work, boards will need visibility into not only whether policies exist, but also whether organizations can monitor decisions, investigate incidents, manage third-party exposure and intervene when systems behave unexpectedly.
Market Landscape
Enterprise AI governance is shifting from policy development toward continuous oversight of deployed systems. The growth of agentic AI adds new considerations around access permissions, autonomous decision-making, auditability, human escalation and the ability to stop operations quickly. IBM’s survey highlights a mismatch between reported board-level ownership and the operational readiness needed to manage these risks. Regulatory requirements, third-party dependencies and uncertainty over vendor liability are likely to keep AI risk management on the agenda for enterprise technology, security, legal and compliance teams.
Top Insights
- AI incidents reach senior leadership: 80% of surveyed executives reported an AI-related incident reaching the board or C-suite, but only 40% reported a resulting governance policy or framework change.
- Agentic deployment is accelerating: 35% already run agentic AI in production, while 75% expect agents to have some decision-making autonomy by 2027.
- Governance readiness remains limited: Just 37% believe their current governance systems can scale with agentic AI deployment, according to IBM’s research.
- Third-party risk is under-monitored: 54% reported limitations in supply-chain AI governance, while only 21% continuously monitor third-party AI risk.
- Accountability remains unsettled: Although 98% reported formal board-level AI risk responsibility, respondents differed on who should be liable for agent-related harm.
Power Tomorrow’s Intelligence — Build It with TechEdgeAI
