Ask a UAE enterprise about its AI governance and you will usually be handed something impressive. A policy. An ethics framework. A review board with terms of reference. An approval workflow that every new use case has to pass through before it goes live.

Then ask a second question: how many AI systems are running in production right now, and who is watching them?

The room usually goes quiet. Not because the organisation is careless, but because almost nobody built for that. Governance was designed as a gate. Something arrives, gets assessed, gets approved, goes through. The gate does its job and the system passes into production, where it operates for months or years largely unobserved.

That is the missing layer. And it is increasingly the reason AI programmes in this region stall somewhere between pilot and scale.

The numbers describe a specific kind of failure

The Gulf does not have an AI adoption problem. McKinsey's GCC research found 84 per cent of companies have adopted AI in at least one business function, up from 64 per cent in 2023. That is a fast-moving market by any global standard.

What it has is a conversion problem. From the same research: only 31 per cent report successfully scaling AI.

Roland Berger's Middle East study, published in February 2026, locates the bottleneck fairly precisely. Eighty per cent of Gulf organisations now have an AI strategy. Fewer than one in three have built an operating model or a governance process to support it. Only 28 per cent have a dedicated AI ethics or compliance board.

And the DFSA, surveying 661 DIFC firms with an 88 per cent participation rate, found AI use rising from 33 per cent to 52 per cent in a single year, generative AI adoption nearly tripling, and 21 per cent of firms without clear accountability or oversight mechanisms even where AI was business critical.

Read those together and a pattern emerges that most executives in this market will recognise from the inside. Strategy is done. Adoption is happening. Pilots work. And then things get stuck, not because the technology failed but because nobody can get comfortable enough to let it run at scale.

Gartner's projection that over 40 per cent of agentic AI projects will be cancelled by the end of 2027 lists inadequate risk controls alongside cost and unclear value as the drivers. That ordering is worth noticing. Risk control is not the thing that slows AI down after it works. It is one of the things that determines whether it gets to work at all.

Why gate-based governance runs out

The gate model was not a mistake. It was inherited, and it was inherited from a world where it made sense.

Most enterprise governance frameworks were built for software and for models that behave like software. You specify something, you build it, you test it, you approve it, you deploy it. The thing you deployed is the thing that runs. If it changes, that change goes through a controlled release, which triggers another review. Change control works because change is discrete, visible and initiated by a human being.

AI systems break that assumption in a way that is easy to state and hard to internalise.

The model does not change. Everything around it does. Your customer base shifts. Market conditions move. Behaviour that meant one thing last year means something different this year. The system carries on applying a pattern learned from a world that has quietly moved on, and it does so with complete confidence, because confidence is not a thing it can lose.

There is no release. No change ticket. No trigger. The governance framework never fires, because governance frameworks fire on events, and nothing that the framework recognises as an event has occurred.

This is the structural point, and it is worth putting to a board in one line: your AI governance activates when something changes, and the most consequential AI risks arrive without anything changing.

Add to that a second problem. Conventional monitoring watches availability. Is the service up, is latency acceptable, are error rates normal. Those dashboards can be entirely green while a model's accuracy for one customer segment has been eroding for weeks. AI systems rarely fail loudly. They drift, and drift is silent by construction.

[How Runtime Governance Catches What Pre-Deployment Checks Miss sets out the technical failure modes in detail.]

What UAE regulators now expect

For a while, an organisation could reasonably treat continuous oversight as maturity rather than obligation. That position has become harder to hold, and the change came from the regulator with the most exposure to consequential AI decisions.

The Central Bank of the UAE issued its Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E. on 11 February 2026, announcing it publicly on 23 February. It applies to all licensed financial institutions, with insurance providers expressly in scope.

The Guidance Note uses "should" rather than "shall" and states that it supplements rather than replaces existing law. But it sits in the CBUAE Rulebook under Market Conduct and Consumer Protection, and anyone who has been through a supervisory review knows how that distinction plays out in practice.

Section 6 is titled Continuous Monitoring and Review. It expects AI to be subject to continuous monitoring, and expects institutions to consistently monitor and review and, where appropriate, update or cease using AI models, taking into account changes in data, market conditions and customer behaviours. It asks for mechanisms to detect, report and remediate performance issues, biases or unintended consequences arising before implementation and over time.

Section 3 goes further. It states that no AI system should be deployed or used if it is discriminatory or manipulative or develops as such post-deployment.

That clause is the one that ends the gate model as a complete answer. A system can pass every check at the gate and become a problem afterwards, and the Guidance Note is explicit that this remains the institution's responsibility. There is no version of that sentence that an approval workflow alone satisfies.

Institutions in the DIFC face a parallel expectation from a different direction. The DIFC Commissioner of Data Protection's guidance on Regulation 10, which governs personal data processed through autonomous and semi-autonomous systems, requires those deploying such systems to assess ongoing risks of processing in them.

Two regulators, different mandates, same word. Ongoing.

The layer that is missing

If gate governance is the first layer and it is not enough, what is the second?

