What: A BCG Institute survey of 142 senior leaders at US and EU companies with over $1 billion in revenue finds that "accountable innovators", which combine transparency with executive accountability, post a 15% median AI value impact, against 7% to 10% for the other three archetypes.

Why it is important: Reported AI incidents rose to 445 in 2025 from 106 in 2022, and most recent public cases involved an agent taking a path nobody anticipated, with nobody watching, after review had been passed. BCG concludes that testing and build-phase controls alone are insufficient.

BCG's 2026 Applied AI Index of 1,330 leaders finds that companies scaling AI innovation alone see twice the ROI of low-innovation peers, and those that add governance see three times. A separate governance survey and 30 executive interviews isolate two levers behind the difference.

Transparency means an inventory of AI systems with named owners, visibility into agent actions and the ability to shut a system down. Accountability means documented executive ownership that extends to end users. Unapproved tools remain common: on average, 16% of employees use them, because sanctioned tools are too restrictive or employees are unaware of their options.

BCG sets out six practices: zero-trust use of AI outputs, role-specific training, executive accountability, named owners across the organisation, formal risk tiering, and automated controls. Organisations that record and codify AI decisions report more than 30% higher ROI than those that only record them. One organisation approved 80% of requests within hours after automating precedent-based decisions.

IADS Notes: BCG, September 2026 covers the same Applied AI Index survey and found that only 5% of companies have all six agent controls in place, while future-built companies put nearly three-quarters of their top priorities into people, organisation and processes. RH-ISAC, September 2026 found that only 3% of surveyed retail and hospitality organisations had no AI policy, yet unsanctioned use persisted because approvals moved too slowly. Harvard Business Review, October 2026 adds that restrictive rules can lead employees to downplay threats, with choice inside the guardrails and an explanation of the risk reducing the effect. BCG, June 2026 described how a single agentic deployment triggers privacy, cybersecurity and governance exposure at once, and called for monitoring of how agents access data.

How to create AI value by balancing innovation and risk