Study Reveals AI Governance Gap Across UAE Enterprises as Adoption Outpaces Security Frameworks
Rapid enterprise artificial intelligence adoption across the United Arab Emirates is outpacing organizational governance and oversight structures, according to a joint study by IDC, Microsoft, and cybersecurity provider CPX.
The report, titled Securing AI in the UAE Enterprise and surveying 175 senior technology and security executives, highlights an operational disconnect between business deployment and IT risk management. While 80% of surveyed Chief Information Officers express confidence that AI initiatives will generate returns within two years, 98% of security teams report already encountering security risks in production environments.
The findings reflect broader structural challenges as AI tools access mission-critical data. According to the data, 92% of security leaders report that AI systems currently process sensitive corporate information. Furthermore, 54% have faced scenarios where automated system decisions could not be audited or explained to meet compliance obligations.
Unsanctioned technology usage presents an immediate operational vulnerability. The study shows that 43% of CIOs recognize widespread employee use of unapproved AI tools, and 52% of security teams have verified direct corporate data leaks through these external applications.
Governance readiness is similarly strained by the emergence of autonomous software. Although over half of surveyed enterprises have deployed or are developing agentic AI solutions, only 10% consider their internal controls mature enough to manage them securely.
Organizational authority lines explain much of the disparity. Just 15% of Chief Information Security Officers hold mandatory sign-off authority over AI projects, and only 10% of enterprises establish defined security parameters prior to testing or purchasing AI software. Consequently, cybersecurity evaluations frequently occur well after procurement decisions are finalized.
A capability gap also persists at the assessment stage. Only 30% of companies employ structured methodologies to evaluate AI security, while 40% rely on ad-hoc assessments or third-party audits. With 87% of internal teams reporting gaps in AI security expertise, the report recommends organizations leverage specialized managed security partners to conduct baseline asset audits and establish clear operational boundaries without offloading accountability.
Commenting on the findings, Hadi Anwar, CEO of CPX, said, “The research makes clear that readiness cannot be measured by adoption alone. UAE organizations are moving quickly to capture the opportunities presented by AI, but the pace of technological change must be matched by clear accountability, stronger governance and security models designed for increasingly autonomous systems. The organizations that succeed will be those that embed security and governance into their AI programs from the outset.”
Rima Semaan, Data & AI lead at Microsoft UAE, said, “The pace of AI adoption is not going to slow down. But as AI becomes part of more day-to-day decisions and workflows, organizations need to be just as deliberate about how they govern it. They need visibility into where AI is being used, clear accountability, and the right controls around data and access. This matters even more with AI agents. The opportunity for the UAE is to build these controls in early, so organizations can move quickly with AI without compromising trust.”
Shilpi Handa, Associate Research Director, Security & Trust, IDC, said, “AI adoption across UAE enterprises is accelerating rapidly, driven by strong national ambitions and government-led innovation agendas. However, while organizations are moving quickly to deploy AI, security governance has not kept pace. Our research has found security teams are already encountering AI-related risks, yet many CISOs still lack formal authority over deployment decisions. The challenge is not the technology itself. The real gap lies in governance, and it can be addressed with the right frameworks, accountability, and oversight in place.”
Despite the identified governance risks, the technology is also expanding inside enterprise security centers. Two-thirds of surveyed UAE organizations currently employ AI for threat detection, response, and investigation, with the remaining third planning to integrate it over the next 12 months.
The study outlines key corrective steps for leadership, including establishing mandatory security sign-offs, cataloging existing AI tools and connected data sets, standardizing permission boundaries for software agents, and instituting verifiable compliance frameworks as systems grow more autonomous.
