AI is already in the building – but in most industries, nobody owns it.

Our AI Industry Exposure Index maps ten UK industries against two measures: how many businesses within each industry use artificial intelligence, and how many organisations in each industry have a board member responsible for cyber security – to show one aspect of how well businesses are keeping an eye on AI activities. Although this is much broader than just having the responsibility sit with one person or department, it’s a step towards ensuring proper AI practices are held by a business. Only two sectors clear the national average on both, whilst one sector clears neither and has the thinnest senior accountability of any industry in Britain.

Key findings

• Only two of ten sectors (information and communication, and professional, scientific and technical) sit above the all-sector average on both AI adoption and board-level cyber ownership.
• Transport and storage has the weakest governance in the index at 17%: the only sector where fewer than one in five organisations puts cyber security at board level.
• Construction is the slowest adopter of AI by a wide margin at 13%, yet its governance sits at 24%, which is no better than the entertainment and service industry, which adopts at more than twice the rate.
• Health and social care shows the widest inversion in the index: 21% AI adoption against 38% board-level ownership.
• Nationally, of the businesses using, adopting or considering AI, just 24% have any cyber security practices in place to manage the risks it brings.

According to the DSIT Cyber Security Breaches Survey 2025/2026, 31% of UK businesses are using AI, adopting it, or actively considering it. Of that group, 24% report having cyber security practices or processes in place to manage the risks from using it, meaning three in four are proceeding without any.

Their survey also uncovered that 43% of UK businesses identified a cyber breach or attack in the last twelve months, roughly 612,000 businesses, and yet only 25% had a formal incident response plan. Those numbers together don’t describe businesses braced for some new category of threat; they describe businesses already being breached, mostly without a plan for it – and now adding a fast-moving, data-hungry layer of technology on top.

Two industries we analysed are governing AI, but eight are behind.

WHO IS ACTUALLY READY FOR AI?

UK sectors mapped by Al adoption against board-level ownership of cyber security.
Quadrant boundaries are set at the all-sector average (29.2% adoption, 31% governance).

The information and communication industry sits alone at the top of the index, with 58.3% AI adoption and 51% board-level cyber ownership. It is the only sector where a majority of organisations do either. The professional, scientific and technical services industry follows at 45.8% and 41%.

The remaining eight sectors are stuck in a band between 13% and 27.3% adoption, and not one of them reaches the average 29.2%. And when you dig into it, that average is not a midpoint; it’s a number just two sectors are dragging up – worth remembering the next time “a third of UK businesses now use AI” is quoted as a national statistic. For construction, transport, retail and hospitality, it’s roughly double them.

Three industries worth a closer look

AI ADOPTION VS CYBER GOVERNANCE, BY UK INDUSTRY

Ten UK sectors, ranked by the share of businesses using artificial intelligence.

1. Construction: slowest does not mean safest. At 13% adoption, construction is barely half the rate of the next-lowest sector, and less than a quarter of information and communication. A sector that has largely stayed out of AI might be expected to carry less risk; its governance figure of 24% says otherwise – it’s identical to entertainment and service, which adopts AI at more than twice the rate. Slow adoption has bought construction nothing. And when AI does arrive, through a design platform or a subcontractor or a plant-hire system, it will arrive into a sector with no more senior oversight than the fast movers.
2. Transport and storage: the least accountable sector in the index. At 17% board-level ownership, transport and storage is last on governance, with an adoption rate of 19.4%. This is the sector that operates the warehouses and the fleets, and is also one of the most disrupted targets in cyber crime. It might not be attacked often, but it has very little room to absorb an attack when one lands, because taking a distribution centre offline costs money by the hour.
   The low adoption rate might look like breathing space, but it isn’t. Low usage is not the same as safe usage, and transport and storage has the lowest adoption in the index: just 1.5% of its AI users are running more than one use case, against 48% in information and communication. The numbers suggest that not a lot has been embedded yet, which is precisely why the governance gap matters. The adoption curve here has not started climbing, and when it does, under the margin pressure that drives route optimisation, demand forecasting and warehouse automation, it will climb into an organisation where almost nobody senior owns or monitors the consequences.
3. Health and social care: governance without the adoption. Health and social care runs the pattern in reverse: 21% adoption against 38% board-level ownership, the third-highest governance figure in the index and seventeen points clear of its own AI use. Cyber security reached the board in this sector for reasons that have nothing to do with AI – patient records, regulators, and a long history of being targeted. Administration and real estate (27.3% and 36%) and manufacturing (21.6% and 33%) show the same shape: whatever these sectors do with AI next, they will do it with someone accountable at the top.

The risk is silence, not speed

The instinct is to worry about the industries moving fastest, but our index doesn’t actually support this. Adoption and governance appear to rise together within the industries we’ve analysed, which means the sectors that have not started adopting have mostly not started governing either – and they represent a large chunk of the British economy.

The worry is, AI doesn’t wait for a board to be ready for it, and it rarely arrives by board decision at all. It’s embedded into the business through individual employees, and through features switched on inside software the business already pays for, which means it’s in use long before anyone senior could report it as policy. So actually, the sectors at the bottom of this index are not sectors without AI; they are sectors where the governance of AI has not yet been taken fully into consideration.

What ungoverned AI actually costs

The price of getting this wrong is now measurable. According to IBM, as of February 2026, one in four malicious breaches worldwide were AI-enabled (a 56% increase on 2025), and those breaches cost an average of $6 million, against a global average of $4.99 million. IBM also reported that, in the UK, 22% of organisations reported experiencing AI-generated attacks, with deepfake impersonation being the most common type at 45%, ahead of AI-enabled malware and phishing campaigns, and the average UK breach cost £3.13 million.

That’s looking at AI used against businesses, but the more revealing numbers are about AI usage inside businesses. 20% of organisations reported a breach that targeted their own AI models or applications, up from 13% in 2025, according to IBM’s latest study. In their 2025 version of the study, of the organisations breached this way, 97% said they had no AI access controls in place, and 63% of breached organisations either had no AI governance policy at all, or were still writing one. One in five reported a breach caused by shadow AI (tools brought into the business without approval), and yet only 37% had any policy for managing AI or detecting it – heavy usage of which added an average of $670,000 to the cost of a breach.

None of these reported attacks required a sophisticated attacker, but they did exploit a lack of regulation. Without regulation, tasks which seem simple and harmless can put key business data in harm’s way; if someone in the finance team pastes a customer list into a free AI chatbot to reformat it, that data is now held by a company nobody has assessed. A manager might sign up for an AI notetaker and let it join client calls, and the recordings and transcripts of those conversations now sit with a third party the business has no contract with. Someone in HR could upload a staff spreadsheet to build a summary, and an unregulated tool now has access to payroll and personal details of employees.

These scenarios are not malicious or intentionally harmful; they’re just the result of someone trying to do their job faster. Ultimately, ungoverned AI does not usually get a business hacked alone, but it loses the business control of its data – and you can’t fix, report or contain a problem nobody owns or knows about.

That’s what board-level ownership is really measuring: whether anyone can tell you which AI tools are in use, what data they touch, and who approved them. Without an owner, there’s no inventory, no approval route, no off-switch, and a lot of risk.