ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

IBM Institute for Business Value

IBM report cover examining AI sovereignty, vendor lock-in, and governance risks for enterprise AI systems.

IBM Finds AI Sovereignty Gap Raising Governance Risks

, , , , , , , , ,

Only 9% of executives say they have an excellent understanding of their AI dependencies as organizations face growing vendor lock-in and operational resilience challenges.

 

Key Takeaways

  •         Only 9% of executives say they have an excellent understanding of their AI dependencies.
  •         71% say switching their primary AI vendor or model would be difficult today.
  •         72% would accept a 20% cost increase to maintain multiple AI vendors for strategic flexibility.
  •         81% say a seven-day outage at a primary AI vendor would have a severe or critical impact on operations.
  •         Organizations with stronger control across data, models, and infrastructure protect 55% more operating profit from AI-driven disruption.

 

The IBM Institute for Business Value released a new report examining how organizations are managing AI sovereignty as AI becomes increasingly embedded in business operations.

Based on a survey of 1,000 senior executives, the report found that many organizations are expanding AI adoption while struggling to maintain visibility into the vendors, models, infrastructure, and data dependencies that support those systems.

The findings suggest AI sovereignty is emerging as a governance issue as organizations seek greater control over the technologies driving operational decisions.

Organizations lack visibility into AI dependencies

Only 9% of executives said they have an excellent understanding of their dependencies on AI vendors, models, and infrastructure.

At the same time, 71% said switching their primary AI vendor or model would be difficult if required today. IBM said the findings highlight the growing challenge of maintaining flexibility as organizations become increasingly reliant on AI services and providers.

The report defines AI sovereignty as an organization’s ability to move data, swap models, and shift workloads across environments when technical, commercial, or regulatory conditions change.

These dependencies have become more complex over the past two years, with executives reporting unexpected price increases, usage restrictions, service deprecations, changes to data-handling practices, and geographic access limitations.

Vendor concentration creates resilience concerns

The study found that 81% of executives believe a seven-day outage affecting a primary AI vendor would have a severe impact on business operations.

In addition, 75% of executives who switched or attempted to switch AI vendors over the past two years said the process was difficult due to data portability issues, model revalidation requirements, compliance obligations, and being tied to a specific vendor’s technology.

Despite those challenges, many organizations are willing to invest in flexibility. The report found that 72% of executives would pay 20% more to maintain multiple AI vendors if doing so improved strategic freedom and reduced dependence on a single provider.

IBM noted that 28% of organizations already use four or more AI vendors as part of a strategy to maximize flexibility and avoid lock-in.

Governance and control linked to business outcomes

The report found that organizations with the strongest control across data, models, infrastructure, and applications protect 55% more operating profit from AI-driven disruption than organizations with less control.

The report also found that 57% of executives said replacing a core AI model would require significant decoupling or even a complete system rebuild. In comparison, 56% said moving core AI systems and applications to a different vendor would take at least six months.

As AI systems become more deeply embedded in business operations, IBM said organizations are increasingly evaluating how much control they maintain over the data, models, and infrastructure that support those capabilities.

Abstract 3D metallic C in magenta and blue tones, illustrating enterprise AI agent incidents risk and governance failures.

Enterprises Averaged 54 AI Agent Incidents Last Year; A Third Caused Data Breaches.

, , , , , , , , , , , ,

IBM’s 2026 tech leader study found that governance built for human-speed decisions cannot contain machine-speed systems. Most technology leaders are already experiencing the consequences.

Key Takeaways

  • 77% of tech leaders say AI adoption is outpacing their current governance capabilities.
  • Companies detected an average of 54 AI agent incidents over the past 12 months; 17% were high-severity incidents, with each requiring more than 4 hours to contain.
  • 37% of AI agent incidents resulted in data exposure or security breaches.
  • Only 11% of CIOs and CTOs say they’re fully prepared for the scale of agent deployment expected in the next 12 months.
  • Survey: 2,000 CIOs, CTOs, and other C-suite technology leaders across 33 geographies and 19 industries, Q1 2026, IBM Institute for Business Value with Oxford Economics

The IBM Institute for Business Value, working with Oxford Economics, published its 2026 Tech Leader Study in Q1 2026. It surveyed 2,000 CIOs, CTOs, and other C-suite technology leaders across 33 geographies and 19 industries on how enterprises are managing AI as it scales from pilots to production. The AI agent governance numbers stand apart.

 

AI adoption without governance is driving cyber incidents

77% of tech leaders say AI adoption has outpaced their current governance capabilities. 70% report that their teams are deploying technology faster than IT can keep track of. More than two-thirds say business units bypass IT entirely to adopt AI tools.

Enterprises are starting to feel the effects. Enterprises detected an average of 54 AI agent incidents in the past 12 months. 17% were high severity, requiring more than four hours to contain. Of those incidents: 37% resulted in data exposure or security breaches, 33% triggered cascading system failures, and 17% created compliance or regulatory issues.

 

Why manual controls break down as AI deployment scales

The root problem is architecture. AI agents make decisions continuously, and at volumes no approval process can realistically supervise. When companies allow business units to deploy AI systems without IT oversight, visibility degrades, and incident rates rise proportionately. When IT tries to review everything, the business slows.

Conversely, in organizations that build governance into their system architecture, incident rates stay relatively flat even as agent deployment accelerates. In organizations that rely on manual review, incidents increase in proportion to deployment.

 

Strong governance generates ROI

Organizations with designed-in governance deploy 16 times more agents than peers relying on manual review, spend 4 times less of their AI budget, and deliver 18% higher operating margins.

 

By 2027, enterprises expect to deploy an average of 1,661 AI agents, a 38% increase from today’s levels. IBM projects AI spending to reach nearly 25% of total IT budgets by 2027, up from 14.5% in 2025. For organizations still relying on manual governance, both numbers make the current gap harder to close, not easier.