UK boards & CEOs split on cyber risk & AI governance

Eton Bridge Partners has published its Board & CEO Insights Report 2026, highlighting a widening gap between UK boards and Chief Executive Officers over risk and the pace of response.

The clearest divide is on cybersecurity. Among Non-Executive Directors, 38% ranked it among their top three risks, compared with 8% of Chief Executive Officers.

The findings also show disagreement over whether boards are addressing their main exposures. Almost three-quarters of Chairs said the board was dealing with most of its key risks, while fewer than a third of Chief Executive Officers agreed.

Chief Executive Officers were also far more likely than Chairs to say progress was too slow. They were around five times more likely than Chairs to say action was not keeping pace with the risks.

Risk split

The research surveyed UK Chairs, Non-Executive Directors and Chief Executive Officers across listed, private equity-backed and privately owned businesses. It found broad agreement that growth was the main priority, but less consensus on the threats that could derail it.

Just over half of respondents, 52%, said their organisation was focused on growth. There was little difference on that point between listed groups, private equity-backed businesses and privately owned companies.

Beyond growth, views were less consistent. Cybersecurity produced the widest gap between board and executive respondents, at a time when cyber resilience remains high on the agenda for many UK companies.

Olivia Sharp, Head of Board Practise at Eton Bridge Partners, said: "While Boards and CEOs share the same ambitions, our research reveals significant differences in how they perceive risk, capability and progress. These gaps matter because when Boards and executive teams disagree on the risks facing the business or the pace of action required, it raises questions about how aligned they really are.

"Cybersecurity is a clear example. Despite the current focus on AI, our research suggests NEDs are more alert to cyber risk than their executive counterparts. Understanding these differences is key to ensuring risks are properly prioritised, understood and managed at the highest level."

AI concerns

Artificial intelligence ranked differently from cyber risk. Only 9% of respondents named AI as the single biggest threat, but 52% said governing it was where the board was most exposed.

This suggests concern is less about AI as a standalone headline risk and more about whether boards have the oversight needed to manage it. Only 8% believed the board currently added meaningful value on AI.

The contrast points to a wider question for company boards. Many respondents appear to see AI as an area where accountability and judgement sit at board level, even if they do not yet rank it above more immediate operational and security risks.

The report also identified one issue where views were closely aligned across roles. Succession planning produced similar responses from Chairs, Chief Executive Officers and Non-Executive Directors.

On that question, 30% of respondents said over-reliance on the current Chief Executive Officer was the main barrier to effective succession planning. The three groups answered within only a few percentage points of each other.

Board tensions

The findings add to a broader debate over how closely aligned boards and management teams are when businesses face overlapping pressures. Strategy may be set around growth, but execution depends on shared priorities between directors responsible for oversight and executives responsible for delivery.

In this survey, the sharpest tensions were not about ambition itself, but about preparedness, speed and where the most important risks lie. Chairs were more likely to believe exposures were being addressed, while Chief Executive Officers were more sceptical about the pace of progress.

Non-Executive Directors stood out for the weight they placed on cybersecurity. That may reflect their oversight role, particularly where disruption can spread quickly across operations, customers and supply chains.

At the same time, the board's unease over AI governance suggests directors are alert to a different kind of problem. Even if AI is not yet seen as the leading standalone threat, many respondents appear unconvinced that boards are equipped to guide decision-making in that area.

Overall, the report paints a picture of organisations with a shared growth objective but different views on what could obstruct it and how quickly those obstacles should be tackled. One of its starkest findings is that only 8% believe the board currently adds meaningful value on AI.