The data points to inconsistent enforcement as a central weakness
UAE organisations have moved quickly to establish policies governing AI access, but new research from Delinea shows that those rules are not consistently translating into effective control over what AI tools and agents do in practice.
The global research surveyed IT and security leaders at organisations that are actively using or piloting AI, including 251 respondents in the UAE. Every UAE respondent said their organisation has a formal policy governing what data AI tools and agents may access.
Yet 98% have experienced confirmed or suspected instances in which an AI tool accessed sensitive data beyond what its task required, compared with 87% across the global survey sample.
Fallacy of policy
“Written policy is only as good as an organisation’s ability to enforce it at the moment an AI agent acts. The UAE has clearly recognised the need to govern AI access, but the findings reveal what I call the fallacy of policy: assuming that defining what an agent should be allowed to do is the same as controlling what it actually does. That distinction becomes critical when agents operate across systems and make decisions at machine speed,” explained Art Gilliland, CEO, Delinea.
The enforcement gap is particularly apparent when organisations attempt to identify excessive access. Seven in ten UAE organisations did not detect the latest instance in real time or within 24 hours, compared with six in ten across the overall sample.
“UAE organisations have already taken the first step by establishing policies and approval requirements, but policy alone cannot contain an agent operating at machine speed,” noted Mortada Ayad, VP of Sales – META, Delinea.
