Eight in ten senior executives surveyed across Europe and the Middle East say an AI-related incident reached their board or C-suite in the past year, according to new IBM research — yet only 40% of those organisations changed their AI governance policy or framework in response to fill AI governance gap. The study — run by Censuswide among 3,221 executives across eight countries — paints a picture of governance that adoption is outpacing, particularly as AI agents take on more autonomous work.
The incidents the survey counts include agent failures, data exposure, AI-driven decision errors and AI security breaches. AI governance gap is clearly visible. That such events are reaching the top of the organisation is not, on its own, a failure — escalation is what governance is for. The AI governance gap the study identifies is in what happens next: fewer than half of the organisations that escalated an incident changed their governance in response. Surveys of this kind are worth reading for direction rather than precision. The sample is large and the methodology is there, but the responses are executives’ perceptions of their own organisations, collected by a research panel rather than audited.
That does not make the pattern unreliable — the convergence with other surveys argues against that — but it does mean the numbers describe what leaders believe about their governance, not what an independent reviewer would find.
AI Governance Gap: The accountability paradox
The survey’s most striking tension sits in its accountability findings. Nearly all respondents (98%) say their organisation has formally assigned responsibility for AI risk at board level, and 26% have a dedicated board-level AI committee. Yet there is no clear consensus on who is accountable for adverse outcomes from AI agents: the organisation’s CIO or CTO was the most frequently role to fill that AI governance gap, and only 17% of all respondents named it.
Views on legal liability when an AI system causes significant harm are similarly divided. A fifth (20%) favour sharing liability proportionally between deployer and vendor; 19% say there should be a regulatory framework that does not yet adequately exist; and 14% say it should sit with the AI vendor. In other words, organisations have appointed owners for AI risk without agreeing on what ownership means when an agent causes harm.
The absence of a clear owner is not a technicality. When an agent acts on an organisation’s behalf, someone must be able to answer for the outcome, and the survey suggests most organisations cannot yet say who that is. Until they can, governance will rest on structures rather than on responsibility.
Governance lagging agentic adoption
The study’s agentic findings sharpen the point. Thirty-five percent of respondents say they run agentic AI in production today, and three-quarters expect AI agents to hold some level of decision-making autonomy by 2027. But only 37% say their current governance system can scale with agentic AI deployment.
Measurement is thinner still. Only 37% have a formal, board-reviewed quantification of the financial risk created by gaps in their AI governance. Supply chain oversight is weaker: 54% acknowledge gaps in how their framework covers AI systems used by vendors and partners, only 21% continuously monitor third-party AI risk, and just 13% apply independent assurance or certification requirements.
The study also captures how organisations behave when the pressure to ship AI outruns governance. Rather than pause, 56% of respondents report pressing ahead within agreed risk limits while governance adapts; a third (33%) delay deployment until governance is ready. That is a deliberate trade-off, and the survey suggests most organisations are choosing speed with guardrails over waiting for perfect rules.
Act Without Human Approval
To manage agents that may act without human approval at each step by 2027, respondents say they expect to need formal legal or contractual frameworks defining vendor liability for agent failures (33%), defined human escalation thresholds (32%), real-time monitoring and audit trails (30%) and the ability to halt agent activity across the enterprise (29%). Those are, in effect, a wish list for controls that largely do not exist yet. The combination of these findings is what matters.
An organisation can be running agents in production, expect them to gain autonomy within two years, and still lack an AI governance system built for that future, a financial-risk estimate, and a clear owner for failures. Each gap is survivable on its own; together they describe a control environment that has not caught up with the technology it is meant to govern.
Not an outlier
IBM’s findings would matter less if they stood alone. They do not. EY’s AI Risk and Governance Survey found that while 98% of senior AI executives report formal governance policies, about half (47%) admit their organisation has previously not followed its own governance process for urgent deployments, and 26% of those using agentic AI cannot detect unauthorised agents operating internally. Grant Thornton’s 2026 AI Impact Survey found 78% of executives lack strong confidence they could pass an independent AI governance audit within 90 days, and only 20% have a tested AI incident response plan. OneTrust found 87% of organisations encourage agent use while only 47% say that use is backed by clear governance and controls.
Different samples, different geographies, the same shape: adoption is running ahead of governance. That convergence is the strongest evidence in the story, because it means the gap is structural rather than an artefact of one vendor’s survey panel. The corroboration is not exact, and it need not be, because it is the pattern that matters. EY surveyed US executives at billion-dollar companies; Grant Thornton surveyed a different pool; OneTrust spanned eight countries. The samples, geographies and questions differ, yet each lands on the same conclusion: policy exists, but practice lags. That is a stronger signal than any single survey could provide, because it is harder to attribute to one vendor’s framing.
The regulatory clock
Regulation is beginning to set a deadline. Under the EU AI Act, the obligations for high-risk AI systems in Annex III areas — including biometrics, critical infrastructure, education, employment, and migration, asylum and border control — apply from 2 December 2027, and those for high-risk AI embedded in regulated products from 2 August 2028, following the “AI Omnibus” amendments that pushed the dates back. The IBM finding that 41% of EU respondents are accelerating governance investment ahead of the December 2027 deadline is consistent with that timetable.
The drivers differ by market, and that difference is informative. In the UK, where the Act does not apply, sector-regulator expectations are the most cited driver of AI governance investment (27%). In Saudi Arabia and the UAE, national AI strategy requirements lead, cited by 61%. The study thus shows regulation pulling governance investment in the EU, regulators in the UK, and national strategy in the Gulf — three different mechanisms producing similar activity. The three drivers point to a deeper question about what governance is for. If investment is pulled by a regulatory deadline in the EU, by sector regulators in the UK, and by national strategy in the Gulf, then governance is largely compliance-driven — something organisations do because a rule requires it.
The IBM findings suggest that incidents themselves are not yet a strong enough driver: most boards saw one, and most did not change policy.
What to watch
The question the study leaves open is what actually changes after an incident reaches the board. If 80% of organisations escalated an AI incident but only 40% changed policy, the next year will show whether that ratio shifts as the AI Act deadline approaches and as agents move further into production. Two other signals are worth tracking: whether the share with formal financial-risk quantification rises above 37%, and whether law, contract or the market resolves the liability question. The survey’s own respondents expect the answer to come from legal and contractual frameworks, which suggests they do not think the regulatory framework alone will settle it.
What the study does and doesn’t establish
It establishes a large, methodologically disclosed survey of executive perception across eight EMEA countries, and a set of findings that independent research corroborates. It does not establish measured incident rates or financial losses, a longitudinal trend, or that governance failures caused any specific harm; the data is what executives reported, not what auditors verified. Moreover, it is also worth noting that IBM sells AI governance, hybrid-cloud and sovereign-platform offerings, so the research aligns with its commercial interests even as its findings are echoed elsewhere.
The honest summary is that the study quantifies a gap that practitioners already sense: AI has moved from pilot to production, and in some cases to autonomous agents, faster than the policies, measurements and accountability structures meant to govern it. The headline statistic — eight in ten boards seeing an AI incident — is arresting, but the more telling numbers are the quieter ones: 40% changing policy in response, 37% able to measure the financial risk, and 17% able to name who is accountable when an agent goes wrong. Those are the numbers that will need to move before governance can claim to have caught up with adoption.
Editor’s Note: This article draws on the IBM release and its UK companion release, EU AI Act primary sources, and independent AI governance surveys by EY, Grant Thornton and OneTrust. All survey figures are as reported by their publishers; the EU AI Act timeline is from official sources. IBM sells AI governance and hybrid-cloud offerings. No independent audit of the survey data was conducted. No interview was conducted.