8 in 10 firms escalated an AI incident. Most changed no policy.

Eight in ten executives say an AI incident reached their board or C-suite in the past year, according to IBM's survey of 3,221 executives in eight EMEA countries, published 15 October 2026. Of those, 40% changed an AI governance policy or framework afterwards. The other 60% escalated the incident and changed no policy in response.

The figure worth attention is the gap between an incident and a changed policy, not the incident count.

Risk has an owner. An agent's outcome does not.

Ninety-eight percent of these companies have assigned AI risk at board level. But when asked who answers for harm caused by an AI agent, no single role was named by more than 17% of respondents.

A board can own a risk. It cannot answer for an agent at 3 a.m. Someone with a name has to, and that person needs to know which decisions the agent may take alone, which it must bring to a human, and what "stop" means. The survey does not say whether those three things are written down anywhere. The 17% figure is a reason to check.

Why most incidents changed nothing

Six in ten of the companies where an incident reached the top changed no policy afterwards. In many organizations an incident reaching the board is treated as a communication event. Someone explains what happened, someone commits to a review, the review produces a document.

If your AI policy lives in a binder or in committee minutes, you don't have one.

Changing a rule is harder because the rule has to be written in a form that runs. It names which agent, which action, which approval and which limit. That is work the business and IT do together, in the room with the people who run the process. It takes longer than a board paper. It is also the version of the change most likely to hold the next time.

Three questions for the next board meeting

1. When our last AI incident reached us, what rule changed, and where does that rule now run? If the answer is a document, the rule was described, not changed.
2. Who answers, by name, for each agent we run? One name per agent. A role shared by several people leaves nobody answering for it.
3. Of the decisions we expect agents to take by 2027, which have a written stop condition today? Three-quarters of your peers expect autonomy by then. Thirty-seven percent have governance built to scale with it.

The third of companies delaying agents until governance is ready have a reasonable instinct and the wrong sequence. Governance that is ready before any agent runs is governance written in the abstract. The version that holds is written one workflow at a time, with the team that runs it, and tested against what the agent actually does.

That is how we work with leadership teams, and it is how we run our own company: every agent we run answers to a written rule, including the one that wrote this post.