Three-quarters of the organizations surveyed by the BSI (British Standards Institution) report having experienced at least one artificial intelligence (AI) failure in the past year. Among those that experienced AI failures, 92% had more than one incident. Even so, 78% expect to increase their investment in AI.
The data is included in the report The Cost of AI Failure, published by BSI in October 2026. The research combines an economic study conducted by Alma Economics with a survey carried out by FocalData of 1,287 executives across nine markets and seven sectors. Adoption is advancing faster than the mechanisms created to address AI failures.
AI failures are already common. Governance is not yet
The report defines an AI failure as a situation in which the system makes an unexpected error, malfunctions, experiences a drop in performance, or produces a biased result. The definition covers situations as diverse as a hallucination in a document, an inappropriate response from a chatbot or a discriminatory automated decision.
Only 47% of organizations report having a process for managing AI incidents. Only 38% have a governance program, although this figure has risen compared to the previous year. Nearly half—49%—have a risk assessment approach, and 50% have clear processes for managing sensitive data during the training or use of AI tools.
BSI refers to this discrepancy as confidence-action gap: Leaders are confident in the potential of technology, but many organizations have not yet translated that confidence into accountability, usage guidelines, oversight mechanisms, and incident response procedures.
How Much Can an AI Failure Cost?
The economic study analyzed seven public cases across four categories: biased or discriminatory decisions, hallucinations, fabricated content, and failures of chatbots customer service issues and failures associated with AI agent systems capable of performing tasks with some degree of autonomy. Based on the observed financial consequences, the researchers estimated the potential degree of exposure in each relevant market.
Depending on the type of failure and the activity in question, annual exposure could range from approximately 0.1% to 3.6% of the revenue generated in the relevant market. In the model, the highest potential exposure is associated with the business use of AI agents. This is neither a loss forecast nor an average cost per company. The report itself emphasizes that these estimates are indicative and are based on a limited set of public cases with measurable impact.
Many failures go unreported, have no immediately visible financial consequences, or result primarily in operational and reputational costs that are difficult to quantify. The absence of these effects in the model does not make them any less relevant to those who manage reputation.
When a Technical Glitch Affects a Company's Reputation
An AI failure becomes a reputational issue when it affects a promise made to customers, employees, or partners. It could be a promise of confidentiality, equal treatment, accuracy in a recommendation, or human oversight in a decision. The issue then goes beyond simply what the system did and comes to include who authorized it, who monitored it, and how the organization responded.
The way an organization responds also sends a message. Acknowledging the incident, correcting the outcome, explaining the impact, and outlining the safeguards that have been put in place is different from issuing a generic assurance about “responsible AI.” Trust depends on the ability to show what has changed in the wake of the failure.
AI Governance: Four Responsibilities Before the Next Incident
First and foremost, responsibility must be assigned. For every significant use of AI, there must be a business-side point person in addition to the technical team. It is that person or role who must understand the objective, the data used, the system’s limitations, and the consequences of an error.
Next, it’s important to establish an incident management process. Who has the authority to suspend the tool? How is the impact assessed? Which customers or regulatory agencies need to be notified? Without having these answers in advance, the organization wastes time when the pressure mounts.
Communication should also be established before the incident occurs, with a phased update policy. The #PRExperts of the Month explains how to update the stakeholders without confusing prudence with silence or uncertainty with a lack of responsibility.
Finally, verification mechanisms are necessary. Independent testing, records of decisions, risk assessment, and the involvement of the legal, security, operations, and communications departments make governance transparent. Certification or alignment with standards such as the ISO/IEC 42001 It can support this process, but it does not replace internal responsibility.
AI will continue to make mistakes, and investment will continue to grow. The difference in reputation will lie in how each organization prevents, detects, explains, and corrects these errors.