AI Governance for UAE Companies, Made Practical

Board Member (Audit and Risk Committee Chair)

I chair the audit and risk committee of a UAE company that is starting to use AI in several functions. I do not want to slow the business down, but I also do not want to discover a problem from a customer complaint. What should I be asking management for at each meeting?

AI Leadership Agent — Governance Advisory

Ask for the same five artefacts every meeting and watch how they change. Consistency reveals more than depth at board level.

1. The inventory. Every AI system and significant AI feature in use, including anything embedded in purchased software. Ask specifically how it was compiled, because incompleteness is the normal state.
2. Risk tiers. Which systems affect customers, employees, money or safety, and which do not.
3. Named owners. A person per system, not a department. Departments do not attend hearings.
4. Monitoring evidence. Error rates, overrides, complaints and incidents for the tiered systems — actual numbers, month over month.
5. Decisions taken. What was approved, what was rejected, what was switched off.

The most informative line in an AI governance report is the list of things that were stopped. If nothing has ever been stopped, the process is decorative.

Does management currently produce anything resembling those five?

Board Member (Audit and Risk Committee Chair)

We get a policy update and a list of initiatives. No numbers. When I ask for detail I am told it is early days. At what point does early days stop being an acceptable answer?

AI Leadership Agent — Governance Advisory

The moment any AI output reaches a customer, an employee decision or a financial record. Before that, early days is fair. After that, the absence of numbers is itself the finding.

A reasonable way to move management without confrontation is to set a dated expectation rather than a criticism: request the inventory and tiering by the next meeting, monitoring for tier-one systems the meeting after, and a first independent review within two quarters. Sequenced requests are harder to deflect than general concern.

1. Ask who has authority to switch a system off and whether that person has ever used it.
2. Ask what would have to happen for the company to pause an AI system voluntarily.
3. Ask how employees report a concern about an AI output, and how many such reports there have been.
4. Ask which regulatory obligations management believes apply, and who confirmed that view.

Boards do not need technical fluency to govern AI. They need to insist on evidence and be unembarrassed about asking the same question twice.

What is management's stated position on data leaving the country?

Board Member (Audit and Risk Committee Chair)

That it does not, but I suspect nobody has traced it through the vendor chain. How deep should we push on that, given the cost of a full review?

AI Leadership Agent — Governance Advisory

Push to the point of one traced example. Pick a single system that handles personal or commercially sensitive data and ask for the full path: where it is captured, which processors touch it, which sub-processors they use, where inference happens, what is retained and for how long.

One traced example costs little and tells you whether the general assurance is grounded. If the trace is easy, the assurance is probably true. If nobody can produce it within two weeks, you have learned something important about the whole estate.

Test the claim, not the policy. A single verified data path is worth more than a chapter of assurances.

Do that once a year on a different system each time, and governance stays honest without becoming a burden.