Share with your CISO
IBM’s EMEA AI governance study surveyed 3,221 senior executives across eight countries and found that 80% have escalated an AI-related incident to their board or C-suite in the past year, covering agent failures, data exposures, decision errors, and security breaches. Only 40% changed their governance policy in response. Meanwhile, 75% expect AI agents to operate with meaningful autonomy by 2027, yet only 37% say their governance is built to scale with that reality. The accountability picture is just as fractured: with no clear consensus on who owns adverse outcomes, the most commonly cited role was CIO or CTO, named by just 17% of respondents.
What this means for your business
The pattern this data fits is one that security and risk leaders know well from earlier technology waves: adoption laps governance, incidents accumulate, boards get involved, and then policy changes happen too slowly to prevent the next wave of incidents. What’s different with agentic AI, meaning AI systems that take sequences of actions and make decisions without human sign-off at each step, is that the incident surface is no longer bounded by what a human operator could have caught in review. If 56% of your EMEA peers are already pressing ahead with AI deployment within “agreed risk limits” while governance catches up, the question for any CISO is whether those risk limits were scoped for agents or for the narrower AI tools that preceded them.
The accountability vacuum revealed here is the more structurally dangerous finding. When only 17% of organizations point to any single role as responsible for adverse AI agent outcomes, and legal liability views are split three ways among deployer, vendor, and a regulatory framework that doesn’t yet exist, no one is actually holding the bag. IBM, whose consulting business sells directly into the governance gap this study describes, has an obvious incentive to paint the problem as large and urgent, but the specific numbers don’t require inflation to be alarming. Fifty-four percent of respondents acknowledge gaps in how their governance covers third-party AI systems, and only 21% continuously monitor third-party AI risk. For a CISO managing a supply chain of vendors who are themselves deploying agents, that’s not a gap, that’s a blind spot with a timer on it.
The budget question this reframes isn’t whether to invest in AI governance infrastructure, that argument was already won when the board started receiving incident reports. It’s whether the governance frameworks already in place were ever designed for systems that act, not just recommend. Only 37% of organizations have a board-reviewed financial quantification of their AI governance gaps. If yours isn’t one of them, the next board-level AI incident will arrive without a number attached to it, and that’s the moment when “we’re working on a framework” stops being an acceptable answer.
Concept deep-dive: Agentic AI
Agentic AI refers to AI systems that pursue multi-step goals autonomously, deciding what actions to take next without a human approving each individual step, much like delegating a task to a contractor who delivers results rather than asking permission at every turn. Standard AI tools respond to a prompt and stop. Agents plan, act, check results, and act again. That loop is what makes them powerful and what makes conventional governance frameworks, built around reviewing AI outputs before they have consequences, structurally insufficient for the risk they introduce.
Based on reporting from IBM Study: Eight in Ten EMEA Enterprises Escalate AI Incidents to Board or C-Suite as AI Agents Test Governance, originally published 2026-10-14 19:02:00.
