IBM (NYSE: IBM) found that UK enterprises are pushing AI into operations faster than their governance structures are maturing, creating a control gap as more organizations plan to give AI agents decision-making autonomy. The research gives IT leaders a measure of the governance work that may be required before agentic systems take on more consequential business tasks.
In a survey of 504 UK executives at organizations with at least 1,000 employees, 80% said an AI-related incident had reached their board or C-suite in the previous year. IBM said the incidents included agent failures, data exposure, AI-driven decision errors and AI security breaches. Only 35% of organizations that reported such an incident said they had changed an AI-governance policy or framework in response.
The findings arrive as organizations move from experimentation toward AI systems that can act within defined workflows. Sixty-eight percent of UK respondents expect AI agents to have some level of decision-making autonomy by 2027, but only 53% said their governance structures could scale to manage that future. That difference matters for enterprise IT because agent deployment shifts the control question from approving a model before use to monitoring how it behaves across data, tools, applications and business processes.
IBM’s research also showed that many organizations intend to continue deployment while controls catch up. Among organizations where AI implementation was moving faster than governance readiness, 61% said they were proceeding within agreed risk limits rather than pausing. Twenty-seven percent of UK respondents said they delayed deployment until controls were ready, compared with 33% across the broader EMEA sample.
Board-level ownership does not appear to settle the operational-accountability issue. Ninety-seven percent of surveyed UK executives said their organization had formally assigned responsibility for AI risk at board level, including 31% with a dedicated board AI committee. Yet only 20% selected the CIO or CTO as the accountable role for adverse outcomes from AI agents, the most frequently cited response in a field without a clear consensus.
The study also identifies a supplier-management issue for IT and security teams. Forty-six percent of respondents acknowledged gaps or limitations in how their governance framework covered AI systems and models used by key vendors, technology partners and supply-chain participants. Nineteen percent said they continuously monitored third-party AI risk, while 14% applied independent assurance or certification requirements.
Those figures suggest that organizations may need to extend familiar vendor-risk and change-control practices to AI services, model providers and the applications that call them. More than half of respondents, 64%, said they governed generative-AI tools and agentic-AI systems as separate risk categories with different frameworks; another 29% used the same core framework with additional agentic-AI controls. Only half had a formal, board-reviewed quantification of financial exposure created by governance gaps.
IBM commissioned Censuswide to survey 3,221 executive-management respondents in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE from Sept. 14 to 24. For enterprise teams, the practical implication is not that autonomy should be halted; it is that agent rollout needs controls for responsibility, third-party dependencies, incident response and financial risk before autonomous actions become routine. Legacy governance processes built around periodic approvals can struggle when AI systems draw on multiple vendors and act continuously within operational workflows.