The news. A new IDC study, run with two technology companies and based on a survey of 175 senior security and technology executives in UAE enterprises, says companies are adopting AI faster than they are building the rules around it. 80% of CIOs expect their AI investments to pay off within two years. At the same time, 98% of security teams say they have already met at least one real AI security risk in production.
The numbers that matter outside IT
Three findings reach well beyond the security department.
43% of CIOs say employees regularly use AI tools their organisation never approved, and more than half of security teams have already found data leaking through those tools. 92% of security leaders say their AI systems handle sensitive data. And 54% have faced a case where an AI system's decision could not be explained or audited when compliance asked.
IDC's researcher put it in one line: "The challenge is not the technology itself. The real gap lies in governance."
Why it matters for the agency
A travel agency handles exactly the data this study worries about: passport copies, phone numbers, card details, family names. If a junior pastes a client's details into a free AI tool to write a quick email, that is the 43% in your own office.
The second finding matters more for us. "Could not be explained" is a real problem when a client disputes a price or a cancellation fee. Somebody has to answer for it.
The desks I ran left more than 83,100 documented bookings, more than 41,200 of them counted row by row. Behind every dispute in a record like that, the client asks the same question: who approved this? The cheapest AI governance a small agency can have is to keep that answer a person's name. Let AI prepare the work. A named person approves what reaches the client.
Do you know which AI tools your team used this week, and with whose data?
Source: Arabian Business — IDC report shows glaring AI governance gap across the UAE.