As AI moves from answering questions to making decisions, data governance is becoming a critical test for enterprises across the Middle East.
For the last few years, most conversations around artificial intelligence have focused on its capabilities. How intelligent are the models? How much productivity can they deliver? What business value can organisations expect?
Now we are reaching a stage where enterprises need to ask a more important question. What happens when AI starts making decisions on our behalf?
With agentic AI, this is already fast becoming a reality. These AI systems are being built so that they not just can access critical enterprise information but also interpret it, make decisions and execute actions, often without human approval at every stage.
An AI agent does not need to breach a security system to create a problem. It could simply use the access provided to it, misinterpret information and execute a series of actions that nobody intended. Each action might be permitted, yet the outcome could be entirely different from what the organisation expected. That is concerning.
Having worked with enterprises across the Middle East for many years, I have seen organisations invest significantly in technology, data platforms and analytics. Yet many continue to struggle with questions around data ownership, consistency, quality and access.
Until now, human judgement compensated for these gaps in most cases. An experienced employee can recognise when a report looks incorrect, when information is sensitive or when a business definition needs clarification. An AI agent may not recognise these distinctions. It operates on the information and permissions available to it, potentially making thousands of decisions at a speed no human team can realistically review.
A data quality issue that once resulted in an incorrect report could now trigger an incorrect business action, with consequences extending well beyond the original error. We have spent years making enterprise data accessible. We now need to understand whether it is safe for autonomous systems to act on it.
The UAE and Saudi Arabia are making significant investments in AI-led transformation across government services, banking, aviation, logistics and healthcare. The UAE has outlined ambitions to introduce agentic AI across 50% of federal government sectors, services and operations within two years. Saudi Arabia has also placed considerable emphasis on responsible AI and data governance.
The pace of adoption in the region is encouraging. However, greater autonomy brings greater responsibility.
For enterprises operating in regulated sectors, some difficult questions need to be addressed. Who controls the information an agent can access? Can it combine data from different systems? What decisions can it make independently? And who takes responsibility when something goes wrong?
These are questions that technology alone cannot resolve. They require organisations to rethink how enterprise data is governed and how accountability is maintained when decisions are increasingly automated. Governance needs to work beyond the policy document.
Most large organisations already have data governance and security policies. The real issue is whether these policies can effectively control the actions of an AI agent.
A policy may define access restrictions, but unless those restrictions are enforced when an agent retrieves information or initiates an action, the organisation remains exposed.
This requires combining technical expertise with a clear understanding of business priorities and embedding AI into how solutions are designed and delivered. Its real value becomes evident across three dimensions. The first is growth which includes unlocking new markets, creating products and services, and uncovering opportunities that were previously out of reach. The second is productivity, which means eliminating repetitive work, accelerating decisions and freeing people to focus on problems that demand human judgement. And the third is transformation which involves rethinking entire workflows, business models and operating structures rather than simply making existing processes faster. Together, these dimensions help distinguish AI that merely automates tasks from AI that creates lasting business value.
All three depend on trusted data. For AI to operate reliably at enterprise scale, organisations need to know what data they are working with, who is accountable for it, and who or what can access it. This means establishing clear data ownership, maintaining data quality and putting appropriate controls around access and use. As AI agents move from answering questions to taking actions, these safeguards must extend beyond information access to govern what agents can do, the business context in which they operate, and the decisions or actions that require human oversight. The goal is to enable AI to work autonomously where appropriate, without compromising security, accountability or organisational control.
For enterprises, the question is increasingly about how much responsibility they are prepared to entrust to AI, and whether they have the governance to support that decision.
I expect conversations around AI in boardrooms to become considerably more demanding over the next few years. CEOs and CIOs will certainly continue to focus on productivity, efficiency and business outcomes. But they will also need to understand how much autonomy their organisations have given AI, whether that autonomy is properly governed and who remains accountable for the consequences.
The Middle East has demonstrated remarkable ambition and commitment towards AI adoption. Maintaining that momentum will require equal attention to governance, security and trust.
I believe the true measure of AI maturity will be how confidently organisations can stand behind the decisions their intelligent systems make. An AI agent may take the action. The accountability remains with us.
