36% of Organizations Report Material AI Incidents, EY Survey Finds

What happened

Why it matters

• ·A 36% material incident rate from a recognized audit and advisory firm gives regulators and plaintiffs a credible industry baseline. Organizations without documented incident management programs face heightened exposure when their own incidents surface.
• ·The EY finding directly reinforces the pattern documented in reports like the Credo AI survey of 371 leaders: governance maturity separates organizations that catch failures early from those that discover them through harm. Compliance teams that cannot demonstrate monitoring and oversight controls are now operating below an emerging industry standard of care.
• ·Operational disruption and financial damage as named incident categories mean AI failures are reaching materiality thresholds that trigger board reporting, disclosure obligations, and potentially SEC or insurance scrutiny. Boards without visibility into the AI incident inventory are now carrying undisclosed risk.

Governance controls affected

What to do now

• ☐Audit whether your organization has a formal AI incident classification and response playbook that covers data loss, financial harm, and operational disruption as named categories.
• ☐Map every deployed autonomous or semi-autonomous AI system against your existing incident management program and identify which systems are not covered.
• ☐Confirm that board or senior risk committee reporting includes an AI incident register, not just aggregate performance metrics.
• ☐Verify that human approval gates exist for high-stakes AI decisions and that those gates are documented and tested, not assumed.
• ☐Brief your general counsel and CISO on the EY survey as context for any regulatory inquiry or litigation discovery that references industry norms around AI governance.

What to watch next

Regulators and enforcement bodies increasingly cite industry-wide survey data when establishing reasonable care standards. As this EY finding circulates, expect it to appear in guidance documents, supervisory letters, and litigation filings as evidence that material AI incidents are a known and foreseeable category of harm. Teams should monitor whether the NIST Artificial Intelligence Risk Management Framework Playbook or sector-specific regulators update their incident management guidance in response to accumulating survey evidence. The pattern of deployment outpacing oversight is also the dominant theme in recent agentic AI security research, meaning the risk is likely to grow before governance programs catch up.