In October, IBM published a survey of more than 3,000 senior executives in the UK, Europe and the Middle East. Eight in ten said an AI-related incident had reached their board or executive team in the past year. Only four in ten of those said it had led to any change in how AI is governed.
It is the second figure I would want a board to sit with.
Some caution is due. The survey was commissioned by a technology company and covered organisations with more than 1,000 staff. Most charities, colleges and housing associations are much smaller. I doubt the pattern is any different in a smaller organisation, though. There are simply fewer people whose job it is to notice.
Being told is not the same as overseeing
When something goes wrong, the board paper usually follows a familiar route: what happened, what was done, lessons learned. The board notes it and moves on. That is reasonable for a one-off. It is not enough when the cause is a technology the organisation is still adopting, because the next incident will come through the same gap.
An AI incident is rarely dramatic. It might be a chatbot giving someone wrong information, a member of staff pasting personal data into a free tool, or a summary in a board pack that nobody checked against the source. Each looks minor on its own. Together they show the board where its controls are thinner than it thought.
Most AI arrives through suppliers
The same survey found that more than half of organisations admit gaps in governing the AI their suppliers use, and only 13% apply independent assurance to it.
For a smaller organisation this is the bigger issue. Few build AI themselves. It arrives inside products they already pay for: the office software, the case management system, the finance package, the phone system. Often it arrives in an update rather than through a decision anyone took.
A point at which you look again
When Microsoft Copilot first became available, I was working with a government-owned organisation whose leaders were divided on it. Legal, cyber security and finance each had different concerns. They were not settled by debate in the abstract. Each function set the conditions for its own area before anything went live, and the leadership team approved a phased start with a point at which it would review what had happened.
That review point is what most AI adoption lacks. Without one, an incident is news. With one, it is evidence, and the board has somewhere to put it.
What a board might ask
What AI-related incidents or near misses have we had in the past year, and who decided they were minor?
After the last one, what changed: a policy, a control, some training, or nothing?
Which of our suppliers now use AI in services we rely on, and what have we agreed with them about it?
When will we next look at whether our approach to AI is working, and what would make us change it?
None of this needs an AI committee. Most of the organisations I would like to serve will never have one. It needs the board to treat an AI incident as information about its own oversight, not as a report to be noted.
Source: IBM, “Eight in ten EMEA enterprises escalate AI incidents to board or C-suite as AI agents test governance”, 14 October 2026.
