IBM survey: 80% report AI incidents reaching senior leadership, 40% cite governance changes

AI failures are reaching senior leadership, but changes to the rules governing the technology are less common. In research published October 14, 2026, IBM said 80% of surveyed executives reported an AI-related incident reaching their board or C-suite in the past year. It put the share reporting resulting governance policy or framework changes at 40%.

The incidents covered several kinds of trouble: an agent failure, exposure of data, an erroneous AI-driven decision or an AI security breach.

Censuswide surveyed 3,221 executives for IBM between September 14 and 24, 2026, at organizations with at least 1,000 employees. Respondents were based in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE. These are executives’ accounts of incidents and readiness, not an independent audit of their organizations’ controls.

Deployment continues while the rules catch up

When organizations want to deploy AI faster than their governance and compliance frameworks are ready, 56% of respondents said they continue within agreed risk limits while governance adapts. Another 33% said they delay deployment until governance is ready.

AI agents—systems that can make decisions without human approval at every step—give that choice a more demanding setting. Already, 35% of respondents said their organizations run agentic AI in production. Looking ahead, 75% expect agents to have some decision-making autonomy by 2027. Just 37% said their governance is designed to scale with agent deployment.

IBM’s UK release, covering 504 respondents from the same study, shows regional differences. There, 61% continue deployment within agreed risk limits and 27% delay it. Yet 53% said their governance can scale with agents, above the overall 37%. Expectations for autonomous decision-making by 2027 were lower: 68%, against 75% overall.

98%Board-level responsibility assigned

Respondents reporting formally assigned responsibility for AI risk at board level.

37%Financial exposure formally quantified

Respondents reporting formal, board-reviewed quantification of financial risk from AI governance gaps.

Who answers when an agent goes wrong?

A dedicated board-level AI committee was in place for 26% of respondents. For responsibility over adverse agent outcomes, the most common answer was the chief information officer or chief technology officer—selected by just 17%. IBM characterized the responses as showing no clear consensus on accountability.

If an AI system causes significant harm, 20% said liability should be shared proportionally between the organization deploying it and its vendor. Another 19% wanted a regulatory framework they believe does not yet adequately exist, while 14% preferred vendor liability. These are respondents’ preferences, not findings about current legal requirements.

Controls inside agents—and across suppliers

For increasingly autonomous agents by 2027, executives identified controls they expect to need, rather than safeguards already in place:

• 33%: legal or contractual frameworks defining vendor liability for agent failures.
• 32%: defined thresholds for escalating decisions to a human.
• 30%: real-time monitoring and audit trails of agent decisions and actions.
• 29%: the ability to immediately halt agent activity across the enterprise.

Many already distinguish agents from other AI tools: 54% use separate governance frameworks for generative AI and agentic AI, while 38% use a common framework with extra controls for agents.

Supplier coverage remains another weakness. Some 54% acknowledged governance gaps covering AI used by vendors, technology partners and supply-chain participants. Only 21% continuously monitor third-party AI risk, and 13% apply independent assurance or certification requirements.