Eight in ten EMEA companies sent an AI incident to the board. Fewer than half changed anything.
IBM's survey, published on October 14, 2026, put a number on the quiet failure mode of enterprise AI: escalation without correction. In the same fortnight, the Financial Stability Board and the UK's data protection regulator wrote down what governance is supposed to look like.
A survey of giants, read from a smaller chair
On October 14, 2026, IBM published research covering 3,221 executives at organisations with 1,000 or more employees across the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE (fielded by Censuswide, September 14 to 24). A 60-person ADGM corporate services provider is nowhere in that sample. Read it anyway, because those giants are your clients. What their boards decide this year becomes your vendor questionnaire next year.
Escalate, then move on
The headline: 80% of surveyed executives in Europe and the Middle East said an AI-related incident reached their board or C-suite in the past year. IBM counts agent failures, data exposures, AI-driven decision errors and AI security breaches as incidents. Only 40% cited a change to their AI governance policy or framework in response. When deployment outruns governance, 56% press ahead within agreed risk limits while the rules catch up. A third delay deployment.
Ownership is messier than the reporting lines. Ninety-eight percent have formally assigned AI risk responsibility at board level, 26% run a dedicated committee. But when an agent causes an adverse outcome, the most-cited owner is the CIO or CTO, at just 17%. Only 37% have a formal, board-reviewed quantification of the financial risk from governance gaps. On liability for serious AI harm there is no majority anywhere: 20% share it between deployer and vendor, 19% want a regulatory framework that doesn't exist yet, 14% say it sits with the vendor.
I don't think this is bad faith. Fixing a governance gap needs a named owner, a budget line and a number to argue with, and most of these firms have none of the three. The incident gets heard. Nothing downstream changes.
Richard Nevinson of the Information Commission, on agents that bypassed their safeguards in testing: "the fact AI agents act with autonomy is not an excuse for poor compliance."
What regulators wrote down in the same fortnight
On October 8, 2026, the UK's Information Commission confirmed enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute into agentic AI testing and deployment. Per the regulator's own statement, in some cases agents reportedly "bypassed protections, used unauthorised communication channels and accessed external systems such as Hugging Face." The ICO also opened a six-week call for evidence on agentic AI.
Seven days later, the Financial Stability Board finalised 12 sound practices for AI adoption on October 15, 2026, addressed to the boards and senior management of financial institutions. Three read like direct answers to the gap IBM measured: fold AI risk into the existing risk framework and document AI use (practice iii), maintain human oversight (practice x), manage third-party AI dependencies (practice xii).
That last one lands in DIFC and ADGM. These are not binding rules, but board-level expectations travel down the supply chain anyway. If your 40-person practice drafts board packs with a chatbot, you are one of your client's third-party AI dependencies in exactly the sense practice xii means. The questions will not be labelled "AI questions". They arrive inside the annual vendor due-diligence form.
The 2027 spec, written by the buyers themselves
Executives listed what they will need once agents decide without sign-off, and IBM got a ranked answer: contractual frameworks defining vendor liability (33%), human escalation thresholds (32%), real-time monitoring and audit trails of agent decisions (30%), the ability to halt agent activity enterprise-wide (29%). Same dataset: 35% already run agentic AI in production, 75% expect agent autonomy by 2027, and 37% have governance designed to scale to it. Fifty-four percent admit governance gaps covering the AI used by key vendors. Audit trails and thresholds top that list because without them, the 80% keep escalating and the 40% keep not changing.
What a 60-person firm can actually answer
You don't need a governance suite to satisfy a questionnaire like that. You need one place, in front of whatever models your people use, that masks personal and client data before it reaches a vendor, keeps a tamper-evident log of what was asked and returned, meters spend, and can be switched off in an afternoon. It is a gateway, not a platform, and a smaller project than the word "governance" implies. It is also what LLM Fusion is, which is why this survey made uncomfortable reading around here.
Why the Gulf pressure runs on its own clock
One regional cut explains why this matters in Dubai differently than in Brussels. In the UK, sector regulator expectations are the most cited driver of AI governance investment, at 27%. In Saudi Arabia and the UAE, national AI strategy requirements lead, at 61%. The EU cohort moves on a date: 41% are accelerating governance investment ahead of the EU AI Act's high-risk obligations in December 2027. That deadline is already in client procurement calendars. The ICO's evidence call closes on November 20, 2026. Deployers can still write in.