UK boards need evidence behind AI governance confidence

Confidence in AI governance needs a demonstration

UK boards need to know whether their confidence in AI governance rests on evidence that controls work under pressure. In IBM’s research, 84% of UK leaders believed they could demonstrate accountability for their AI systems, while 27% reported having done so through an audit, regulatory review, assurance activity or operational testing. For leaders responsible for AI risk, the practical question is whether the organisation can produce that evidence when asked.

The gap gives boards a reason to examine what supports management’s confidence and which controls have been tested. Organisations that have yet to report a demonstration may still be able to provide one, so the findings do not establish that they would fail a test. They do show where boards need to ask questions.

The UK scores above average, with AI its weakest control area

To put that confidence in context, IBM assessed digital sovereignty: an organisation’s ability to retain control over critical AI, technology, operations and data, and to demonstrate that control when challenged. IBM published the findings under the heading “UK firms confident on AI, but lack proof of control”. Its UK sample comprised 250 senior decision-makers at employers with more than 500 employees, within a wider survey of 2,003 executives across seven countries. IBM also has a commercial interest in organisations investing in technology and governance services, which matters when considering its findings and recommendations.

Within that seven-market assessment, the UK placed in the top three, with an overall score of 77 out of 100 against a global average of 74. The concern about demonstrating control therefore arises in a market that performed comparatively well. But the overall result combines several areas of control, and AI scored below data, operations and technology:

AI’s lower score gives boards a specific area to examine. Stronger performance elsewhere cannot establish that AI oversight works, because each score measures a different part of organisational control. The practical test comes when an incident, review or external demand requires the organisation to show how that oversight works.

Evidence demands expose operational barriers

These demands were common among the organisations surveyed: IBM found that 93% of UK respondents had experienced at least one sovereignty-related challenge in the past three years. The events included AI failures, cyber incidents, changes involving providers and government restrictions. Formal audit or regulatory events and problems involving data access or transfers also featured, each potentially requiring an organisation to account for its controls.

IBM found that AI-related sovereignty issues were the most common category, affecting four in 10 UK respondents, or 41%, over that period. Cybersecurity incidents followed closely at 40%, with significant provider changes at 38%, formal audit or regulatory events at 36%, data-access or transfer issues at 32%, and government restrictions at 30%. AI therefore combined the lowest UK control score with the most frequently reported challenge category, although cyber incidents were almost as common.

Those challenges often brought a formal demand for evidence. Among respondents who had encountered a challenge, IBM found that 83% said they were required to supply formal evidence. Of that group, 34% supplied evidence externally, including to regulators, auditors or customers, while 49% did so through an internal review involving boards, executives, internal audit, risk or compliance teams. Either route required people to gather records and present them in a form others could examine.

Gathering those records was itself a barrier: among challenged UK respondents, 53% cited “manual or time-consuming” evidence collection. IBM’s combined description covers collection that was manual, time-consuming or both. So even with controls in place, an organisation may face substantial work to demonstrate how they operate.

That work becomes harder when records are spread across teams and systems, a barrier reported by 47% of challenged UK respondents in IBM’s survey. Individual teams may hold relevant evidence while the organisation struggles to assemble a coherent response. A board examining readiness therefore needs to understand how those records can be brought together and who is responsible.

Even assembled records can leave questions about whether the documented arrangements work. A separate 47% of challenged UK respondents in IBM’s survey cited controls, recovery plans or exit plans that had yet to be tested; exit plans set out how an organisation would leave a provider or existing arrangement. Written plans describe intended action, while exercises show how it works in practice. A challenge can expose uncertainty about both retrieving the records and carrying out the plans they describe.

Retrieval can also depend on organisations outside the business: IBM found that 46% of challenged respondents reported dependence on third parties for records as a barrier. The response may therefore require cooperation across company boundaries as well as coordination between internal teams. Boards examining readiness need to consider whether they can obtain the necessary information from providers and other parties when required.

Testing can examine readiness

The barriers involving untested plans make regular exercises relevant to an organisation’s ability to demonstrate control. IBM found that 39% of UK respondents regularly tested their ability to demonstrate sovereignty, compared with 33% globally. IBM suggests that testing may help explain differences between stronger and weaker performers, making it a practice to examine when assessing readiness.

