IBM Study: Eight in Ten EMEA Enterprises Escalate AI Incidents to Board or C-Suite as AI Agents Test Governance

Among surveyed EU executives, 41% are accelerating governance investment ahead of December 2027 high-risk obligations under the EU AI Act.

Rhea-AI Summary

IBM (NYSE: IBM) published research finding that 80% of surveyed EMEA executives reported an AI-related incident reaching their board or C-suite. Only 40% of those organizations changed AI governance policy or frameworks in response. When deployment outpaces governance readiness, 56% proceed within agreed risk limits, while 33% delay deployment until governance is ready.

The survey covered 3,221 executives across eight countries in Europe and the Middle East. While 35% report running agentic AI—systems that act autonomously—in production today, 75% expect AI agents to have some decision-making autonomy by 2027. Only 37% say their governance is designed to scale with agentic AI deployment. Although 98% have assigned AI risk responsibility at board level, only 37% have formal, board-reviewed financial risk quantification for governance gaps. Another 54% acknowledge gaps in governance coverage of third-party AI.

Key Figures

Incidents reaching board or C-suite: 80% Governance policy or framework changed: 40% Expect AI-agent decision autonomy: 75% +4 more

Incidents reaching board or C-suite

80%

Surveyed EMEA executives; past year

Governance policy or framework changed

40%

Organizations responding to an AI-related incident

Expect AI-agent decision autonomy

75%

Respondents; by 2027

Governance designed to scale

37%

Respondents; agentic AI deployment

Continue deployment within agreed risk limits

56%

Respondents whose AI deployment outpaces governance readiness

Delay deployment until governance is ready

33%

Respondents whose AI deployment outpaces governance readiness

Survey respondents

3,221 executives

Organizations with 1,000 or more employees across eight countries

Key Terms

agentic ai, generative ai

2 terms

agentic ai technical

"designed to scale with agentic AI deployment"

Agentic AI refers to computer systems that can make their own decisions and take actions without needing someone to tell them what to do each time. It's like giving a robot a degree of independence to solve problems or achieve goals on its own, which matters because it could change how we work and interact with technology in everyday life.

generative ai technical

"govern generative AI tools and agentic AI systems as distinct risk categories"

Generative AI is a type of computer technology that can create new content, like text, images, or music, on its own. It’s important because it can produce realistic and useful material quickly, which could change how we create art, write stories, or even develop new products. Think of it as a smart robot that can invent and produce things almost like a human.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

• 80% of surveyed executives in EMEA say an AI-related incident reached their board or C-suite in the past year, with only 40% changing AI governance policy or frameworks in response.
• 75% of respondents expect AI agents to have some level of autonomy with respect to decisions by 2027, yet only 37% say their governance is designed to scale with agentic AI deployment.
• When surveyed organizations want to deploy AI faster than governance and compliance frameworks are prepared for, nearly 60 percent (56%) continue within agreed risk limits while governance adapts; a third (33%) delay deployment until governance is ready.
• Only 37% of respondents have a formal, board-reviewed quantification of the financial risks created by gaps in their AI governance.

LONDON, Oct. 14, 2026 /PRNewswire/ -- New research by IBM (NYSE: IBM) finds that AI-related incidents are reaching boardrooms across Europe and the Middle East among the organizations surveyed, but governance capabilities and risk accountability are not keeping pace with adoption of the technology.

Eight in ten executives surveyed say an AI-related incident – including an agent failure, data exposure, AI-driven decision error, or AI security breach – reached their board or C-suite in the past year. Yet fewer than half (40%) of those organizations cite a change to AI governance policy or framework in response.

When the pace of deploying AI outstrips governance and compliance frameworks readiness, rather than pause while governance adapts, the majority (56%) of executives surveyed report pressing ahead within agreed risk limits. Just a third delay deployment entirely until their governance is ready.

The survey, of more than 3,200 senior executives at organizations across eight countries in Europe and the Middle East, suggests governance policies will be tested further as AI agents take on more autonomous work. Thirty-five percent of respondents say they are running agentic AI in production today, yet three-quarters expect AI agents to have some level of autonomy towards decisions by 2027. Only 37% say their current governance system is designed to scale with agentic AI deployment.

Ana Paula Assis, IBM Senior Vice President and Chair, EMEA and APAC, said: "The AI debate has moved from adoption to governance and accountability. As organizations progress from AI assistants to autonomous agents, governance can no longer be treated as a compliance exercise. It has become a business requirement and value enabler.

The enterprises that can scale AI with accountability and trust will be postitioned to realize business value. That means governance must be built into how agents operate, with clear boundaries on what they can do, clear ownership when things go wrong, and controls that work in real-time."

