New IBM survey data shows AI incidents are reaching boards across Europe, but most boards leave the governance framework exactly as they found it.
IBM published survey data on 14 October. Across 3,221 senior executives in eight European and Middle Eastern markets, 80% said an AI-related incident had reached their board or C-suite in the previous twelve months. Forty per cent changed a governance policy in response.
Sit with the second number. Four in five boards have now had a live AI failure put in front of them. Three in five of those boards looked at it and left the framework exactly as they found it.
Two caveats before the argument. The research is vendor-commissioned, and vendor-commissioned research tends to find problems the vendor sells into. Ireland was not in the sample, which covered the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE. The fieldwork ran 14–24 September, so it is current. And Irish organisations are running the same tool estate under the same regulation as the European firms surveyed, which makes the pattern worth taking seriously even without a local sample.
The escalation loop that does not close
Most AI governance advice still assumes the hard part is finding out. Build the monitoring, build the logging, build the escalation path, and the board will eventually hear about the problem. These figures say that part is largely working. Something went wrong, somebody wrote it up, and it travelled as far as the board. Then the loop stops.
What that looks like in practice is familiar to anyone who has sat through the meeting. A tool produced an output that was wrong in a way that mattered. The incident is presented as a one-off: a prompt problem, a user-training problem, a vendor problem that the vendor has since patched. Somebody says the word "reminder". The minute records that the committee noted the matter. Nobody revisits the policy that permitted the deployment in the first place, because the policy was written before anyone knew what this class of failure looked like.
An incident is the cheapest information a board will ever get about its own AI exposure. It arrives already paid for. A board that absorbs it as a noting item has converted a diagnostic into an anecdote.
Accountability that has never been priced
The same study reports that 98% of these organisations have formally assigned AI risk responsibility at board level. Only 26% have a dedicated board-level AI committee. And only 37% have a formal, board-reviewed quantification of the financial risk created by gaps in their AI governance.
So nearly every board has named an owner, and most of those owners have no number to own. That combination is unusual. No board would accept a credit exposure or an open currency position described only as somebody's responsibility, with the size of it left unstated.
For Irish organisations the number is not hypothetical. The AI Office of Ireland has been operating as the central coordinating authority since 2 August, alongside fifteen sector-specific competent authorities, with administrative fines running up to €35 million at the top of the scale. The fine is the smallest part of the exposure for most firms. The expensive part is the remediation: a system withdrawn from service mid-quarter, client files reviewed by hand, a regulator asking for records of human oversight that were never kept. That cost is estimable. Very few boards have estimated it.
The agentic problem is already live
Thirty-five per cent of the organisations surveyed are running agentic AI in production. Seventy-five per cent expect AI agents to be making autonomous decisions by 2027, and 37% say their governance is designed to scale to that.
One finding explains much of the gap: 54% manage generative AI and agentic AI as separate risk categories. In most organisations that separation is accidental rather than considered. The generative policy was written for a tool that produced text a human then read. The agent inherits that policy, and it holds credentials, calls systems and takes actions nobody reads before they land.
The Digital Omnibus pushed the high-risk obligations for standalone Annex III systems out to 2 December 2027, and the equivalent for AI embedded in regulated products to August 2028. That deferral created room to build properly. The IBM data suggests the room is not being used: 41% of EU executives in the sample said they were accelerating governance investment ahead of the new deadline, which leaves a clear majority who are not.
Four things to do with this
Make every AI incident leave the room with a decision. Noted is not a decision. Either the policy changes, or the board records in the minute why it does not. That one procedural change converts incidents into learning without any new framework.
Put a number on the governance gap. Pick the two or three AI systems closest to clients or to money, and cost the realistic failure: the service interruption, the manual rework, the client redress. A rough number that the board has seen beats a precise number nobody has produced.
Give agents their own risk class. Anything holding credentials and taking action without a human in the path needs a named owner, a tested kill switch and a log somebody actually reads. Tested, not documented.
Check the 2 December date if you have built anything customer-facing and generative. Generative systems placed on the market before 2 August have until 2 December 2026 to carry machine-readable marking of synthetic output under Article 50. That obligation was not deferred by the Omnibus.
The Acuity AI position
We diagnose before we prescribe, and an incident log is the best diagnostic material an organisation owns. The first thing we ask for in a board-level AI review is the last twelve months of AI incidents and near-misses, and the second is the record of what changed as a result. The distance between those two documents tells you more about an organisation's real AI maturity than any framework assessment will.
A board that has seen an AI failure and changed nothing is not badly governed by intent. It is usually missing one mechanism: somebody whose job is to turn the incident into a decision with a date on it. That is a small piece of plumbing, and it is cheaper to install than the second occurrence of the same failure.
We work with Irish boards and leadership teams on that assessment — what is running, what it can reach, what it has already got wrong, and what the organisation did about it. Vendor-neutral, evidence first.