IBM survey finds AI incidents reaching executives faster than governance adapts

Incident escalation does not guarantee a policy change

IBM's EMEA governance survey reports that 80% of respondents say an AI-related incident reached their board or C-suite during the past year. The incident category includes agent failures, data exposure, decision errors and security breaches.

Only 40% of those organizations cite a change in governance policy or framework in response, according to the release. These are executive survey responses, rather than an independently audited register of incidents or remediation.

Agent autonomy exposes an operational gap

Three-quarters of respondents expect AI agents to have some decision autonomy by 2027, but only 37% say their governance is designed to scale with agent deployment. IBM also reports that 35% are already running agentic AI in production.

Board ownership is widespread: 98% report formally assigning AI-risk responsibility at board level. Yet only 37% report a formal, board-reviewed quantification of financial exposure from governance gaps. The contrast concerns what respondents report having implemented, not a finding that one named organization violated a requirement.

Censuswide conducted the research for IBM with 3,221 executive-management respondents at organizations employing at least 1,000 people. The eight-country sample covered six European countries, Saudi Arabia and the UAE, with fieldwork from September 14 to 24, 2026. It should not be treated as a census of all businesses across EMEA.

Check what happens after an alert

Franklin analysis: a useful governance exercise follows one agent incident from detection to resolution. Identify who can stop the workflow, inspect the actions and authorize a change before activity resumes.

Record whether the fix changes an executable control, such as permissions or an escalation threshold, as well as written policy. The survey's gap between assigned responsibility and operational readiness suggests a concrete question for teams: can the person named as accountable actually observe and intervene in the deployed system?