London – October 14, 2026 -- Eight in ten executives surveyed across Europe and the Middle East say an AI-related incident reached their board or C-suite in the past year, yet only 40% of those organizations changed AI governance policy or frameworks in response, according to new IBM research.
The survey covers 3,221 senior executives, including C-level, at organizations with 1,000 or more employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE. Censuswide conducted the research for IBM between 14 and 24 September 2026. Incidents in scope included agent failures, data exposure, AI-driven decision errors and AI security breaches.
56% of executives keep deploying AI while governance catches up
When deployment speed outpaces governance and compliance readiness, 56% of respondents proceed within agreed risk limits while governance adapts. One third delay deployment until governance is ready.
Agentic AI outruns governance design: 35% in production, 37% ready to scale
Thirty-five percent of respondents run agentic AI in production today. Three-quarters expect AI agents to have some level of autonomy over decisions by 2027, but only 37% say their governance system is designed to scale with agentic deployment.
Ana Paula Assis, IBM Senior Vice President and Chair, EMEA and APAC, said the debate has shifted from adoption to governance and accountability, and that governance must be built into how agents operate, with clear boundaries, defined ownership of failures and real-time controls.
Board ownership reaches 98%, but accountability for agent failures stays unclear
Nearly all respondents (98%) have formally assigned AI risk responsibility at board level, including 26% with a dedicated board-level AI committee. No consensus exists on who answers for adverse outcomes from AI agents: the CIO or CTO is the most cited role, named by just 17%.
Views on legal liability when an AI system causes significant harm are split. Twenty percent favor proportional sharing between deployer and vendor, 19% call for a regulatory framework that does not yet adequately exist, and 14% place liability with the AI vendor or technology provider.
For agents making decisions without human approval at each step by 2027, executives expect to need:
- Legal or contractual frameworks defining vendor liability for agent failures (33%)
- Defined human escalation thresholds (32%)
- Real-time monitoring and audit trails of agent decisions (30%)
- The ability to immediately halt agent activity enterprise-wide (29%)
Only 37% quantify the financial risk of governance gaps at board level
While 54% govern generative AI and agentic AI as distinct risk categories with separate frameworks, and a further 38% apply the same core framework with additional agentic controls, only 37% have a formal, board-reviewed quantification of the financial risk created by governance gaps.
Third-party AI risk: 54% report coverage gaps, 21% monitor continuously
Fifty-four percent acknowledge gaps or limitations in how governance covers AI systems and models used by key vendors, technology partners and supply chain participants. Only 21% continuously monitor third-party AI risk, and 13% apply independent assurance or certification requirements.
Regulatory drivers differ by market
In the EU, 41% of surveyed executives are accelerating governance investment ahead of the EU AI Act's high-risk obligations in December 2027, and a further 35% are on track with structured compliance plans. In the UK, sector regulator expectations are the most cited driver of governance investment (27%). In Saudi Arabia and the UAE, national AI strategy requirements lead at 61%.