UAE organisations are struggling to enforce AI access policies despite widespread adoption of formal governance rules, with 98% reporting instances of AI tools accessing sensitive data beyond task requirements, according to new research from Delinea.
The survey of 251 UAE IT and security leaders found that every respondent’s organisation had a formal policy governing AI access. However, only 59% said those policies were actively enforced, compared with 71% across the global sample. The findings highlight a growing disconnect between defining AI permissions and controlling how AI tools and agents behave in operational environments.
Detection and response remain significant weaknesses. Seven in ten UAE organisations failed to detect their latest excessive-access incident in real time or within 24 hours. More concerning, just 16% said they could immediately revoke an AI tool’s credentials and terminate its session, compared with 35% globally.
“UAE organisations have already taken the first step by establishing policies and approval requirements, but policy alone cannot contain an agent operating at machine speed. The next priority is to enforce authorisation at the instant of action.”
— Mortada Ayad, VP of Sales – META, Delinea
Business pressures may further undermine governance. According to the report, 41% of UAE respondents said their organisations either allow employees to bypass formal approval processes or grant temporary access and review it later when deadlines or commercial demands require faster AI deployment.
Accountability is another challenge. Although 98% said approval from a named individual is required at least sometimes before AI tools access new sensitive data sources, only 35% could always trace a sensitive-access event to a named human authoriser.
Art Gilliland, CEO of Delinea, described this as the “fallacy of policy”—the assumption that defining what an AI agent should be permitted to do is equivalent to controlling its actual actions.
The findings point to a critical identity-security challenge as AI agents operate across connected systems at machine speed. Organisations need to move beyond written policies towards task-specific permissions, traceable human authorisation and immediate credential and session revocation when access is no longer justified.
For UAE enterprises accelerating AI adoption, the priority is ensuring that governance translates into enforceable controls, rather than remaining a policy document disconnected from real-time activity.
