IBM: 80% of UK Firms Hit by AI Incidents, Yet Most Won't Change Governance

What is the AI governance gap and why is it growing?

The AI governance gap is the widening distance between how quickly businesses deploy AI and how slowly they update the rules that control it. IBM's survey shows 80% of EMEA leaders saw an AI incident reach the board, but only 40% plan to change governance.

IBM surveyed over 3,000 business leaders across Europe, the Middle East and Africa. Four in five said an AI-related incident — an agent failure, data exposure, AI-driven decision error or security breach — had reached their board or C-suite in the past year.

Despite that, fewer than half of those organisations said they would change their AI governance policy or frameworks in response. The result is a gap between awareness and action that is opening up in businesses of all sizes.

The pressure is rising because AI is moving from assistant to actor. Three-quarters of respondents expect AI agents to have some level of decision-making autonomy by 2027, yet only 37% believe their governance is designed to scale with agentic AI deployment.

• 80%: leaders who saw an AI incident reach the board in the past year
• 40%: organisations that will change AI governance in response
• 75%: leaders expecting autonomous AI agents by 2027
• 37%: leaders who believe their governance can scale with agentic AI

Who should be liable when an AI agent makes a mistake?

Business leaders are split on who should carry legal liability when an AI agent fails. IBM's survey shows the most common safeguard is contractual vendor liability at 33%, followed by human escalation thresholds at 32% and real-time monitoring at 30%.

Almost every executive surveyed (98%) has formally assigned responsibility for AI risk at board level, including 26% with a dedicated board-level AI committee. Awareness is clearly present, but accountability is not settled.

When asked what they are building to cover AI agent failures, leaders named formal legal or contractual frameworks defining vendor liability (33%), defined human escalation thresholds (32%), real-time monitoring and audit trails (30%), and the ability to immediately halt agent activity across the enterprise (29%).

Those numbers are low across the board. Fewer than a third of organisations have any single control in place, which means most AI agents currently operate without a clear liability chain or a reliable kill switch. The lack of a kill switch is a critical risk, as seen when an AI agent wiped an entire Swedish TV season.

1. Define contractual liability for AI vendor failures
2. Set human escalation thresholds for agent decisions
3. Deploy real-time monitoring and audit trails
4. Build an immediate enterprise-wide halt capability

Why is AI governance now a business requirement, not a compliance exercise?

IBM argues governance has become a value enabler because enterprises that scale AI with accountability and trust will realise the greatest business value. Governance must be built into how agents operate, with clear boundaries, clear ownership and real-time controls.

Ana Paula Assis, IBM Senior Vice President and Chair for EMEA and APAC, said the AI debate has moved from adoption to governance and accountability. She added that governance can no longer be treated as a compliance exercise.

Assis said enterprises that scale AI with accountability and trust will realise the greatest business value. That requires clear boundaries on what agents can do, clear ownership when things go wrong, and controls that work in real time.

The survey suggests most organisations have the first layer — board-level ownership — but not the operational layers that make governance real. Without those, an AI incident that reaches the board is likely to repeat.

What should UK businesses do before deploying autonomous AI agents?

UK businesses should treat AI agent governance as a prerequisite, not an afterthought. IBM's data suggests starting with a board-level AI committee, contractual liability terms, escalation thresholds, audit trails and a tested halt capability before agents get decision-making autonomy.

The first step is to confirm who owns AI risk at board level. IBM found 98% of organisations have done this, so most UK firms already have a starting point. The harder work is turning that ownership into enforceable controls.

The second step is to write liability into vendor contracts before agents go live. Only a third of leaders have done this, which leaves businesses exposed when an agent makes a costly or harmful decision.

The third step is to test the kill switch. Real-time monitoring, audit trails and an enterprise-wide halt capability are the minimum controls for any agent with autonomy. IBM's findings suggest most UK businesses are not there yet.

1. Confirm board-level ownership of AI risk
2. Add vendor liability clauses to AI contracts
3. Set human escalation thresholds for agent decisions
4. Turn on real-time monitoring and audit trails
5. Test the enterprise-wide halt capability

Bottom line

IBM's survey shows UK and EMEA businesses are enthusiastic about AI but dangerously split on who owns the risk. With 80% seeing incidents reach the board and only 40% changing governance, the oversight gap is real. The next step for UK leaders is to turn board-level ownership into tested controls — liability clauses, escalation thresholds, audit trails and a working kill switch — before autonomous agents arrive in 2027.