75 percent expect AI autonomy by 2027 – only 37 percent have governance that can withstand it
Eight in ten large EMEA companies have experienced an AI-related incident at board or C-suite level in the past year, according to a new IBM survey. Yet only four in ten have changed their governance policies in response. The survey, published on October 14, 2026, paints a picture of organizations where AI risk has become a board-level issue on paper, while governance frameworks have not kept up — right before the high-risk obligations of the EU AI Act take effect in December 2027.
What the survey shows
IBM published the findings on October 14, 2026, based on a survey of 3,221 executives in eight countries across Europe and the Middle East, at organizations with 1,000 or more employees. The figures are reproduced here as reported by StockTitan, which likely republishes IBM's own press release; they have not been verified against IBM's primary document.
The core finding is the gap between experience and response: 80 percent of the executives surveyed say an AI-related incident has reached the board or C-suite in the past year, but only 40 percent have changed their AI governance policy or governance framework in response. The survey does not define what counts as an "AI-related incident," and it is not clear whether the 40 percent figure applies to all respondents or only to those that have experienced an incident — both caveats affect how the numbers should be read.
Agentic AI is running ahead of governance
The most striking tension in the material lies in the forward-looking scenarios for autonomous AI systems. 35 percent report that they already run agentic AI — systems that act autonomously — in production. 75 percent expect AI agents to have some degree of decision-making autonomy by 2027. But only 37 percent say their governance is designed to scale with agentic AI rollouts.
In other words: a majority see autonomous decision-making systems arriving within a couple of years, while a small minority believe their governance tools can withstand this kind of deployment. Since agentic AI can carry out multi-step tasks without a human in the loop, the number of decision points that must be governed effectively increases — which places greater demands on governance tools than classic, reactive AI systems do.
What companies do under pressure
The survey also asks what happens when deployment runs ahead of governance readiness. The answers are split: 56 percent continue the rollout within agreed risk limits, while 33 percent postpone the rollout until governance is in place. A minority of roughly one in ten falls outside these two categories according to the figures, but the source does not say what they do.
The distribution illustrates a common pattern in digital transformation: most organizations choose to deliver on the assumption that risk is managed in parallel, not sequentially. Whether the agreed risk limits actually work in practice, the survey does not say.
Responsibility on paper, rarely in practice
A third pattern is the distance between formal accountability and actual risk management. 98 percent have assigned AI risk responsibility at board level — a near-universal response suggesting that assigning accountability has become standard practice in large organizations. But only 37 percent have a formal, board-reviewed financial risk quantification of governance gaps, and 54 percent admit that their governance has coverage gaps for third-party AI — that is, AI functionality delivered via external vendors, models, or integrations.
The latter is particularly relevant at a time when many businesses build AI features on third-party models and APIs: accountability may sit internally, while the risk partly sits elsewhere.
The December 2027 deadline
The regulatory context puts a clock on the whole picture. Among the surveyed EU executives, 41 percent say they are accelerating governance investments ahead of the high-risk obligations of the EU AI Act, which take effect in December 2027. The survey's publication date falls less than 14 months before that deadline.
The AI Act's high-risk requirements include, among other things, demands for risk management, documentation, and human oversight for systems in the high-risk categories. The survey suggests that a significant minority of EU companies are now moving governance work forward in time for that reason — but it does not say what the remaining 59 percent are doing, or whether the investments actually change anything before the deadline.
What the numbers do not show
Several caveats are worth keeping in mind. First, all the figures here come from a single secondary source, a StockTitan republication that likely originates from IBM's own press release. The findings therefore cannot be considered independently verified, and IBM's own report is not available in the source material.
Second, the central term "AI-related incident" is undefined in the source. A broad definition could include anything from minor data errors to regulatory breaches, which makes the 80 percent figure difficult to interpret precisely.
Third, the relationship between the two key figures — 80 percent incidents and 40 percent policy changes — is unclear in the source text. If the 40 percent figure applies only to organizations that have experienced incidents, the response rate is somewhat better than if it applies to all. The source does not say which is the case.
Fourth, the source provides no country-level breakdown of the eight countries, nor a definition of which countries are included beyond that they are in Europe and the Middle East.
Finally, a conflict of interest: IBM itself sells AI governance tools and services. The survey is real as documented corporate research, but the framing of a "governance gap" is also commercially motivated, and should be read with that in mind.
Why it matters
Regardless of the caveats, the survey points to a concrete and measurable situation for large European and Middle Eastern organizations: AI risk has entered the boardroom via experience — eight in ten have had incidents at C-suite level — but governance tools, financial risk quantification, and coverage of third-party AI lag considerably behind. With agentic AI in increasing production use, a majority expecting autonomous decision-making by 2027, and an EU deadline 14 months away, organizations have a limited window to close the gap between what has happened and what has been built to handle it.