UK firms confident on AI, but lack proof of control

IBM has published research on digital sovereignty among UK organisations, finding a gap between confidence in AI oversight and proof that governance works.

The UK ranked among the top three of seven markets surveyed, scoring 77 out of 100, ahead of the global average of 74.

The research assessed how well organisations retain control over critical AI, technology, operations and data, and how well they can prove that control when challenged. It surveyed 250 senior decision-makers in UK organisations with more than 500 employees as part of a wider study of 2,003 executives across seven countries.

IBM's findings suggest UK businesses have put controls in place across several areas but are less prepared to show those systems can withstand pressure. Only 32% of UK respondents met the study's highest standard for evidence that governance works, compared with 26% globally.

AI was the weakest area. UK organisations scored 70 out of 100 on AI control, behind data at 81, operations at 80 and technology at 79.

That weakness was reflected in responses on accountability. While 84% of UK leaders said they were confident they could demonstrate accountability for their AI systems, only 27% said they had done so through audit, regulatory review, assurance activity or operational testing.

Pressure points

The figures also show how often organisations have faced sovereignty-related disruptions. Some 93% of UK respondents said they had encountered at least one challenge in the past three years, spanning AI failures, cyber incidents, provider changes and government restrictions.

Among those affected, 83% said they had to provide formal evidence of control. Of that group, 34% provided evidence to an external party such as a regulator, auditor or customer, while 49% did so through an internal review involving the board, executives, internal audit, risk or compliance teams.

AI-related problems were the most frequently cited trigger. Four in 10 UK respondents, or 41%, said they had experienced an AI-related sovereignty issue in the past three years, ahead of cybersecurity incidents at 40%, significant provider changes at 38%, formal audit or regulatory events at 36%, data-access or transfer issues at 32% and government restrictions at 30%.

The study suggests testing may be one factor separating stronger performers from weaker ones. UK respondents were more likely than the global sample to say they regularly test their ability to demonstrate sovereignty, at 39% versus 33%.

That appears to have had some operational effect. Among UK respondents that faced a sovereignty challenge, 35% said they resolved their most difficult event without material disruption, compared with 30% globally.

Evidence gap

Even so, many respondents said producing evidence remained difficult. More than half, 53%, of UK respondents who had faced a challenge said manual or time-consuming evidence collection made it hard to respond.

Other barriers included fragmented evidence spread across teams and systems, cited by 47%, and untested controls, recovery plans or exit plans, also cited by 47%. Dependence on third parties for records was cited by 46%.

Leon Butler, Chief Executive of IBM UK and Ireland, said the issue for boards was shifting from having policies in place to proving they work when tested.

"For business leaders shaping their digital sovereignty strategies, the focus must be on stronger evidence," Butler said. "Real digital sovereignty means having the freedom to adapt, respond and change course without losing control. Organisations across the UK should focus on building sovereign-by-design strategies that embed openness, interoperability and flexibility from the outset. That way they can demonstrate resilience and accountability, even under pressure."

The findings come as UK businesses face rising scrutiny over how they govern data, software suppliers and AI systems. The study suggests digital sovereignty is increasingly being treated as a board-level issue rather than a narrow technology question, as organisations respond to demands from regulators, customers and investors for clearer evidence of control.

IBM said organisations that reached the top evidence standard generally had a complete audit trail of AI-supported decisions, routinely tested controls, independent reviews, and exit plans that had been tested or used in practice.

Debbie Lawrence, Group Head of Data Strategy and Management at LSEG, said the challenge was particularly clear in data governance linked to AI use.

"As organisations embed AI more deeply into their operations, data sovereignty must be more than a matter of confidence," Lawrence said. "Organisations need to be able to demonstrate where their data comes from, how it can be used, and what controls are in place. Trusted, well-governed data from established providers enables businesses to continue innovating securely and responsibly."