Nearly Half of UAE Employees Use AI Tools Their IT Team Never Approved - New Research Shows the Real Cost

During Cybersecurity Awareness Month, IDC surveyed 175 senior security and technology executives across the UAE for a new study backed by Microsoft and CPX, called "Securing AI in the UAE Enterprise." The headline numbers are worth sitting with: 98% of security teams reported encountering at least one real AI security risk in production - not a hypothetical, something that actually happened - and 43% of CIOs admit employees regularly use AI tools their organization never approved. Despite that, 80% of CIOs say they are confident their AI investments will deliver results within two years.

That gap - high confidence, low governance - is the real story. Businesses are moving fast on AI. Oversight of how it's actually being used isn't keeping pace.

What the Research Actually Found

IDC's findings aren't an outlier. A Cooper Fitch survey across the UAE and GCC found that 57% of organizations have no formal AI governance framework, or only an informal, evolving one - rising to 81% among regional GCC companies specifically. Separately, ServiceNow's Enterprise AI Maturity Index found that only 16% of UAE organizations have implemented AI testing, auditing and risk-management processes at all.

Put together: AI spending and adoption are climbing across the UAE, confidence in that spending is high, and the governance structures meant to manage the risk that comes with it are, in most organizations, still minimal or informal.

Why “Shadow AI” Is a Bigger Problem Than It Sounds

"Shadow AI" is what IT teams call AI tools employees adopt on their own - a free AI assistant for drafting emails, a browser extension that summarizes meetings, an AI coding tool, a chatbot someone pastes client data into to save time. None of it looks like a security incident in the moment. Most of it never touches a firewall or a managed device policy.

That's exactly the problem. Company data - client details, financials, internal documents - can leave the network through a tool IT has never seen, with no audit trail, no access control, and no way to know what happened to it afterward. For businesses in regulated or client-sensitive sectors, that's not just a security gap, it's a compliance exposure.

What Actually Closes the Gap

Closing this doesn't require banning AI tools, which employees will route around anyway. It requires treating AI tools the same way you'd treat any other unmanaged device or access point on your network:

• Visibility - knowing which AI tools are actually in use across the business and what data they touch, instead of assuming policy equals practice
• A written AI usage policy - specific about what can and can’t be shared with external AI tools, communicated clearly rather than left implied
• Access control - the same credential and permission discipline applied to any other software touching company data
• Centralized monitoring - a SOC watching for unusual data movement isn’t just for traditional malware and intrusion attempts anymore

Closing the Gap With the Right Partner

This is exactly the kind of gap CODE3 closes for businesses across Dubai, Abu Dhabi and Sharjah. Our Managed IT Services give you real visibility into what’s actually running across your business, our Security Operations Center (SOC) provides the continuous monitoring this research shows most UAE organizations still lack, and our cybersecurity services help put a practical governance policy in place - scoped to how your business actually uses technology, not a generic checklist.

AI adoption in the UAE isn’t slowing down, and it shouldn’t. Talk to us about getting a quote to make sure your governance keeps pace with it, instead of finding out the gap the hard way.