80% of EMEA Enterprises Escalate AI Incidents to the Board, IBM Finds

What happened

Why it matters

• ·Board escalation without formal escalation criteria creates legal and regulatory exposure. Under frameworks such as the EU AI Act (Regulation (EU) 2024/1689), organizations deploying high-risk AI systems must demonstrate documented oversight. A pattern of ad hoc board escalation, with no defined thresholds or ownership, will not satisfy that standard.
• ·Agentic AI creates a new category of incidents that most current escalation playbooks were not designed for. Autonomous agents can take consequential actions across multiple systems before anyone notices a problem, compressing the time available for human intervention and making post-incident accountability harder to establish.
• ·The study reveals an accountability ownership gap. When incidents reach the board without a named internal owner, remediation decisions default to senior leadership who may lack the operational context to act. Organizations without a designated AI governance function, clear ownership at the business unit level, and pre-defined escalation thresholds will struggle to respond consistently.

Governance controls affected

What to do now

• ☐Review your current AI incident escalation policy and confirm it defines specific thresholds, such as affected user count, financial exposure, or regulatory trigger, that automatically elevate an incident to C-suite or board level rather than leaving that call to individual managers.
• ☐Identify who is the named accountable owner for each AI system currently in production, including any AI agents that can act on data or external systems without per-step human approval, and confirm that owner is documented in writing.
• ☐Ask your legal and compliance team whether your incident response playbook covers agentic AI failures specifically, including scenarios where an AI agent takes a harmful action before any human is aware a problem has occurred.
• ☐Benchmark your escalation data against the IBM finding: if fewer than 80% of your material AI incidents have reached executive review in the past 12 months, investigate whether that reflects good governance or unreported problems.
• ☐Confirm that board-level AI risk reporting includes a standing item for agentic AI incidents, not only model performance issues, and that directors receive enough context to ask meaningful questions rather than simply ratifying management decisions.

What to watch next

The IBM findings add enterprise-level evidence to a growing body of research showing that governance structures are lagging behind AI deployment speed, particularly for agentic systems. Compliance teams should watch for regulatory guidance that formalizes board-level AI accountability requirements. Both the EU AI Act (Regulation (EU) 2024/1689) and the White House Artificial Intelligence Oversight Framework are moving in that direction. The ECB's recent requirement for banks to submit AI cyber action plans by October 31, 2026, is described in ECB Requires Bank AI Cyber Action Plans by October 31, 2026. It signals that sector regulators will increasingly treat AI incident governance as a supervisory matter, not a voluntary internal practice.