Accountability & liability gap

Nearly all executives (98%) surveyed have formally assigned responsibility for AI risk at board level, including 26% with a dedicated board-level AI committee. Yet the research found no clear consensus on accountability for adverse outcomes from AI agents. An organization's CIO or CTO was the most frequently cited role with assigned responsibility for adverse outcomes from AI agents, selected by just 17% of all respondents.

Respondents' views on legal liability when an AI system causes significant harm were also divided: 20% say it should be shared proportionally between deployer and vendor, 19% say there should be a regulatory framework that does not yet adequately exist, and 14% say it should sit with the AI vendor or technology provider.

To manage increasingly autonomous AI agents making decisions without human approval at each step by 2027, executives expect to need formal legal or contractual frameworks defining AI vendor liability for agent failures (33%), defined human escalation thresholds (32%), real-time monitoring and audit trails of agent decisions and actions (30%) and the ability to immediately halt agent activity across the enterprise (29%).

Other key findings include:

• Measurement of financial risk exposure less established than board ownership: More than half (54%) of surveyed executives govern generative AI tools and agentic AI systems as distinct risk categories with separate governance frameworks and a further 38% apply the same core framework, but with additional controls to agentic AI. Measuring financial exposure from gaps in AI governance is less advanced: only 37% have a formal, board-reviewed quantification of the financial risk created by gaps in their AI governance.
• Supply chain risk: 54% of all respondents acknowledge gaps or limitations in how their governance framework covers the AI systems and models used by key vendors, technology partners and supply chain participants. Only 21% continuously monitor third-party AI risk and 13% apply independent assurance or certification requirements.
• Regulation shapes the pace regionally: In the EU, 41% of surveyed executives are accelerating governance investment ahead of the EU AI Act's high-risk obligations in December 2027, and a further 35% are on track with structured compliance plans. In the UK, sector regulator expectations are the most cited driver of AI governance investment (27%), while in Saudi Arabia and the UAE, national AI strategy requirements lead (61%).

Study methodology

The research was conducted by Censuswide on behalf of IBM among 3,221 executive management respondents, including C-level, at organizations with 1,000 or more employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE. The data was collected between 14 and 24 September 2026.

About IBM

IBM is a leading provider of global hybrid cloud and AI, and consulting expertise. We help clients in more than 175 countries capitalize on insights from their data, streamline business processes, reduce costs and gain the competitive edge in their industries. Thousands of government and corporate entities in critical infrastructure areas such as financial services, telecommunications and healthcare rely on IBM's hybrid cloud platform and Red Hat OpenShift to affect their digital transformations quickly, efficiently and securely. IBM's breakthrough innovations in AI, quantum computing, industry-specific cloud solutions and consulting deliver open and flexible options to our clients. All of this is backed by IBM's long-standing commitment to trust, transparency, responsibility, inclusivity, and service.  Visit www.ibm.com for more information.

Media contact: 

Gregor Hastings
IBM EMEA Communications
gregor.hastings@ibm.com

View original content to download multimedia:https://www.prnewswire.com/news-releases/ibm-study-eight-in-ten-emea-enterprises-escalate-ai-incidents-to-board-or-c-suite-as-ai-agents-test-governance-302908550.html

SOURCE IBM

FAQ

AI-generated questions and answers. How Rhea-AI works. Not financial advice.

What did IBM's EMEA study find about AI incidents reaching company boards?

80% of surveyed executives said an AI-related incident reached their board or C-suite in the past year. These incidents included agent failures, data exposure, AI-driven decision errors or AI security breaches. Only 40% of those organizations cited a resulting change to AI governance policy or frameworks.

How prepared are organizations for autonomous AI agents in IBM's EMEA study?

Only 37% of respondents said their current governance system is designed to scale with agentic AI deployment. Meanwhile, 35% reported running agentic AI in production today, and 75% expected AI agents to have some decision-making autonomy by 2027.

How was IBM's EMEA AI governance survey conducted?

Censuswide conducted the research for IBM among 3,221 executive management respondents, including C-level executives, at organizations with 1,000 or more employees. Data was collected between 14 and 24 September 2026 in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE.

What controls do executives expect to need for autonomous AI agents in IBM's study?

Executives expected to need legal or contractual vendor-liability frameworks for agent failures (33%), human escalation thresholds (32%), real-time monitoring and audit trails (30%), and an ability to halt agent activity across the enterprise immediately (29%). These expectations concern increasingly autonomous agents making decisions without human approval at each step by 2027.

How do organizations monitor third-party AI risk in IBM's EMEA study?

Only 21% of respondents continuously monitor third-party AI risk, and 13% apply independent assurance or certification requirements. These measures concern AI systems and models used by vendors, technology partners and supply chain participants.