KPMG: UK firms pivot AI focus to governance and resilience

UK businesses have moved past the question of whether to adopt artificial intelligence and are now grappling with how to govern, secure and sustain it, according to KPMG's Q3 2026 Global AI Pulse survey. The quarterly poll of 2,131 senior leaders across 20 countries, including 101 in the UK, finds that formal management infrastructure, named executive ownership and cybersecurity investment are all expanding as AI embeds itself into core operations.

Senior accountability is a standout finding for the UK market. Sixty-four per cent of UK organisations place responsibility for AI-informed decisions at C-suite level or above, compared with 54% globally. Of those, 39% have a named executive in the role, while 25% place oversight with the CEO or executive committee directly. AI agent adoption is also climbing: 35% of UK organisations report significant deployment of AI agents, up from 30% in Q1 2026.

Governance maturity mirrors ROI maturity

The survey draws a sharp correlation between how formally an organisation manages AI and the returns it sees. Just 31% of organisations still experimenting with AI have formal management infrastructure in place; that figure rises to 58% among those scaling AI and reaches 86% among those reporting established return on investment. A similar gradient appears in cybersecurity: 36% of organisations at the experimentation stage rank cyber and data security among AI budget priorities, against 71% of those reporting established ROI.

Paul Henninger, Partner and Head of Technology and Data at KPMG in the UK, said: "Organisations generating the strongest returns from AI have moved beyond experimentation and treat it as an organisation-wide priority. Success increasingly depends on clear accountability, strong governance and the ability to coordinate AI across the business."

Model sovereignty is emerging as a distinct line item in AI strategy. Sixty-nine per cent of UK firms say they factor sovereignty considerations into AI decisions, covering where models, data and intellectual property are hosted and controlled. Among organisations reporting established ROI, 53% have an organisation-wide sovereignty strategy under regular review, suggesting the most mature adopters are actively managing provider dependency and continuity risk.

Value measurement remains the weak link

Despite broad cost monitoring, value assessment is underdeveloped. While 67% of organisations review AI costs at the approval stage and 58% track them in operation, only 13% consistently measure value against cost across the whole organisation. Among established-ROI organisations the figure rises to 48%, indicating that financial discipline is a marker of maturity rather than a universal practice.

That gap is significant in the current enterprise software market. AI vendors, from hyperscalers to niche application providers, are under growing pressure from buyers to demonstrate measurable business outcomes rather than capability benchmarks. CIOs and CFOs are increasingly co-signing AI budget decisions, and boards in regulated sectors such as financial services and critical infrastructure are asking for audit trails that link AI deployment to quantifiable value.

Regulatory read-across

The shift towards formal governance aligns with incoming obligations under the EU AI Act, whose high-risk system requirements and transparency provisions will affect UK firms with EU operations even after Brexit. Domestically, the UK's AI Safety Institute has signalled a focus on evaluation and accountability frameworks, and the FCA has issued guidance on model risk management that covers AI-driven decision-making in financial services. Organisations that build structured oversight now are better positioned to satisfy those requirements without reactive remediation.

KPMG's findings suggest the next competitive divide in enterprise AI will not be between adopters and non-adopters, but between organisations that have embedded governance into their operating model and those still treating it as a compliance afterthought.