AI incidents are reaching boardrooms across Europe and the Middle East, but governance is not keeping pace with AI adoption, according to a new IBM study released in London on October 15.

Eighty percent of executives surveyed said an AI-related incident reached their board or C-suite in the past year, but only 40% of those organizations changed their AI governance policy or framework in response, IBM says.

The research firm Censuswide surveyed 3,221 executives at organizations with 1,000 or more employees in eight countries on IBM’s behalf, between September 14 and September 24. The survey covered the United Kingdom, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the United Arab Emirates.

IBM says AI agents, which take actions with limited human input, will test governance further as they take on more autonomous work.

Agents Are Arriving Before Governance Is Ready

IBM counts an agent failure, data exposure, AI-driven decision error or AI security breach as an AI incident. Thirty-five percent of respondents said they are running agentic AI in production today.

Three-quarters expect AI agents to have some level of autonomy over decisions by 2027. Only 37% said their governance is designed to scale with agentic AI, IBM says.

When deployment outpaces governance, 56% press ahead within agreed risk limits while governance catches up. A third delay deployment until governance is ready, according to the study.

IBM senior vice president Ana Paula Assis said governance “can no longer be treated as a compliance exercise.” She said it must be built into how agents operate, with clear boundaries and clear ownership when things go wrong.

No Clear Owner When an Agent Fails

Ninety-eight percent of executives surveyed said responsibility for AI risk is assigned at board level, including 26% with a dedicated board AI committee, according to IBM. But the study found no clear consensus on who is accountable when an AI agent causes harm.

The chief information officer (CIO) or chief technology officer (CTO) was the most-cited role, named by just 17% of respondents, IBM says. Views on legal liability were also split. Twenty percent said it should be shared between the deployer and the vendor, and 14% said it should sit with the vendor.

By 2027, executives expect to need vendor liability frameworks (33%), defined human escalation thresholds (32%), real-time monitoring and audit trails (30%), and the ability to halt agent activity across the enterprise (29%), according to the study.

Few Organizations Measure Vendor and Financial AI Risk

Fifty-four percent of respondents acknowledged gaps in how their governance covers AI systems used by vendors and partners, IBM says. Only 21% continuously monitor third-party AI risk, and 13% require independent assurance or certification.

Only 37% have a formal, board-reviewed estimate of the financial risk created by gaps in their AI governance, according to the study.

Agent Failures Need a Named Owner Before They Happen

For chief data officers (CDOs), the key finding is the ownership gap. Nearly every organization in IBM’s survey has assigned AI risk to the board, yet no single role is clearly accountable when an agent fails.

AI governance work that names an owner, sets escalation thresholds and builds in a way to stop an agent gives a board something to act on when an incident arrives.