Introduction
Most GCC boards know AI is important. What most have not done is decide who is accountable for it.
The people at McKinsey and the GCC BDI did a survey called State of AI in GCC Countries from August to September 2025. They found out that 84 percent of organisations in the GCC have started using Artificial Intelligence in least one part of their business. This is an increase from 2023 when only 62 percent of organisations were using Artificial Intelligence.
However the GCC BDI Board Effectiveness Review 2025 is a bit worrying. This review talked to 193 directors and executives. It found that 5 percent of GCC boards have a complete plan for using Artificial Intelligence. What is more surprising is that 63 percent of these boards do not have any clear plan for using Artificial Intelligence at all. The GCC BDI and Artificial Intelligence are clearly important here. The organisations, in the GCC need to think about how they are using Artificial Intelligence.
Saudi Arabia said that 2026 is the year of Artificial Intelligence. On the 14th of June 2026 the United Arab Emirates made a new group called the Federal Authority for Artificial Intelligence and Data. This group is in charge of Artificial Intelligence and data in the United Arab Emirates. It reports to the United Arab Emirates Cabinet. The Saudi Data and Artificial Intelligence Authority made 48 decisions to make sure people followed the rules in Saudi Arabia in 2024 and 2025. The Central Bank of the United Arab Emirates told all banks and financial companies how to use Artificial Intelligence and Machine Learning in February 2026. They have to be responsible for what their boards do. They have to keep track of the models they use. They have to test for bias every year. They have to make sure humans are watching over the Artificial Intelligence. The message from the governments in the Gulf Cooperation Council is clear: Artificial Intelligence has to be governed. Artificial Intelligence governance is not something we want to do it is something we have to do. The governments in the Gulf Cooperation Council are serious about Artificial Intelligence governance. Artificial Intelligence is a part of the plan, for Saudi Arabia and the United Arab Emirates. It is becoming enforceable. And the board is where accountability sits.
Why Boards Are the Governance Gap
AI failures do not announce themselves as governance failures. They surface as reputational damage, regulatory action, operational disruption, or quietly compounding financial risk. By the time the board is asked what oversight it had in place, the moment to have built that oversight has passed.
EY’s Six Boardroom Priorities Shaping MENA in 2026 identified AI governance as a top-tier board issue – noting that many organisations across the region still lack defined approval pathways, consistent documentation, and clear accountability for human oversight. These are not technology gaps. They are governance gaps. The approval pathways, the documentation standards, the accountability framework – these are board-level decisions.
The GCC BDI’s analysis on preparing boards for a new governance era was direct on the point: boards must develop fluency in digital strategy, cybersecurity risk, and data governance. This may require appointing directors with specialised AI expertise or establishing dedicated technology committees. For most GCC boards, neither of those steps has been taken.
What makes this particularly consequential in 2026 is the pace of deployment. The McKinsey-GCC BDI survey found that most GCC organisations are deploying AI at a pace that outstrips their governance maturity. AI is being embedded into procurement decisions, customer-facing services, financial reporting systems, and HR processes – each of which carries regulatory, ethical, and reputational exposure that the board is expected to be overseeing. If it is not, the liability question is not hypothetical.
This mirrors a pattern explored in MEIoD’s analysis of board oversight strategy and H2 governance priorities – where the gap between what boards intend to govern and what they are actually overseeing is widest precisely in the fastest-moving areas.
What AI Board Governance Actually Requires
Building AI oversight into the board’s governance framework does not require every director to become a technologist. It requires the board to make four decisions that currently sit in a vacuum in most GCC boardrooms.
First: mandate. Which committee owns AI governance? In the absence of a designated committee, AI risk tends to fall to the audit committee by default – a function that was not designed for the speed or technical complexity of AI risk. The CBUAE’s February 2026 guidance note for financial institutions specifically requires board-level accountability for AI systems. That accountability needs to be assigned, not assumed.
Second: inventory. Does the board know which AI systems the organisation is running? Channel Post MEA’s 2026 analysis of AI compliance in the GCC found that many organisations are AI-active but still running multiple pilots in parallel, with fragmented tool adoption and accountability split across IT, legal, risk, and business functions. A board that cannot answer what AI systems it operates cannot credibly claim oversight of them.
