Introduction

Artificial intelligence is transforming MENA enterprises at an accelerating pace. The same technology that creates competitive advantage also creates governance obligations that most organisations have not systematically structured. AI governance — the framework of policy, process, decision rights, and accountability that ensures AI systems are developed, deployed, and operated responsibly — has become a strategic requirement for MENA organisations deploying AI at any scale. Yet most MENA organisations approach AI governance as an afterthought, adding compliance review after models are already deployed or treating governance as a documentation exercise rather than a living management system. This is the wrong sequence and the wrong approach. AI governance must be designed before models are built, deployed alongside models, and continuously adapted as the AI portfolio and regulatory environment evolve.

This article provides a comprehensive framework for AI governance in MENA organisations. It addresses the purpose and scope of AI governance, the governance structure — roles, committees, and decision rights — required for AI, the governance lifecycle from development through deployment and operation, the regulatory compliance layer specific to MENA frameworks including CBUAE, SAMA, SFDA, DHA, NCA, NESA, and PDPL requirements, the technical controls that enforce governance through technology, the continuous monitoring requirement that ensures governance remains current, and the maturity model that organisations can use to assess their own governance capability and plan their development roadmap. This is a governance framework designed for MENA enterprises — calibrated to the regulatory environment, the governance culture, and the AI deployment patterns characteristic of organisations operating across the GCC and wider MENA region.

Purpose and Scope of AI Governance

AI governance exists to achieve three purposes. First, to ensure that AI systems produce outcomes that are correct, fair, safe, and aligned with the organisation’s strategic intent and values. Second, to ensure that AI systems comply with the regulatory requirements that apply to their development, deployment, and operation — including requirements that are AI-specific and that traditional IT governance frameworks were not designed to address. Third, to create accountability — clear ownership and responsibility for AI systems throughout their lifecycle so that decision-makers can be held to account and so that organisations can demonstrate to regulators, boards, and stakeholders that AI has been responsibly developed and deployed.

The scope of AI governance covers the full AI lifecycle: the development phase in which models are designed, trained, validated, and prepared for deployment; the deployment phase in which models are integrated into production systems and made available for inference; the operational phase in which models serve live inference requests, are monitored for performance and risk, and are periodically reviewed for continued fitness; and the decommissioning phase in which models are retired and associated data and infrastructure is managed appropriately.

AI governance is distinct from — but connected to — data governance. Data governance addresses how data is managed, classified, secured, and used. AI governance addresses how AI systems that use that data are developed, deployed, and operated. Data governance provides the foundation on which AI governance sits: data quality requirements, data lineage requirements, data access controls, and data classification requirements all feed into AI governance controls. The relationship is that data governance enables AI governance: an AI governance framework cannot be effective without effective data governance underneath it. Conversely, data governance alone does not ensure AI governance: the additional controls, decision rights, and accountability mechanisms that AI governance requires are not provided by data governance.

Governance Structure for AI

AI governance requires defined organisational structure with clear roles, responsibilities, and decision rights. The governance structure typically includes three levels: board-level governance, executive AI governance, and operational AI governance.

Board-Level AI Governance

Board-level AI governance establishes the strategic direction, risk appetite, and accountability framework that governs the organisation’s AI portfolio. The board’s role includes approving the AI strategy and ensuring alignment with organisational strategy and stakeholder expectations; approving the AI risk appetite — the organisation’s tolerance for AI-related risk across different risk categories; receiving and reviewing AI portfolio performance and risk reports on a regular cadence; overseeing AI governance framework effectiveness; and exercising fiduciary responsibility for AI investments and AI-related risks. Board AI governance is most effective when it is integrated into existing board governance structures — typically through a technology or digital transformation committee — rather than requiring a separate AI committee at board level, which increases organisational complexity for modest additional value.

The board AI governance responsibility should be supported by AI briefing materials that translate technical and regulatory AI developments into strategic language appropriate for board consumption. These briefings should cover: the organisation’s AI portfolio status — models in development, production, and pipeline; performance and risk status of production AI systems; regulatory developments affecting AI compliance; emerging AI risks and how they are being managed; AI investment and return status; and any AI governance incidents or near-misses that require board attention. Regular board briefings ensure that boards develop sufficient AI literacy to govern AI effectively.

Executive AI Governance

Executive AI governance sits at C-suite or senior management level and translates board-level AI governance into operational governance. The primary governance forum is typically an AI Steering Committee or AI Governance Committee, chaired by the Chief Data Officer, Chief Technology Officer, or a designated Chief AI Officer. Committee membership typically includes representatives from data, technology, risk, compliance, legal, business, and finance — ensuring that all dimensions of AI governance are represented at the decision-making level.

The Steering Committee’s responsibilities include: approving AI use cases for development based on business case, risk profile, and portfolio alignment; reviewing and approving high-tier AI models for deployment after independent validation; reviewing AI model performance reports on a regular cadence; approving policy decisions that affect AI governance across the organisation; and escalating significant AI governance issues — model failures, regulatory concerns, ethical issues — to the CEO or board as appropriate.

The Model Risk Committee, which may be a subcommittee of the AI Steering Committee or a separate function depending on regulatory requirements, focuses specifically on model risk. MRC responsibilities include: maintaining the model inventory; classifying models by risk tier; approving validation methodology; reviewing independent model validation reports; approving model deployment and change decisions; and reviewing model performance against defined thresholds. For CBUAE-regulated financial institutions, the MRC is effectively mandatory; for organisations not subject to CBUAE, establishing MRC-equivalent function is nonetheless best practice for managing AI risk at scale.

