An IBM-commissioned survey of 3,221 executives at large organizations across eight European and Middle Eastern countries found that 80% said an AI-related incident had reached their board or C-suite in the previous year. Only 40% reported changing an AI governance policy or framework in response, according to results IBM published on Oct. 14.
IBM says the incidents include an AI agent failure, data exposure, an AI-driven decision error or an AI security breach.
More autonomy, uneven preparation
An AI agent is software designed to take actions toward a goal, sometimes over several steps, with less human approval at each step. Thirty-five percent of respondents said their organization already runs agentic AI in production. Three-quarters expect AI agents to have at least some autonomy over decisions by 2027, but only 37% said their current governance is designed to scale with agentic AI.
Board ownership does not settle who is accountable
Nearly all respondents, 98%, said responsibility for AI risk had been formally assigned at board level. But the survey found no clear consensus about who should be accountable when an AI agent causes an adverse outcome. CIOs or CTOs were the most frequently named role, at 17%.
Those figures describe different questions. A board can formally oversee AI risk while responsibility for a specific failure remains unclear. Respondents said the controls they expect to need include legal or contractual rules for vendor liability, defined thresholds for human escalation, real-time monitoring and a way to halt agent activity across an organization.
Organizations report different ways of handling the gap
For situations where AI deployment outpaces governance readiness, 56% of respondents said their organization continues within agreed risk limits while governance adapts; 33% said their organization delays deployment until governance is ready. The survey does not show which incidents led to those choices or whether either approach reduced harm.
Censuswide conducted the survey for IBM among 3,221 executive-management respondents, including C-suite leaders, at organizations with at least 1,000 employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the United Arab Emirates. Fieldwork ran from Sept. 14 to 24, 2026.
The results are a self-reported snapshot from an IBM-commissioned study, not an independent audit of incident records. The release does not give incident counts or severity, country-level sample sizes, or evidence that a reported policy change made systems safer. It therefore cannot establish whether AI incidents are becoming more common or how much a particular governance approach changes risk.
Sources
- IBM Newsroom: survey findings and methodology
- Illustration and rights: “Board room,” by hunterdt, an empty meeting room at Office Nomads in Seattle. The image is unrelated to IBM and the survey; it is licensed under CC BY-SA 3.0.