IBM: 8 in 10 Firms Saw an AI Incident — and Changed Nothing

Here is a number that should end a few board meetings early: 80%. That is the share of senior executives across Europe and the Middle East who told IBM that an AI-related incident reached their board or C-suite in the past year. Agent failure. Data exposure. A bad AI decision. A security breach. Four out of five boardrooms have now had the conversation.

And here is the number that should start a much harder one: 40%. That is the share of those organisations that actually changed an AI governance policy or framework in response. The other 60% had the incident, briefed the board — and changed nothing.

IBM's new study, "The New Realities of AI Governance," surveyed more than 3,200 senior executives at large organisations across eight EMEA countries and was presented at the company's Think on Tour EMEA 2026 conference in London last week. Its message is uncomfortable: AI governance has become a communications exercise. The incident gets escalated, the board gets briefed, the minutes get filed — and the same agents keep running under the same rules. With agentic AI about to go mainstream, that gap is about to become a chasm.

IBM's head office in Bangalore, India. The company's new AI governance study found 8 in 10 EMEA executives had an AI incident reach the boardroom — but only 40% changed a policy. Photo: Chinmayee Mishra, CC BY-SA 4.0, via Wikimedia Commons.

8 in 10 boardrooms, meet the incident

The headline figure is stark: eight in ten executives surveyed said an AI-related incident — including an agent failure, data exposure, AI-driven decision error, or AI security breach — reached their board or executive leadership in the past year. Of those, 43% said it was formally reviewed at board level and 37% said it was communicated informally, according to coverage of the findings.

This is not a fringe-experiment problem anymore. Thirty-five percent of respondents said they are already running agentic AI in production, and three-quarters expect AI agents to have some level of autonomy over decisions by 2027. The incidents reaching the board are not hypotheticals from a lab — they are the exhaust of systems already deployed inside real companies, making real decisions, failing in real ways.

And yet only 37% of respondents said their current governance system is designed to scale with agentic AI deployment. Only 37% have a formal, board-reviewed quantification of the financial risks created by gaps in their AI governance. Boards are being told about AI failures without being given the tools to price them — which is rather like being told the ship is leaking without being told how fast.

The 40% who bothered to change anything

The most revealing number in the study isn't the 80% — it's what happened next. Fewer than half of the affected organisations changed a governance policy or framework in response. When deployment timelines outpace governance readiness, 56% of executives said they simply press ahead within "agreed risk limits" while governance catches up. Only a third delay deployment until the governance is ready.

Think about what that means in practice. An AI agent misfires, exposes data or makes a bad call. The incident travels all the way to the boardroom. And the organisation's response, six times out of ten, is a briefing — not a rule change. The incident becomes a communications event: someone explains what happened, someone commits to a review, the review produces a document. Song, chief marketing officer at the AI consultancy Wyrework, put it brutally in an October 17 analysis of the findings: "If your AI policy lives in a binder or in committee minutes, you don't have one."

We checked the accountability math the survey implies, and it is damning: 98% of executives said their organisation has formally assigned AI risk at board level — yet when asked who actually answers for harm caused by an AI agent, no single role was named by more than 17% of respondents. Responsibility, it turns out, is everywhere and nowhere. A board can own a risk on paper. It cannot answer for an agent at 3 a.m.

Illustrative: a corporate board room in session. IBM found that 80% of EMEA executives had an AI incident escalated to this level — but 60% changed no policy afterwards. Photo: Metropolitan Transportation Authority of the State of New York, CC BY 2.0, via Wikimedia Commons.

Who's actually responsible? Nobody can say

The accountability vacuum is the study's quiet bombshell. Formal assignment of AI risk at board level is nearly universal — 98% — which sounds reassuring until you ask the follow-up question. Who, by name and title, answers when an autonomous agent does damage? The survey couldn't produce a consensus answer. The chief risk officer? The chief compliance officer? Only 14% of respondents thought the CRO or CCO should carry AI risk in the boardroom.

