Fifty-nine per cent of European IT and business professionals do not know how long it would take their organisation to halt an AI system during a security incident, according to advance findings from ISACA’s 2026 AI Pulse Poll. Only 21 per cent said they could do so within half an hour.
The survey, drawn from 681 digital trust professionals across Europe, surfaces a gap that runs deeper than response times. Fewer than half, 42 per cent, expressed confidence in their ability to investigate and explain a serious AI failure to leadership or regulators, and just 11 per cent were completely confident. A third of organisations do not require employees to disclose when AI has been used in work products. Twenty per cent of respondents could not identify who would be accountable if an AI system caused harm.
These numbers land at a pointed moment. The EU AI Act is moving into enforcement, with explicit requirements around explainability and accountability. The MI5 Director General warned Parliament earlier this year about AI systems capable of evading human oversight, prompting a House of Lords debate in January. The national-security conversation has a corporate mirror: organisations have adopted AI into core business processes without building the governance infrastructure to match.
The tools to govern AI responsibly already exist. Risk management, prevention controls, detection mechanisms, incident response and recovery strategies are the foundations of good cybersecurity practice, and they need to be applied to AI with the same rigour and urgency.
Dimitriadis added that closing the gap would require professionals with the expertise to evaluate AI risk across its full lifecycle and translate that into decisions that withstand board and regulatory scrutiny. ISACA’s full 2026 AI Pulse Poll is due for publication in May.
The finding that 59 per cent of organisations cannot say how quickly they could halt an AI system should concern every board in the country. We have spent years talking about responsible AI adoption; this research suggests many organisations skipped straight to adoption and left the responsible part for later. Later has arrived.