A separate finding describes how respondents handled their most difficult event. Among UK respondents who had experienced a sovereignty challenge, IBM found that 35% said they resolved that event without material disruption, against 30% globally. The UK therefore reported both more regular testing and a higher rate of resolving its hardest challenges without material disruption.

But these country-level comparisons do not directly compare organisations that tested with those that did not, so they cannot establish that testing caused the difference in outcomes. Testing remains useful for answering a specific question: can the organisation produce evidence and carry out its controls under the conditions being tested? Boards can use exercises to investigate that question while keeping IBM’s suggested explanation separate from a measured operational benefit.

Boards need records and tested arrangements they can examine

To make that examination concrete, IBM described the practices associated with its highest standard for evidence of governance effectiveness. Organisations reaching that standard generally kept a complete history of AI-assisted decisions, tested their controls routinely, underwent independent review and had exercised their exit plans or put them into practice. IBM found that 32% of UK respondents met this standard, compared with 26% globally.

The standard combines records of decisions with evidence of action. A decision history lets reviewers examine how AI was used, while an exercised exit plan shows how an organisation can leave an existing arrangement. Routine testing and independent review offer further ways to check whether stated controls work as intended. Boards can use these characteristics to ask which claims management can already demonstrate and which still need examination.

This scrutiny is increasingly a board responsibility as regulators, customers and investors seek clearer evidence of control over data, software suppliers and AI systems, according to IBM’s findings. Leon Butler, Chief Executive of IBM UK and Ireland, argues that boards should focus on this evidence. “For business leaders shaping their digital sovereignty strategies, the focus must be on stronger evidence,” he said. His recommendation links technology and supplier decisions to the board’s ability to judge whether the organisation can retain control under pressure.

Butler also argues that the design of those arrangements affects the organisation’s freedom to change direction. “Real digital sovereignty means having the freedom to adapt, respond and change course without losing control. Organisations across the UK should focus on building sovereign-by-design strategies that embed openness, interoperability and flexibility from the outset. That way they can demonstrate resilience and accountability, even under pressure.” Here, sovereign-by-design means building control into the initial design, while interoperability means systems can work together; Butler presents both as ways to preserve the ability to adapt.

The ability to adapt also depends on the data an organisation uses, which brings a distinct commercial perspective. Debbie Lawrence, Group Head of Data Strategy and Management at LSEG, speaks from a business with an interest in demand for trusted data from established providers. “As organisations embed AI more deeply into their operations, data sovereignty must be more than a matter of confidence,” she said. Her concern centres on the data supporting AI decisions and the controls governing its use.

For that data, Lawrence identifies three things an organisation should be able to establish. “Organisations need to be able to demonstrate where their data comes from, how it can be used, and what controls are in place. Trusted, well-governed data from established providers enables businesses to continue innovating securely and responsibly.” Her recommendation gives boards and engineering teams specific questions to examine: the origin of the data, the uses permitted and the controls that apply.

Key takeaways for decision-makers

• Test confidence in AI accountability: In IBM’s survey, 84% of UK leaders believed they could demonstrate AI accountability, while 27% reported having done so. Boards need to establish which management claims are supported by audits, reviews or operational tests.
• Examine AI controls separately: AI scored 70 out of 100 in IBM’s UK assessment, below data, operations and technology. Boards assessing AI oversight need evidence specific to those systems, even where wider technology controls perform well.
• Make evidence retrieval operational: Among UK respondents who faced a sovereignty challenge, 53% reported manual or time-consuming evidence collection and 46% cited dependence on third parties for records. Risk and technology owners need clear responsibilities for assembling internal records and obtaining supplier evidence.
• Use exercises to assess readiness: Only 39% of UK respondents regularly tested their ability to demonstrate control. Board-sponsored exercises can check whether records are retrievable and controls work under defined conditions; the survey does not establish that testing caused better operational outcomes.
• Build a reviewable record of control: IBM’s highest evidence standard combined AI decision histories, routine testing, independent review and exercised exit plans. Boards can use these characteristics to identify gaps, while data owners establish data origins, permitted uses and applicable controls.