There is a particular kind of optimism that takes hold when AI starts working. Pilots ship. Teams accelerate. Leadership starts quoting efficiency gains. It feels like momentum, and across the GCC right now, that momentum is unmistakable. 

1. Saudi Arabia just ranked second globally in data centre market attractiveness, with operational capacity growing from 68 megawatts in 2021 to 467 megawatts in early 2026.  

2. Dubai’s Crown Prince recently announced a two-year programme to accelerate agentic AI adoption across the emirate’s private sector.  

3. And the UAE Cyber Security Council, in partnership with Cisco and Open Innovation AI, has launched a National AI Test and Validation Lab in Abu Dhabi, a sovereign facility designed to certify AI systems for security, safety and trustworthiness at scale. 

The ambition is unmistakable and the infrastructure is being built. The question is whether governance is keeping pace. 

The deployment-accountability gap 

The honest answer, based on the data, is that it is not. 

McKinsey’s State of AI survey, drawn from nearly 1,500 respondents across 101 countries, found that only 28% of organisations say their CEO is responsible for AI governance oversight. Just 17% say their board is. Yet more than three-quarters of those same organisations report using AI in at least one business function. Broad deployment, thin accountability. That gap is where the hidden cost lives. 

McKinsey’s April 2026 AI Transformation Manifesto, drawing on hundreds of large-scale AI transformations, is direct about what separates companies that are actually rewired for AI from those that are not: it is not the tools they use, those are broadly available, but how they apply them at scale, with clear accountability, data infrastructure that works, and governance structures that can handle the trust demands of autonomous systems. On that last point, McKinsey is explicit: 

“The excitement for agentic AI may be getting ahead of companies’ ability to manage the more complex risks associated with the technology.” 

Gartner adds the structural dimension. In a November 2025 survey of over 700 CIOs, it found that by 2030, no IT work is expected to be done without AI in some capacity: 75% augmented by humans working with AI, 25% by AI alone. That is a profound transformation of how organisations operate. It also raises a straightforward question: if AI is going to touch everything, what happens when the governance infrastructure does not? 

What ungoverned AI actually costs 

The costs are rarely dramatic. There is no single incident that announces the problem. The damage accumulates quietly: models producing outputs no one is auditing; AI tools adopted at team level that procurement, legal and IT know nothing about; autonomous processes embedded in workflows with no clear owner when something goes wrong. 

The most instructive recent finding on this came from Gartner in May 2026, based on a survey of 350 global business executives. Among enterprises piloting or deploying autonomous capabilities, roughly 80% have made workforce reductions as part of their AI programmes. The assumption is that headcount reduction equals AI returns. The data says otherwise. Workforce reduction rates were nearly equal among organisations reporting high ROI and those experiencing modest or negative outcomes. As Gartner’s Helen Poitevin put it:

“Workforce reductions may create budget room, but they do not create return. Organisations that improve ROI are not those that eliminate the need for people, but those that amplify them.” 

The pattern is consistent with what McKinsey’s research finds about high-performing AI companies. These are not organisations that raced to automate headcount. They concentrated their AI investment on one to three business domains, reinvented those end-to-end, and achieved an average 20% EBITDA uplift with a payback period of one to two years. That kind of return requires governance architecture: clear accountability for business KPIs, stage-gated investment, and operational controls that allow AI to scale without compounding risk. 

For organisations in the GCC, the regional context is sharpening the stakes. The UAE’s new National AI Test and Validation Lab assesses systems across six dimensions: model security, threat defence, data integrity, supply-chain security, agent autonomy and regulatory compliance. AI systems that pass receive a national certification mark. That is a signal that sovereign assurance is becoming a commercial requirement.  

Where most organisations actually are 

The McKinsey Manifesto identifies 12 capabilities that separate transforming companies from their peers, from strategic road mapping and data infrastructure to adoption frameworks and trust architecture. Fewer than one-third of organisations have implemented most of them. 

The governance gap is not, in most cases, a knowledge gap. Leaders broadly understand that AI needs oversight. The challenge is that governance work is unglamorous, politically complicated and cross-functional in ways that buying another tool is not. It forces difficult conversations about ownership, “who is accountable when an AI system makes a consequential decision?”, before those questions are forced by a regulator, an auditor, or a client. 

That discomfort, deferred, is where the hidden cost compounds. And as agentic AI moves from pilots into production across GCC enterprises, the window for getting the foundations right is narrowing. 

Starting where you are 

The practical question is not whether to govern AI. That is no longer optional. The question is where to begin, particularly in organisations that have already deployed tools without a governance framework underneath them. 

A useful starting point is understanding your current AI maturity across the dimensions that actually drive value: data readiness, accountability structures, risk controls, and operating model alignment. Not as an audit exercise, but as a diagnostic that tells you where to invest next. 

HEMOdata’s AI Readiness Workbook is built for exactly this. It gives data and AI leaders a structured way to assess where their organisation sits and to identify the governance priorities that will unblock real value rather than just add process overhead. 

The region is investing heavily in the infrastructure to run AI. The organisations that capture that investment will be the ones that build the governance to run it well. 

Sources: McKinsey & Company, The State of AI: How Organizations Are Rewiring to Capture Value (March 2025); McKinsey & Company, The AI Transformation Manifesto (April 2026); Gartner, Survey Finds Artificial Intelligence Will Touch All Information Technology Work by 2030 (November 2025); Gartner, Autonomous Business and AI Layoffs May Create Budget Room, but Do Not Deliver Returns (May 2026); Middle East AI News, UAE Launches First National Lab to Test and Certify AI Systems (May 2026); Saudi Press Agency / Arab News, Saudi Arabia Ranks Second Globally in Data Center Market Attractiveness (May 2026).