UK businesses face AI governance gaps, IBM survey finds

Eight in ten UK executives surveyed for IBM said an AI-related incident reached their board or C-suite in the past year, but only 35% of those organisations reported changing governance policies or frameworks in response. Incidents included agent failures, data exposure, decision errors and security breaches. When deployment outpaces governance readiness, 61% report proceeding within agreed risk limits rather than pausing.

The findings reveal a readiness gap as businesses prepare for more autonomous systems. While 68% expect AI agents to have some level of decision-making autonomy by 2027, only 53% believe their governance structures can scale to manage that future. Executives identified human escalation thresholds, real-time monitoring, audit trails and contractual frameworks for vendor liability as necessary safeguards.

Although 97% have formally assigned responsibility for AI risk at board level, accountability for harmful outcomes remains unclear. The most frequently cited accountable role was the CIO or CTO, selected by 20% of respondents. Views also differed on whether legal liability should rest with vendors, be shared with deployers or require a new regulatory framework.

Supply-chain oversight remains another weakness: 46% acknowledged gaps in governance coverage of external AI systems, while only 19% continuously monitor third-party AI risk. Censuswide conducted the IBM-commissioned research, including 504 UK respondents at organisations with 1,000 or more employees.