- New Gallagher research finds 62% of GCC leaders are increasing AI investment, yet just a third see poor implementation as a risk
- AI is arming cyber criminals with faster, more convincing attacks — from hyper-realistic phishing to deepfakes of executives
- UAE businesses are more alert to the risks, with almost half planning to bring in external AI governance expertise within a year
Gulf businesses are pouring money into artificial intelligence faster than they are building the safeguards to manage it, according to new research by Gallagher, the global insurance brokerage, risk management and consulting firm.
The survey of 100 senior decision makers across Saudi Arabia and the UAE found that 62% are increasing investment in AI and automation, and 45% see AI as the region's single biggest opportunity over the next five years.
Yet only a third (33%) recognise poor implementation as a performance risk, and just 35% identify AI governance as the most underestimated emerging risk facing their sector. That gap is opening at a moment when the technology itself is reshaping the threat landscape. AI is helping threat actors conduct faster, more sophisticated and more convincing cyber attacks, making it increasingly difficult for organisations and their people to tell legitimate activity from malicious intent.
"There's no question that decision makers in the region understand the strategic value of AI — it's seen as an opportunity across every sector," said Jamie Gee, Financial Lines Director at Gallagher in the Middle East & Africa. "What concerns us is the gap between the pace of investment and the level of risk readiness. The question isn't whether AI governance matters, it's whether businesses address it before problems emerge or after."
The nature of those problems is already shifting. AI-generated emails and messages now mirror genuine communications so closely that employees are far more likely to click a malicious link or hand over sensitive information.
Deepfake fraud allows criminals to imitate the voice or appearance of senior executives in order to authorise payments, extract confidential information or bypass security controls. And with AI enabling attackers to automate and personalise their campaigns, businesses are facing threats of greater frequency and precision than ever before.
Despite this, just 28% of respondents flag cybersecurity as an underestimated risk, placing it alongside geopolitical and regional instability (30%), workforce strategy challenges (27%) and supply chain resilience (24%) as areas where exposure may be underestimated.
"The same tools businesses are investing in to drive growth are being used to scale up attacks against them," added Gee. "A convincing email or a familiar voice on the phone used to be enough to establish trust, and that's no longer the case. Good AI governance has to cover how organisations defend against AI as well as how they deploy it, from employee awareness and verification protocols to making sure insurance cover keeps pace with the threat."
Attitudes differ sharply between the two markets. Nearly half of UAE respondents (45%) see poor AI implementation as a business risk, compared with 22% in Saudi Arabia, and 49% of UAE decision makers expect to need external AI governance expertise in the next 12 months, against 27% of their Saudi counterparts. The findings suggest the UAE's early adopters are already anticipating their governance needs, while Saudi businesses risk seeing the gap widen as investment scales.
For all the headwinds, optimism remains the dominant mood.
Alongside AI (45%), digital transformation (39%) and regional economic growth (33%) are seen as the main drivers of value creation over the next five years, while infrastructure investment, workforce development and public-private collaboration are each cited by fewer than one in five respondents.