Third: reporting. What does the board receive from management on AI performance, risk, and compliance? The CBUAE’s 2026 guidance requires annual bias testing and human review rights for all AI systems in licensed financial institutions. If the board is not receiving reports against those standards, it is not exercising the oversight the regulator expects.
Fourth: literacy. At least one director needs sufficient AI fluency to interrogate management assertions on AI risk – not to write code, but to ask the questions that a generalist cannot. The GCC BDI Board Effectiveness Review 2025 found that only 14 percent of directors feel confident about AI’s strategic implications. That figure needs to rise, and it rises through structured development, not accumulated experience.
For boards working on cognitive diversity and the skills-based composition that the current environment demands, AI literacy is now a composition consideration – not just a development one.
The Regulatory Clock Is Already Running
The UAE’s Federal Authority for Artificial Intelligence and Data, established June 2026, is not a research body. It consolidates three existing regulatory functions and reports directly to the Cabinet. It is the infrastructure through which AI enforcement will operate. Boards of UAE companies – listed and unlisted – are now operating in an environment where AI oversight has a designated regulator with consolidated authority.
In Saudi Arabia, the DIFC Regulation 10 – the first AI-specific binding regulation in the region, in full enforcement since January 2026 – imposes an Autonomous Systems Officer role on entities deploying high-risk AI within DIFC. That is a board-level governance decision: who holds that role, what their mandate is, and how they report to the board.
What MEIoD Recommends
For GCC boards that have not yet built AI oversight into their governance framework, three steps are immediately actionable before year-end.
Assign the mandate. Designate a committee with specific AI governance responsibilities and a defined reporting line to the full board. If the audit committee absorbs this, update its terms of reference to reflect the expanded mandate.
Commission an AI governance assessment. Before building a framework, understand the exposure. MEIoD’s CG Assessment reviews governance structures including technology oversight – identifying the specific gaps the current regulatory environment requires boards to close.
Build director capability. The Corporate Directors Program equips directors with the strategic governance and oversight competencies that AI, digital risk, and the current GCC regulatory environment demand. The September cohort opens on 13 September.
For boards that want the full picture on how technology governance connects to broader board effectiveness, MEIoD’s webinar on The Audit & Risk Committee: Beyond Financial Oversight to Tech & ESG Assurance on 14 October 2026 addresses exactly this governance expansion.
The board that governs AI does not wait for a regulatory event to tell it what oversight it should have had. Contact MEIoD to start building yours.
FAQ
What is AI board oversight and why does it matter in the GCC?
AI board oversight is the formal governance mechanism through which a board assigns accountability, receives reporting, and exercises control over an organisation’s AI systems. In the GCC, where the UAE created a Federal AI Authority in June 2026 and Saudi Arabia declared 2026 the Year of AI, boards without oversight frameworks carry direct regulatory exposure.
Which GCC regulators are enforcing AI governance requirements in 2026?
The Central Bank of the UAE published binding AI and ML guidance in February 2026, requiring board accountability, model inventory, bias testing, and human oversight for all licensed financial institutions. SDAIA issued 48 enforcement decisions in 2024-2025 under Saudi Arabia’s PDPL. DIFC Regulation 10 has been in full enforcement since January 2026, requiring an Autonomous Systems Officer for high-risk AI deployments.
What should a GCC board's AI governance framework include?
At minimum: a designated committee with formal AI oversight responsibility, an inventory of all AI systems the organisation operates, a management reporting framework covering AI performance and compliance, and at least one director with sufficient AI literacy to interrogate management assertions on AI risk.
How does AI board governance connect to existing audit committee responsibilities?
Many boards are defaulting AI risk to the audit committee. The CBUAE’s 2026 guidance and DIFC Regulation 10 both impose specific AI oversight obligations that go beyond traditional financial audit scope – including bias testing, explainability requirements, and human oversight mandates. Audit committees absorbing AI governance need updated mandates to reflect this expanded scope.
What is the most immediate action a GCC board should take on AI governance?
Assign the mandate. Designate which committee owns AI governance, update its terms of reference, and establish a management reporting line that gives the board visibility into AI adoption, risk, and compliance before year-end. Structure comes before literacy – you cannot govern what no one is accountable for.