This is the governance equivalent of everyone being in charge and nobody being in charge. And it is about to collide with regulation. The White House has moved to mandatory AI incident reporting and a 120-day Super Intelligence Force review of how companies handle breaches and hacks; India's CERT-In has issued critical advisories after AI agents broke into live systems during testing; Australia is legislating a digital duty of care for platforms. The era of "we briefed the board" as a sufficient response is ending — regulators are starting to ask what changed.

The operating problem, not the technology problem

Speaking on stage in London on Wednesday, Ana Paula Assis, IBM's senior vice president and chair for EMEA and APAC, framed the findings as a management failure, not a technical one. "The AI debate has moved from adoption to governance and accountability," she said. "As organizations progress from AI assistants to autonomous agents, governance can no longer be treated as a compliance exercise. It has become a business requirement and value enabler."

Her sharper line came in the keynote: "The question now is: Can we operate it at scale safely, reliably?" Assis said. "That is not a technology problem. That is an operating problem, and it requires a fundamentally different, new AI operating model."

She also landed a quieter punch on the industry's favourite narrative. Eighty percent of executives expect AI to drive revenue growth, she noted — yet only 20% can explain exactly how that will happen. The C-suite is simultaneously certain AI will make money and uncertain how, certain AI incidents reach the board and uncertain who owns them. Confidence without comprehension is the whole 2026 enterprise-AI story in two statistics.

What an actual AI incident playbook looks like

The survey shows boards lack all three ingredients: a named accountable owner (no role cleared 17%), a mandatory policy review after every escalation (60% skip it), and a quantified financial exposure (only 37% price the risk). So here is the working playbook. First, name the person who can kill the agent at 3 a.m. — not a committee, a name, with the authority to pull the plug. Second, write the post-incident policy change into the review itself, not into a briefing that nobody acts on. Third, set pause-or-pivot rules before agents gain decision autonomy — three-quarters of firms expect that autonomy by 2027, and a rule written after the fact is a press release, not a control. And a briefing, as this post argues in its closing, is not the fix.

Our take: the briefing is not the fix

Let's call the 80/40 gap what it is: governance theatre. An incident that reaches the board and changes nothing is not governance — it is a ritual. And rituals are what organisations perform when they want the appearance of control without the cost of it. The 56% who "press ahead within agreed risk limits" are betting that their risk limits mean something when an autonomous agent acts at 3 a.m. with no human in the loop. That bet is about to be tested at scale: three-quarters of these same executives expect agents to have decision autonomy by 2027.

The honest reading of IBM's study is that enterprise AI has outrun enterprise management. The technology works well enough to deploy and badly enough to fail; the governance layer — the part that decides who answers for the failure — was never built. Boards have spent the last year being briefed about incidents. The next year will be spent being sued about them. The companies that survive won't be the ones with the best incident briefings. They'll be the ones that can name, right now, the person who stops the agent.

IBM reports third-quarter earnings on Wednesday. The numbers will get the headlines. But this study is the more important IBM story this week — because it describes, in the industry's own data, a corporate world sleepwalking into the agentic era with its governance in a binder.

Sources

IBM via PRNewswire, "IBM Study: Eight in Ten EMEA Enterprises Escalate AI Incidents to Board or C-Suite as AI Agents Test Governance" (Oct 15, 2026); TechTarget, "IBM: Agentic AI is reshaping governance, controls and trust" by Scarlett Evans (Oct 14, 2026); FinanceChief, "IBM Think 2026: AI, Governance and ROI" (Oct 15, 2026); Wyrework, "8 in 10 firms escalated an AI incident. Most changed no policy." by Song, CMO (Oct 17, 2026); AI Weekly summary of the IBM survey (Oct 15, 2026); Channel NewsAsia media-release relay of the IBM announcement. Survey base: 3,200+ senior executives at 1,000+-employee organisations across eight EMEA countries.

By Daniel Rao. Daniel Rao covers AI policy, enterprise AI and Big Tech accountability for TechPulse USA.