56% of executives say their company keeps rolling out AI before governance is in place, and only 37% built in governance for AI agents that act without a person approving each step.
Key Takeaways
- 80% of the 3,221 executives IBM surveyed in Europe and the Middle East say their company escalated an AI incident to its board, CEO, or other top executives in the past year. Only 40% of those companies changed their AI rules after the incident.
- 75% expect their AI agents to act without a person approving every step by 2027. Only 37% say their company’s AI governance is designed for that.
- When AI deployment outpaces governance, 56% of companies roll out AI anyway, but only within their current risk limits. 33% hold off until their governance catches up.
- Only 37% say their board has reviewed an estimate of how much money their company could lose because its AI governance falls short.
In an IBM survey of 3,221 executives at large companies in Europe and the Middle East, 80% said their company escalated an AI incident to its board, CEO, or other top executives in the past year. Only 40% of those companies say they changed their AI rules after the incident.
AI incidents go to the board, but most companies keep their AI rules the same
The AI incidents executives described include an AI agent failing, data exposure, AI making a wrong decision, and AI-related security breaches.
Among the companies that escalated an AI incident, 40% say they changed their written AI rules afterward. 38% changed their AI spending or rollout plans, 37% brought in outside advisers, and 35% notified regulators.
Companies keep rolling out AI agents before governance is in place
35% of executives say their company already uses AI agents in its everyday work. 75% expect agents to act without a person approving every step by 2027.
Only 37% say their company’s current AI governance is designed to handle agents working that way. Another 45% say their governance could cope but needs strengthening.
When their company wants to roll out AI faster than its governance is ready for, 56% of executives say the company does so, but only within its current risk limits, and adjusts its governance along the way. Only 33% hold off on the rollout until their governance catches up.
No one agrees who is responsible when an AI agent causes harm
98% of executives say their company has made the board formally responsible for AI risk, and 26% have a board committee just for AI. On paper, nearly every board owns AI risk, but nobody agrees who answers for it when an agent does harm.
When IBM asked executives who is accountable when an AI agent causes harm, there is no clear consensus. Their answers were split across eight different roles. No role got more than 17%:
- Chief information officer or chief technology officer: 17%
- Top executives sharing responsibility: 14.5%
- Chief risk officer or chief compliance officer: 14%
- Chief AI officer: 13%
- The team that put the agent to work: 11%
- The AI vendor: 10%
- The head of the business unit: 10%
- The CEO: 9%
Executives are also split on who should be legally liable when an AI system causes significant harm. 20% say the company using the AI and the company that sold it should share liability. 19% say the rules needed to decide this don’t exist yet. 14% say the AI vendor should be liable.
As agents make more decisions without a person approving each step, executives expect to need:
- Vendor contracts: contracts that set out what the AI vendor owes when an agent fails (33%)
- Hand-off points: set points where an agent must pass a decision to a person (32%)
- Live records: records of every decision and action an agent takes, monitored as they happen (30%)
- A stop button: the ability to halt every agent across the company at once (29%)
Few companies know what their AI governance gaps could cost
Only 37% of executives say their board has reviewed an estimate of how much money their company could lose because its AI governance falls short.
Most companies govern their partners’ AI through contracts
54% of executives say their company’s AI governance does not fully cover how their systems use and interact with the AI that their vendors, technology partners, and suppliers employ.
To minimize this outside AI risk, companies rely on contract terms that set rules the partner must follow (43%) and the right to audit the partner (39%).
Only 21% monitor their partners on an ongoing basis, and 13% require independent checks or certification of their partner’s AI.
IBM recommends governance should be built into how agents work
Ana Paula Assis, IBM’s chair for Europe, the Middle East, Africa, and Asia Pacific, said governance “must be built into how agents operate, with clear boundaries on what they can do, clear ownership when things go wrong, and controls that work in real-time.”
The survey ran from Sept. 14 to 24, 2026. It questioned 3,221 executives, including chief executives and other top officers, at organizations with 1,000 or more employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia, and the UAE.