It is not a bigger policy. Organisations that respond to this by writing more documentation tend to end up with more documentation and the same exposure. The missing layer is operational. It runs continuously, in production, and it consists of four things.

Visibility. A live, maintained record of every AI system in production, what it does, and how much it matters. The CBUAE Guidance Note asks for an inventory of all AI models, systems or technologies developed or deployed, holding at minimum the model name, purpose and risk rating.

This sounds like administration and is not. In most organisations of any size, AI arrived through several unconnected doors: a vendor module with machine learning inside it, a team that built something useful, a SaaS tool that added generative features in an update nobody read. The inventory is usually the moment an executive team sees the real surface area for the first time, and it is frequently larger than expected.

Thresholds. Monitoring means nothing until somebody has decided in advance what unacceptable looks like. For each material system: what level of performance decline triggers review, what shift in the input population triggers an alert, what fairness gap triggers escalation. Set by people with the authority to act, agreed before the pressure arrives.

Detection. Something must be watching for those thresholds continuously, because nobody sustains manual review across a growing estate. This is where platforms built for the purpose earn their place. IBM watsonx.governance is one such option, maintaining the model inventory, running continuous drift and fairness monitoring, and generating an evidence trail as a by-product of operation rather than as a documentation exercise afterwards. There are others, and the right choice depends on your estate. The principle matters more than the product: what is not automated does not persist.

Response. An alert without an owner is noise. Each material system needs a named person who receives the signal, an agreed escalation path, and a defined range of responses from investigate through retrain to suspend. Section 6 of the Guidance Note also requires that institutions retain, at all times, the clear and immediate ability through human intervention to cease using a deployed AI system. That is a question worth asking internally before a supervisor asks it, because a fair number of organisations discover the model is so embedded in a workflow that stopping it means stopping the business process.

The part that gets missed

Here is the argument that tends to land with boards, and it is not the compliance one.

Runtime governance is usually presented as a brake. In practice it is closer to the opposite.

Think about why AI programmes stall in this region. Rarely because the pilot failed. Usually because the pilot succeeded, someone proposed putting it in front of customers at volume, and the risk committee could not get comfortable. Not because they were obstructive, but because nobody could answer the questions they were obliged to ask. How will we know if this stops working. What happens if it starts treating one group differently. Who is accountable when it does. What do we tell the regulator.

Without a runtime layer, those questions have no good answers, so the honest response is to keep the deployment small. That is the 84 per cent adopting and 31 per cent scaling, expressed as a governance failure rather than a technology one.

With a runtime layer, the answers exist. We monitor continuously against agreed thresholds. Escalation goes to a named owner. We can suspend within a defined period. Here is the evidence trail. The risk conversation changes from whether to deploy into how far, and organisations that can have that conversation move faster than organisations that cannot.

The regulatory case for continuous oversight is real and it is now written down. But the commercial case is stronger, and it is the one that gets funded.

Where a mid-market organisation should start

The full picture can look like an enterprise transformation programme. It does not need to be, and for a mid-market institution it should not be.

Start with the inventory. Everything else depends on knowing what you are running. Give it to someone with the authority to ask uncomfortable questions across business lines, because the systems you do not already know about are the ones the exercise exists to find.

Risk-rate what you find, using customer impact as the primary lens. The CBUAE definition of a high-impact decision is a serviceable anchor: any determination using AI that materially affects a customer's access to financial products or services, with loan applications and insurance claims given as the examples.

Take the top three and govern them properly. Thresholds, automated monitoring, named owners, tested stop. Not the whole estate. Three systems governed genuinely will teach your organisation more about what it actually needs than thirty governed on paper, and it produces something you can show a supervisor.

Then decide on tooling, once you know the shape of your estate rather than before. Buying a platform to solve a problem you have not yet scoped is how governance budgets get spent without governance improving.

Fix the accountability question in parallel. The DFSA found 21 per cent of firms without clear accountability even for business-critical AI. That is not a tooling problem and no platform will solve it. It is a decision about who owns AI outcomes at executive level, and it usually needs to be made before anything else works.

The shift underneath all of this

The organisations getting this right have made one conceptual change, and it is smaller than it sounds.

They stopped treating AI governance as something you complete and started treating it as something that runs.

A completed framework is a document. It has a version number and an owner and a review date twelve months out, and between those dates it does nothing. A running governance function has a heartbeat. It watches, it alerts, it escalates, and it produces evidence continuously rather than being reconstructed in the fortnight before an examination.

Your approval gate answers a question about whether a system was fit to launch. It is a good question and you should keep asking it. But it is not the question your regulator is now asking, and it is not the question that determines whether your AI programme ever gets past pilot.

That question is about this morning. And answering it requires a layer most UAE organisations have not built yet.

Aligne AI helps organisations across the UAE and wider GCC build AI governance that operates continuously rather than periodically, aligned to CBUAE supervisory expectations, ISO/IEC 42001 and the NIST AI Risk Management Framework. Contact us to talk through your AI estate.
‍
This article describes the regulatory landscape as understood at the date of publication and is provided for general information. It does not constitute legal advice. Organisations should obtain advice from qualified UAE counsel on their specific circumstances.