Eight in ten executives surveyed say an AI-related incident – including an agent failure, data exposure, AI-driven decision error, or AI security breach – reached their board or C-suite in the past year. Yet fewer than half (40%) of those organizations cite a change to AI governance policy or framework in response.

When the pace of deploying AI outstrips governance and compliance frameworks readiness, rather than pause while governance adapts, the majority (56%) of executives surveyed report pressing ahead within agreed risk limits. Just a third delay deployment entirely until their governance is ready.

The survey, of more than 3,200 senior executives at organizations across eight countries in Europe and the Middle East, suggests governance policies will be tested further as AI agents take on more autonomous work. Thirty-five percent of respondents say they are running agentic AI in production today, yet three-quarters expect AI agents to have some level of autonomy towards decisions by 2027. Only 37% say their current governance system is designed to scale with agentic AI deployment.

Ana Paula Assis, IBM Senior Vice President and Chair, EMEA and APAC, said: “The AI debate has moved from adoption to governance and accountability. As organizations progress from AI assistants to autonomous agents, governance can no longer be treated as a compliance exercise. It has become a business requirement and value enabler.

The enterprises that can scale AI with accountability and trust will be postitioned to realize business value. That means governance must be built into how agents operate, with clear boundaries on what they can do, clear ownership when things go wrong, and controls that work in real-time.”

Accountability & liability gap

Nearly all executives (98%) surveyed have formally assigned responsibility for AI risk at board level, including 26% with a dedicated board-level AI committee. Yet the research found no clear consensus on accountability for adverse outcomes from AI agents. An organization’s CIO or CTO was the most frequently cited role with assigned responsibility for adverse outcomes from AI agents, selected by just 17% of all respondents.

Respondents’ views on legal liability when an AI system causes significant harm were also divided: 20% say it should be shared proportionally between deployer and vendor, 19% say there should be a regulatory framework that does not yet adequately exist, and 14% say it should sit with the AI vendor or technology provider.

To manage increasingly autonomous AI agents making decisions without human approval at each step by 2027, executives expect to need formal legal or contractual frameworks defining AI vendor liability for agent failures (33%), defined human escalation thresholds (32%), real-time monitoring and audit trails of agent decisions and actions (30%) and the ability to immediately halt agent activity across the enterprise (29%).

Other key findings include:

• Measurement of financial risk exposure less established than board ownership: More than half (54%) of surveyed executives govern generative AI tools and agentic AI systems as distinct risk categories with separate governance frameworks and a further 38% apply the same core framework, but with additional controls to agentic AI. Measuring financial exposure from gaps in AI governance is less advanced: only 37% have a formal, board-reviewed quantification of the financial risk created by gaps in their AI governance.
• Supply chain risk: 54% of all respondents acknowledge gaps or limitations in how their governance framework covers the AI systems and models used by key vendors, technology partners and supply chain participants. Only 21% continuously monitor third-party AI risk and 13% apply independent assurance or certification requirements.
• Regulation shapes the pace regionally: In the EU, 41% of surveyed executives are accelerating governance investment ahead of the EU AI Act's high-risk obligations in December 2027, and a further 35% are on track with structured compliance plans. In the UK, sector regulator expectations are the most cited driver of AI governance investment (27%), while in Saudi Arabia and the UAE, national AI strategy requirements lead (61%).

Study methodology

The research was conducted by Censuswide on behalf of IBM among 3,221 executive management respondents, including C-level, at organizations with 1,000 or more employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE. The data was collected between 14 and 24 September 2026.