54 incidents a year, and the person accountable does not control the system

IBM's 2026 Tech Leader Study is the most uncomfortable read of the year for anyone running IT, and it earns that with numbers rather than adjectives.

77 percent of tech leaders say AI adoption is already outpacing their governance capabilities. 66 percent of CIOs and CTOs are held accountable for systems they do not fully control. 70 percent say business teams deploy faster than IT can track. Only 11 percent believe they are ready for the agent scale expected within a year.

Then the consequences. Surveyed organizations averaged 54 AI agent incidents in the prior year, roughly one a week. Of those, 17 percent were high severity, 37 percent involved data exposure or a breach, and 17 percent triggered compliance issues.

One a week. And the person who answers for it often cannot see the whole system, because someone in marketing wired an agent to the CRM last quarter and nobody wrote it down.

Here is the part of the study that got less coverage and deserves more. Organizations with embedded controls deploy 16 times more agents than those relying on manual governance, and organizations with strong controls report 18 percent higher operating margins. The companies with the most rules run the most agents. Control turns out to be the mechanism of scale rather than a tax on it, for the same reason brakes are what let cars go fast.

With AI budgets projected to grow from 15 to 25 percent of IT spend by 2027, the choice compresses to this: controls now, at leisure, or controls later, during an incident review.

EU companies get a third pressure. That 17 percent of incidents triggering compliance issues lands differently when deployer duties, logging and human oversight become enforceable AI Act obligations on 2 December 2027. An unregistered agent is then not just a shadow-IT annoyance. It is an undocumented system in a regulated category.

Start with a list. Every AI system in use, who owns it, what it touches, who can stop it. Most companies cannot produce that list today. It fits on two pages.

We build that list and the documents behind it. klariq.eu.