Escalated, not changed
By Dino Nokic · OCT 2026 · 4 MIN READIBM put out a study this week that every operator should read twice. Censuswide surveyed 3,221 executives at companies with more than a thousand employees, across eight countries in Europe and the Middle East, in late September. 80% said an AI-related incident reached their board or C-suite in the past year.
That's not the number that stopped me. This one is: of those organizations, only 40% changed their AI governance policy or framework in response.
So in most companies, something went wrong badly enough to climb all the way to the top floor, and the rules underneath it stayed exactly the same.
Reported is not the same as handled
Anybody who has run a dispatch floor knows this pattern. A load goes sideways. It gets escalated. Everyone up the chain hears about it, a few people are unhappy, the customer gets a call. Then Monday comes, and the process that let it happen is still the process. Nobody fixed the step. They just made the noise travel further.
An escalation is a signal, not a repair. If the incident goes up and nothing comes back down to the place where it started, you didn't handle it. You reported it.
The board has the title. The floor has the problem.
Here's the part that looks good on paper. In the same study, 98% have formally assigned board-level responsibility for AI risk. Almost everyone has a name at the top.
Now look at what they say they still need by 2027: defined human escalation thresholds (32%), real-time monitoring and audit trails (30%), and the ability to halt agent activity across the company (29%). Those aren't board items. Those are floor items. When does the system stop and hand it to a person? Who sees what it did? Who can pull the plug? Most companies haven't written those down yet.
And the pressure is building. 35% already run agentic AI in production, 75% expect agents to have some decision-making autonomy by 2027, and only 37% say their governance is designed to scale with that. When deployment outruns governance, 56% keep deploying within "agreed risk limits." Only a third wait.
My contrarian bit
More governance at the top won't fix this. Another committee, another policy deck, another sign-off. The board already owns it. What's missing is the plain operating rule at the point where the work happens: this kind of output goes out on its own, that kind stops and waits for a named person, and anyone on the floor can hit stop.
That's a human gate. It isn't a philosophy. It's three lines on a page, written before you switch the thing on, and rewritten every time something gets past it.
What to do with the next incident
Next time an AI-related problem reaches you, ask one question before it goes any higher: which step let it through, and what changes at that step tomorrow? Write the answer down. Change the threshold, the review, or the owner. Then measure whether the same kind of problem shows up again. If you can't answer that question, it's not ready to escalate. It's ready to be mapped.
If an incident climbs to the board and nothing changes on the floor, you didn't govern it. You just told more people about it.