Nearly 98% of UAE organisations have experienced confirmed or suspected cases of artificial intelligence (AI) tools accessing sensitive data beyond their assigned tasks. However, only 16% can immediately revoke an AI tool’s credentials and terminate its session, according to new research by identity security company Delinea.
The findings highlight a gap between AI governance policies and the controls needed to enforce them. Although every UAE respondent reported having a formal AI data-access policy, only 59% said their organisation actively enforced it.
Delinea’s 2026 Identity Security Report: The AI Enforcement Gap surveyed 2,004 IT and security leaders across seven countries. The UAE accounted for 251 respondents. The research covered organisations with at least 500 employees that use or pilot AI.
UAE firms struggle to enforce AI data security policies
The survey found that UAE organisations face greater challenges in enforcing AI access controls than the global sample.
While all UAE respondents reported having a formal policy governing AI access to data, only 59% said their organisation actively enforced it. The global figure stood at 71%.
Furthermore, 98% of UAE respondents reported confirmed or suspected cases of AI accessing sensitive data beyond what its task required. Globally, 87% reported similar incidents.
The findings suggest that written policies alone may not prevent AI tools from accessing information they do not need. Organisations must also ensure that technical controls restrict access while AI systems operate.
Detection remains another concern. Seven in 10 UAE organisations failed to detect their latest excessive-access incident in real time or within 24 hours. Globally, the proportion was six in 10.
Consequently, security teams may struggle to identify unauthorised access before it creates wider risks for the business.
Only 16% can immediately stop rogue AI access
The ability to terminate an AI session and revoke its credentials immediately remains limited among UAE organisations.
Only 16% of UAE respondents said their organisations could perform both actions in real time. The global figure was 35%.
This gap matters as companies expand their use of AI agents. These systems can carry out tasks across business applications and access information to complete assigned work. Without effective controls, an agent may retain access beyond what its task requires.
The survey also identified weaknesses in approval tracking. Although 98% of UAE respondents said a named individual’s approval was required at least sometimes before an AI tool could access a new sensitive data source, only 35% could always trace a sensitive access event to a named human authoriser.
As a result, organisations may find it difficult to establish who approved access when investigating a security incident.
Business deadlines can weaken AI governance
Operational pressure also appears to influence how organisations manage AI access.
According to the survey, 41% of UAE respondents said their organisations allow teams to use workarounds without formal approval or grant temporary access and review it later when deadlines demand speed.
Such practices can create gaps between established security rules and everyday business operations.
For employers, the challenge is to maintain safeguards without unnecessarily slowing down teams that use AI to improve productivity. Clear approval processes, limited access rights and effective monitoring can help balance these priorities.
Delinea recommends restricting AI tools to the data required for each task. It also advises organisations to maintain a clear link between access approvals and the individuals who authorise them.
In addition, companies should revoke credentials and terminate sessions when a task ends or when the risk changes.
UAE’s rapid AI adoption raises governance demands
The findings come as organisations in the UAE expand their use of AI agents across workplace operations.
According to separate research cited by Middle East AI News, HP’s Work Relationship Index found that 57% of the UAE’s office workforce used AI agents, compared with a global average of 43%.
Meanwhile, Dataiku’s 2026 CIO survey found that 62% of UAE chief information officers ran more than 50 AI agents in production. Another 15% reported running more than 500, making the UAE the leading market in that survey.
However, the same Dataiku research found that only 5% of UAE CIOs said they could reliably contain a problem AI agent within one to two hours.
Taken together, these findings point to a growing operational challenge for businesses adopting AI at scale. As AI agents gain access to corporate systems and sensitive information, organisations need controls that can respond as quickly as the technology operates.
For business leaders, the priority is therefore shifting beyond setting AI policies. They must also ensure that organisations can monitor access, identify unauthorised activity and stop potentially harmful actions before they escalate.
