Summary

• IBM surveyed 504 UK executives at organisations with at least 1,000 employees, as part of an eight-country study conducted in September 2026.
• Eighty per cent reported an AI-related incident reaching their board or C-suite; 35% of that group reported subsequent changes to governance policies or frameworks.
• Ninety-seven per cent reported assigning AI risk responsibility at board level, but only 19% said they continuously monitored third-party AI risk.

Artificial intelligence incidents are reaching senior management at many large British organisations, but formal responsibility for AI risk has not consistently translated into stronger controls, according to new research from IBM.

Eight in ten UK executives surveyed said an AI-related incident had reached their board or C-suite during the previous year. Among those reporting incidents, only 35% said their organisation had subsequently changed its AI governance policies or frameworks.

The findings come from a study conducted for IBM by Censuswide between 14 and 24 September 2026. It included 504 executives working at UK organisations employing at least 1,000 people, forming part of an eight-country survey of 3,221 senior management respondents.

IBM’s announcement, dated to mid-October, identifies incidents involving failures of AI agents, exposure of data, errors in AI-supported decisions and security problems. These categories describe the experiences reported by respondents; the research does not establish that every incident was independently verified or involved the same level of financial or operational harm.

Responsibility has reached the boardroom

Most respondents said their organisation had assigned responsibility for AI risk at a senior level. According to IBM, 97% reported formal board-level ownership, including 31% who said their organisation had established a dedicated board committee for AI.

Those figures indicate that oversight structures have become common among the large organisations represented in the survey. They do not, however, establish whether board members possess enough information to assess how individual systems behave or what action should follow when a problem occurs.

The division of responsibilities becomes more complicated as AI applications move beyond generating information towards performing tasks inside operational systems. Such software can interact with customer records, business applications, development tools and other services, potentially affecting several departments within the same workflow.

Asked who should be accountable for an adverse outcome involving an AI agent, executives did not agree on a single role. The CIO or CTO was the most frequently identified individual responsibility, but was selected by only 20% of respondents.

The uncertainty extended to legal liability. Twenty per cent favoured proportionate responsibility shared between the organisation deploying an AI system and its supplier, while other respondents selected alternative approaches involving vendors or regulatory frameworks.

These views reflect executives’ preferences and understanding of responsibility. They should not be confused with definitive statements of UK law, where liability may depend on the relevant legislation, contractual arrangements and circumstances of an incident.

Agents create new operational exposures

IBM found that 68% of UK respondents expected AI agents to have some autonomy over decisions by 2027. Only 53% believed their organisation’s governance arrangements could expand sufficiently to manage that development.

The gap between those responses is significant because autonomous agents may perform connected actions rather than submit each individual decision for approval. Their operating permissions and ability to use external tools can determine whether an error remains confined to an output or affects underlying business systems.

An inaccurate draft can often be corrected before use, whereas an agent authorised to alter records, interact with customers or initiate an operational transaction may produce consequences before a person reviews its actions.

Governance therefore requires organisations to consider not only what an AI model can produce but what its connected software is permitted to do. Access controls, monitoring, approval thresholds and the ability to halt activity are relevant to managing that distinction.

When asked which arrangements would be needed for more autonomous AI, 37% of UK respondents identified defined human escalation thresholds, 33% selected real-time monitoring and audit trails, and 27% highlighted the ability to stop agent activity across the enterprise.

Another 32% identified legal or contractual frameworks defining suppliers’ liability for failures. These responses concern anticipated governance needs, rather than controls that the same proportion of businesses had already deployed.

IBM also reported that 64% of UK executives governed generative AI tools and agentic systems as distinct risk categories, while another 29% used common frameworks with additional controls for agents.

The results indicate awareness that different applications can require different safeguards. Whether the frameworks are effective depends on their implementation and on organisations’ ability to identify the systems operating within their technology environments.

Financial exposure remains difficult to quantify

Only half the UK respondents said their organisation had formally assessed the financial exposure associated with gaps in AI governance and submitted the assessment for board review.

That contrasts with the much higher proportion reporting formal board responsibility. An organisation may recognise AI as a corporate risk without having evaluated the cost of a failure affecting a particular workflow or supplier relationship.

Financial exposure can be difficult to assess when AI functionality is incorporated into existing software. A disrupted service may affect customers, operations or confidential information without being recorded internally as a separate AI-related cost.

Accurate assessment depends on knowing where systems are deployed, which information they can access and what operational activities could be affected if their performance deteriorates or a connected service becomes unavailable.

IBM’s survey found that 61% of UK respondents reported continuing deployment within agreed risk limits when adoption advanced faster than governance readiness. Another 27% said their organisation delayed deployment until the necessary controls were in place, compared with 33% of respondents across the broader EMEA group.

These answers do not establish that proceeding with deployment necessarily resulted in more incidents. They show different approaches to managing uncertainty while new applications are introduced.

Where organisations choose to continue, the effectiveness of their risk limits depends on their ability to identify failures and intervene before problems spread.

Suppliers introduce another blind spot

Enterprise AI is often obtained through external technology providers, including cloud platforms, specialist applications and existing software products that acquire new capabilities through updates.

IBM found that 46% of UK respondents acknowledged gaps or limitations in the coverage of AI systems supplied by important vendors, partners and other organisations within their supply chains.

Only 19% reported continuously monitoring third-party AI risk, while 14% said they required independent assurance or certification.

These figures do not demonstrate that particular suppliers are insecure. They indicate that many respondents lacked some combination of visibility, oversight or independent assurance relating to AI services supplied by other organisations.

Monitoring becomes more demanding when AI functionality is introduced inside existing contracts. A product initially purchased for a conventional business task may subsequently include automated capabilities with different permissions, data flows and potential operational consequences.

Previous Techopia coverage of enterprise AI implementation has examined the work required to connect new systems with established technology and business processes. Supplier governance adds another requirement because organisations must understand changes made to technology they do not operate directly.

The survey measures executive experience

The findings are based on responses from senior executives at larger organisations, not an independently audited register of AI incidents. Businesses employing fewer than 1,000 people were outside the disclosed sample, so the UK results cannot be generalised to every company.

The study also does not establish whether particular incidents were severe, how organisations classified them or whether the reported governance changes were sufficient to address the underlying problems.

Nevertheless, the contrast between formal accountability and continuing weaknesses in monitoring, financial assessment and incident response provides a concrete account of the difficulties executives say they face.

As AI gains operational authority, governance will depend increasingly on what organisations know about the systems they use, how effectively they supervise connected actions and whether senior management receives information that enables decisions before failures become larger business problems.