#UAE #AIsecurity - US identity security company Delinea has published research showing 98 percent of UAE organisations have experienced confirmed or suspected cases of an AI tool accessing sensitive data beyond what its task required. The global figure is 87 percent. The survey covers 2,004 IT and security leaders across seven countries, including 251 in the UAE. Every UAE respondent has a formal AI data-access policy, yet only 59 percent say it’s actively enforced, while only 16 percent can immediately revoke an AI tool’s credentials and end its session.
SO WHAT? - Inspired and encouraged by proactive government policy, many UAE organisations wrote their AI rules early. However, having governance rules doesn’t mean that organisations can control what an agent does at machine speed. The UAE trails the global sample on enforcement (59% against 71%) and on cutting off access (16% against 35%). The new survey highlights what is fast emerging as a top priority for agentic AI users: enforcing access at the moment an agent acts.
KEY POINTS:
Delinea has released its 2026 Identity Security Report: The AI Enforcement Gap. The security company commissioned Censuswide to survey 2,004 IT and security leaders at organisations with 500 or more employees that use or pilot AI, across seven countries. This included 251 IT and security leaders in the UAE.
All UAE respondents say their organisation has a formal policy on what data AI tools and agents may access. However, 98% report confirmed or suspected cases of AI accessing sensitive data beyond task requirements (against 87% globally).
Only 59% of UAE respondents say their AI data-access policy is actively enforced, compared with 71% across the whole sample. Delinea calls the assumption that a written policy equals control the “fallacy of policy”.
Seven in ten UAE organisations didn’t detect the latest instance of excessive access in real time or within 24 hours. The global figure is six in ten.
Business pressure plays a part. When deadlines demand speed, 41% of UAE respondents say their organisation lets teams find workarounds without formal approval, or grants temporary access and reviews it later.
While 98% say approval from a named individual is required at least sometimes before AI gets access to a new sensitive data source, only 35% can always trace a sensitive access event back to a named human authoriser.
According to the survey, just 16% of UAE organisations have real-time controls that can both revoke an AI tool’s credentials and end its session immediately (less than half the 35% recorded globally).
Delinea advice is for organisations to limit access to what each task needs, keeping a defensible link to the approving person, and ending credentials and sessions when the task finishes or risk changes.
ZOOM OUT - The UAE has moved faster on agentic AI than almost anywhere else in the world. Agentic AI is becoming widespread and leading adopters are implementing at scale. HP's recent Work Relationship Index found that 57 percent of the UAE’s office workforce use AI agents, well above the global average of 43 percent. Meanwhile, Dataiku's 2026 CIO survey found that 62 percent of UAE CIOs run more than 50 AI agents in production, and 15 percent run more than 500, the highest of any market. The same survey found that only 5% of UAE CIOs say that they can reliably contain a problem agent within one to two hours.
[Written and edited with the assistance of AI]
Source: Delinea
DOWNLOAD
Read more about AI governance and security:
UAE firms run AI agents at massive scale (Middle East AI News)
IBM: Middle East’s average data breach cost reaches $8M (Middle East AI News)
Quarter of UAE, Saudi firms run AI unchecked (Middle East AI News)
Many UAE firms unprepared for AI risk (Middle East AI News)
AI failure could put 79% of UAE CEO jobs on the line (Middle East AI News)