Four in five executives in a new IBM-commissioned survey said an AI-related incident had reached their board or senior leadership team during the previous year. Among those organizations, 40% reported changing their AI governance policy or framework in response.
The findings describe executives’ reports, rather than an independent audit of failures. Censuswide surveyed 3,221 executive-management respondents at organizations with at least 1,000 employees across six European countries, Saudi Arabia and the United Arab Emirates between September 14 and 24.
IBM’s announcement includes agent failures, data exposure, AI-driven decision errors and security breaches within its description of incidents. The 80% figure should not be read as the proportion of all businesses suffering a data breach.
Delegating work requires operational controls
AI agents are software systems that can carry out tasks through a sequence of steps, potentially using other tools. Their permissions determine which actions require a person’s approval and which can proceed automatically.
In the survey, 75% of respondents expected agents to have some decision-making autonomy by 2027, but only 37% said their governance was designed to scale with agent deployment.
Governance means the arrangements for approving systems, assigning responsibility, monitoring outcomes and handling problems. An incident reaching senior leaders shows that it was escalated; it does not reveal whether the organization resolved it effectively.
Nor does an unchanged policy necessarily mean no remedial action occurred. The survey summary does not establish what every affected organization did through training, software changes or existing controls.
Oversight has to extend beyond a policy document
The US National Institute of Standards and Technology’s AI risk management framework calls for documented responsibilities, continuing review and executive accountability. Its guidance also addresses third-party systems and contingency arrangements for higher-risk failures.
For an operating team, those recommendations translate into practical questions: who can authorize a system, who checks its actions, and who can stop it when results fall outside its intended use?
A hypothetical purchasing agent illustrates the difference. Giving software access to a supplier catalogue is a different decision from allowing it to place orders without approval. The second permission needs spending boundaries, records and a way to interrupt mistakes.
MBN’s earlier reporting on informal workplace AI adoption in Germany examines a separate problem: employees using tools before employers formally introduce them. A company cannot assess its full exposure by looking only at the systems its technology department has approved.
IBM sells AI technology and consulting services, giving it a commercial interest in this subject. Its survey offers evidence about the views and experiences of the large organizations sampled, rather than a representative incident rate for every company or a measured return on governance spending.
