IBM survey finds 80% report AI escalation, 40% cite governance changes

IBM said 80% of executives in an EMEA survey reported that an AI-related incident had reached their board or C-suite in the previous year, while 40% of the organizations associated with those escalations changed AI-governance policies or frameworks in response. The IBM-sponsored study, published Wednesday, counted agent failures, data exposure, AI-driven decision errors and AI security breaches among the incident examples.

The reported gap comes as 75% of respondents said they expected AI agents to have some decision-making autonomy by 2027. Just 37% said their current governance system was designed to scale with agentic-AI deployments, and 35% said their organization already had agentic AI in production.

IBM commissioned Censuswide to survey 3,221 executive-management respondents, including C-level executives, from Sept. 14 to Sept. 24, 2026. Respondents worked at organizations with at least 1,000 employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the United Arab Emirates.

The results describe executives’ own accounts rather than independently verified incident or governance records. IBM’s release does not publish the questionnaire, define the threshold for an “AI-related incident,” or disclose country-level sample sizes, industry composition, response rate, weighting, margin of error or confidence intervals. It also does not provide the underlying count or explicit base size for the 40% governance-change result.

On deployment decisions, 56% of respondents said their organizations continued operating within agreed risk limits when AI rollouts moved faster than governance and compliance readiness. Another 33% said they delayed deployment until governance was ready.

IBM also said 98% of respondents reported that responsibility for AI risk had been formally assigned at board level, including 26% who cited a dedicated board-level AI committee. Yet 37% said their organization had a formal, board-reviewed estimate of the financial risk created by AI-governance gaps. Among roles named as responsible for adverse outcomes involving AI agents, the CIO or CTO was the most frequent choice at 17%.

The governance findings add to an earlier IBM survey of finance leaders about enterprise AI strategy.

Five of the eight surveyed markets are European Union members. The European Commission’s enforcement schedule says EU AI Act rules for high-risk systems listed in Annex III apply from Dec. 2, 2027, while rules for high-risk systems embedded in regulated products apply from Aug. 2, 2028.

Third-party systems were another reported weakness: 54% of respondents acknowledged gaps or limits in governance coverage for AI used by vendors, technology partners or supply-chain participants. IBM said 21% reported continuous monitoring of third-party AI risk and 13% reported independent assurance or certification requirements.