GOVERNANCE

INTELLIGENT TECHNOLOGY

The incidents included agent failures, data exposure, AI-driven decision errors and AI security breaches. Among respondents who reported an escalated incident, 49 % said their organisations had changed their AI governance policies or frameworks in response, while 40 % had revised their AI investment or deployment plans.

The research also found that when AI deployment outpaced governance and compliance readiness, 60 % of UAE respondents continued deployment within agreed risk limits while governance frameworks adapted. By comparison, 30 % delayed deployment until appropriate governance measures were in place.

These challenges are expected to intensify as AI agents take on more autonomous responsibilities across enterprise operations.

According to the study, 38 % of UAE respondents said agentic AI was already in production across one or more business functions, including 13 % who had embedded the technology across enterprise operations.

Meanwhile, 78 % expected AI agents to have some level of autonomy in decision-making by 2027. However, only 41 % said their governance frameworks were designed to scale with agentic AI deployment, while 35 % acknowledged that their existing frameworks could cope but would require strengthening.

Shukri Eid, Vice President and General Manager of IBM Gulf, Levant, and Pakistan, said:“ As AI agents take on more decisions and actions, governance has to become part of how AI operates, not an afterthought.”

“ For organisations in the UAE, that means creating clear accountability, stronger oversight and controls that can scale with adoption. Building that trust into AI from the start will be critical to turning innovation into long-term business value, while being aware of the risks involved.”

Although AI risk was formally governed at board level in nearly all UAE organisations surveyed, the research identified a lack of consensus over accountability for adverse outcomes involving autonomous AI agents.

The Chief Risk Officer or Chief Compliance Officer was the most commonly cited person responsible, at 21 %, followed by shared responsibility among named C-suite executives at 17 % and the CIO or CTO at 15 %.

Respondents were also divided over legal liability when an AI system caused significant harm.

More than a quarter( 26 %) believed AI liability was too complex and contextspecific for a general answer, while 19 % said an adequate regulatory framework did not yet exist. Another 16 % believed liability should be shared proportionately between the organisation deploying the AI agent and the technology vendor.

As AI agents become increasingly capable of making decisions autonomously, UAE executives identified several governance capabilities that would be required by 2027.

These included formal legal or contractual frameworks defining AI vendor liability( 37 %), crossjurisdictional governance structures( 36 %) and the ability to

Shukri Eid, Vice President and General Manager of IBM Gulf, Levant, and Pakistan

immediately halt agent activity across the enterprise( 36 %).

The study also highlighted gaps in how UAE organisations measure the financial implications of AI governance weaknesses.

Only 39 % of respondents said their organisations had formally quantified the financial risks arising from gaps in AI governance, with those assessments reviewed at board level.

A further 38 % had developed financial risk estimates, but these were neither comprehensive nor regularly reviewed.

Third-party AI governance emerged as another area of concern. Nearly half( 49 %) of UAE respondents acknowledged gaps or limitations in how their governance frameworks covered AI systems used by vendors, technology partners and supplychain participants.

The findings suggested that as enterprises expand their use of AI across internal operations and external technology ecosystems, governance frameworks will need to address risks extending beyond systems directly controlled by the organisation. • www. intelligentcio. com

INTELLIGENT CIO MIDDLE EAST

31