Agentic AI raises a harder enterprise question than whether the technology works. Once a system can initiate transactions, alter workflows or make decisions with financial, regulatory or customer consequences, leaders have to decide how much authority it should have.
“The line should be drawn based on risk and consequence, not the sophistication of the technology. I have spent much of my career in financial services and insurance, where organisations have always had to balance automation with judgement. The principle is straightforward: the greater the financial, regulatory, reputational or customer consequence of a decision, the stronger the oversight should be,” says Ricky Mahar, UAE Country Manager, Accelera Digital Group (ADG).
Routine information processing can tolerate more freedom than moving money, approving credit or making an underwriting decision. Autonomy can also expand as confidence builds.
“I think about this as progressive autonomy. Initially an agent observes and recommends. Then it acts within defined parameters. As the organisation builds evidence around its performance, controls and reliability, those parameters can expand,” says Mahar.
Human involvement still has to be placed carefully. Requiring approval for every action risks preserving the friction automation is meant to remove.
“However, human involvement should not mean requiring somebody to approve everything an agent does,” says Mahar. “That simply recreates the old operating model with another technology layer on top of it. The objective is human judgement at the points where judgement creates value, and autonomy everywhere else where it can safely improve speed, consistency and unit economics.”
Sovereignty in the architecture
Gulf organisations often operate across jurisdictions, while government, financial services, healthcare and energy manage highly sensitive information under specific regulatory requirements. Data location, access and processing therefore have to be designed into the environment from the outset.
“Sovereignty has to become an architectural principle, rather than a compliance exercise performed after an AI solution has been built,” explains Mahar. “Enterprises need to know where their data originates, how it is classified, which agents and models can access it, where inference and processing take place, what can cross jurisdictions and what cannot.”
One model, cloud or environment is unlikely to suit every task. Enterprises may need to route workloads across models, data sources and infrastructure according to sensitivity, risk and jurisdiction. For Gulf organisations, that is also a commercial question, given the valuable proprietary data they hold across sectors from finance and energy to aviation, healthcare and government.
“The question is whether organisations simply use generic AI capabilities or combine those capabilities securely with their own proprietary data, workflows and institutional knowledge,” says Mahar.
He adds: “Because as foundation models become increasingly accessible, access to the model itself becomes less differentiating. The competitive advantage moves towards the proprietary context around it: your data, customer relationships, workflows, domain expertise and the ability to connect AI safely into the systems where work actually happens.”
In financial services, new platforms can combine behavioural, financial and market data in ways individual institutions historically could not, making proprietary context a potential economic moat rather than simply a regulatory obligation.
From pilots to operating model
The region already has much of what it needs to move quickly. The harder question is how enterprises convert that momentum into something repeatable across the organisation.
“The Gulf already has many of the ingredients: ambition, capital, infrastructure and strong government support for AI adoption. The next challenge is execution. I see five things coming together: strategy, data, technology, operating model and people,” says Mahar.
The numbers underline the gap between adoption and value. A recent study by McKinsey shows that 84 percent of GCC organisations are already using AI and 60 percent are using AI agents to some extent. However, it also revealed that only 31 percent have scaled or fully deployed AI, while just 11 percent are generating material value.
Part of the difficulty lies in creating an environment where individual projects do not have to resolve the same fundamental questions every time they move towards deployment.
“We shouldn’t assume that speed and control are opposites,” says Mahar. “In fact, poorly designed governance often slows organisations down because every AI initiative has to negotiate the same questions around data, security, models, approvals and accountability from scratch.”
Enterprise-wide rules can give teams clearer parameters within which to move, while keeping decisions around data access, approved infrastructure and accountability consistent across the organisation.
“The better approach is to establish the enterprise guardrails once: approved models and infrastructure, identity and access controls, data classifications, auditability, monitoring, escalation rules and clearly defined boundaries around what agents can do. Teams can then innovate rapidly inside those boundaries.”
The economic case for getting this right is already becoming visible. McKinsey has found AI-led transformations delivering 20–40 percent reductions in customer onboarding costs, alongside 10–20 percent improvements in insurance agent productivity.
The bigger opportunity, however, is not simply doing today’s work faster. As AI reduces the marginal cost of intelligence and execution, it has the potential to change the economics of processes that have historically scaled with headcount.
Technology alone, however, will not close the gap between experimentation and enterprise-wide deployment. AI has to become part of how the organisation operates, rather than remain a programme owned primarily by the technology function.
Who remains accountable?
Human oversight becomes more nuanced as autonomy spreads across different kinds of work. A single model of intervention makes little sense when one agent may be processing routine information while another is involved in decisions carrying significant financial, regulatory or customer consequences.
“There are really three models. Humans can be in the loop, approving high-consequence decisions before they occur,” says Mahar. “They can be on the loop, monitoring agents operating autonomously within predefined tolerances and intervening when something falls outside those boundaries. And senior leadership must remain above the loop, defining objectives, permissions, risk appetite and ultimately determining how much autonomy the organisation is willing to grant.”
UAE regulation is already putting clearer expectations around where that responsibility sits. The Central Bank of the UAE’s 2026 guidance on responsible AI adoption in financial services places responsibility and accountability for AI systems and their outcomes with senior management and boards.
The UAE AI Charter also puts human oversight, transparency, governance and accountability at the heart of responsible AI, while the National Cyber Security Policy for AI calls for governance frameworks, visibility over AI assets and human oversight for critical decisions.
DIFC has gone further in addressing autonomous systems directly. Its Data Protection Regulation 10 covers personal data processed through autonomous and semi-autonomous systems as its regulatory framework evolves alongside its ambition to become an AI-native financial centre.
“Accountability has to remain with the organisation and ultimately with human leadership. Delegating a decision does not delegate accountability,” says Mahar.
As agent populations grow, enterprises will need a much clearer picture of what is operating across the business and who owns the outcome.
“As organisations deploy hundreds or eventually thousands of agents, I expect enterprises will maintain something resembling a digital workforce register: which agents are operating, who owns them, which systems and data they can access, what decisions they are permitted to make and how their performance is monitored,” says Mahar.
Visibility must also extend to what autonomous systems actually do, with a clear audit trail of the data used, systems accessed and points of human intervention.
“You cannot govern an autonomous enterprise if you cannot see the autonomous systems operating inside it,” says Mahar.
“Organisations also need to redesign work rather than simply layering AI onto existing processes,” says Mahar. “The question leaders should be asking isn’t ‘Where can we add an AI agent?’ It is: ‘If we designed this process today, with humans and AI working together, what would it look like?’”
As adoption accelerates, the bigger opportunity is to turn the region’s momentum into a model for how autonomous enterprises are built, governed and scaled.
“The Gulf has an opportunity to move from being one of the world’s fastest adopters of AI to becoming a global proving ground for the autonomous enterprise,” says Mahar.
The foundations are already in place. The challenge now is orchestration, turning the Gulf’s AI ambition into sustainable enterprise value.
Discussion about this post