The AI Enforcement Gap, 98% of UAE based respondents reported confirmed or suspected instances of AI tools accessing sensitive data beyond what their tasks required, compared with 87% across the global survey sample. The research surveyed 2,004 IT and security leaders at organisations using or piloting AI across seven markets, including 251 respondents in the UAE. All UAE respondents said their organisations had formal policies governing AI access to data.

However, 59% said these policies were actively enforced, compared with 71% globally. Seven in ten UAE respondents also said their organisations had not detected the latest instance of excessive AI data access in real time or within 24 hours.

The findings highlight the growing need to translate AI governance policies into practical security measures as organisations deploy increasingly autonomous systems. Art Gilliland, CEO of Delinea, said written policies must be supported by controls capable of enforcing access restrictions when an AI agent acts across connected systems.

The research also identified opportunities to improve accountability and incident response. While 98% of UAE respondents said approval from a named individual was required at least sometimes before an AI tool accessed a new sensitive data source, only 35% could always trace a sensitive access event to a named human authoriser. Furthermore, just 16% said their organisations could immediately revoke an AI tool’s credentials and terminate its session, compared with 35% globally.

Mortada Ayad, VP of Sales for META at Delinea, emphasised the importance of limiting AI access to what each task requires, maintaining traceable approval records and enabling immediate termination of credentials and sessions when a task ends or risks change.

The findings point to an important next step for enterprise AI adoption: combining governance policies with real-time monitoring, controlled permissions and clear accountability to support secure and responsible AI deployment.