Operational AI Governance

Operational AI governance covers the day-to-day governance activities that ensure AI systems are developed, deployed, and operated in accordance with governance policy. This includes AI data governance — ensuring that training data, validation data, and inference data meet quality, lineage, consent, and classification requirements; model development governance — ensuring that development follows defined lifecycle processes with appropriate review gates; model validation governance — ensuring that independent validation is performed before deployment and that validation meets defined standards; deployment governance — ensuring that deployment decisions are made through appropriate approval processes; and operational monitoring governance — ensuring that production models are monitored for performance, drift, bias, and risk, and that monitoring results are reported and acted on.

The AI Governance Lifecycle

AI governance is not a point-in-time event. It is a continuous process that tracks AI systems through their lifecycle. The AI governance lifecycle comprises five phases, each with defined governance activities and gates.

Phase One: Use Case Governance

The first governance gate occurs at the use case stage — before any model development begins. Use case governance examines the business case underpinning the proposed AI initiative, the data that would be required, the risk profile associated with the use case, the regulatory requirements that would apply, the resource requirements, and the expected return on investment. Use case governance determines whether the use case proceeds to development, proceeds with modifications to address governance concerns, or is not approved. This is the highest-leverage governance gate: decisions made at use case stage prevent wasted investment in AI initiatives that would not be compliant or would not deliver sufficient value.

Use case governance requires specific information from the proposing team: a business case articulating the problem being addressed, the proposed AI approach, expected outcomes, and investment requirements; a data assessment identifying the data that would be used, its quality, its source, and its compliance status — including legal basis for use under PDPL or equivalent; a risk assessment identifying the AI-specific risks that the use case creates — bias risk, fairness risk, security risk, compliance risk, reputational risk; a regulatory map identifying the applicable regulations and compliance requirements; and a proposed governance approach specifying how the AI system would be governed through development, deployment, and operation.

Phase Two: Development Governance

Development governance oversees the model development process, ensuring that AI systems are built with appropriate rigour and in accordance with governance requirements. Development governance activities include: approval of model development plans specifying development approach, data sources, validation methodology, and timeline; periodic development reviews — at checkpoint intervals appropriate to the model’s complexity and risk tier — that examine development progress, data quality, preliminary performance results, and emerging risks; requirement for documented development processes including experiment tracking, version control for data and models, and change management; and early identification of governance issues that may require escalation or use case reconsideration.

For high-risk use cases, development governance may require independent technical review at key development milestones, ethical review of data selection and model design, and bias testing on training data and preliminary model outputs to identify fairness concerns before they become embedded in production models.

Phase Three: Validation Governance

Validation governance addresses the requirement that AI models be independently validated before deployment. Validation governance specifies: the validation methodology — what tests will be performed, what metrics will be measured, what acceptance criteria must be met; the independence requirement — that validation must be performed by a function independent of the model development team; the documentation requirement — that validation produces documented evidence covering performance, robustness, bias, fairness, security, and compliance; and the approval requirement — that validated models are not deployed until validation results have been reviewed by the MRC or equivalent and deployment is formally approved.

Validation governance prevents the most common AI deployment failure — models deployed without adequate validation, producing incorrect, unfair, or non-compliant outputs in production that require rapid remediation under stakeholder scrutiny. The cost of inadequate validation is measured not only in remediation cost but in regulatory exposure and stakeholder trust that is difficult to rebuild once lost.

Phase Four: Deployment Governance

Deployment governance oversees the transition from validated development model to production. Deployment governance activities include: deployment plan review — ensuring that deployment architecture, rollback procedures, monitoring requirements, and incident response plans are in place before deployment; production readiness verification — confirming that production infrastructure meets governance requirements for security, data residency, audit logging, and compliance; deployment approval — formal decision by the MRC or equivalent to permit production deployment; deployment execution monitoring — monitoring deployment for issues in the immediate post-deployment period; and deployment documentation — updating model registry, model documentation, and governance records with deployment-specific information.

Phase Five: Operational Governance

Operational governance covers the full production life of AI models. This is the governance phase that is most commonly neglected, yet it is the phase during which the longest-term governance risks — model drift, concept drift, bias amplification, performance decay, data quality degradation, adversarial exploitation — emerge and compound over time.

Operational governance requirements include: performance monitoring — continuous or periodic measurement of model performance against defined thresholds and reporting of performance degradation; drift monitoring — detection of changes in input data distributions, output distributions, and feature distributions that may indicate model degradation; bias monitoring — periodic fairness testing across protected or relevant demographic groups, with alerting when fairness metrics breach thresholds; security monitoring — monitoring for adversarial inputs, data extraction attempts, and model manipulation; compliance monitoring — verification that operational AI systems continue to meet regulatory requirements as regulations evolve; and periodic review — scheduled review of production models at intervals determined by risk tier, with review findings feeding into update, retraining, or retirement decisions.

Operational governance is where most MENA organisations currently under-invest. The infrastructure for continuous monitoring and alerting on AI performance in production does not exist in most organisations, primarily because most MENA organisations are still in the early stages of AI deployment and have not yet encountered the degradation patterns that monitoring is designed to detect. Organisations that build monitoring infrastructure early — before they have enough production models to generate review fatigue — will find that the infrastructure pays dividends as their AI portfolio grows.

AI Governance in MENA Regulatory Context

CBUAE Requirements

CBUAE’s AI governance expectations for licensed financial institutions apply to every AI model used in customer-facing, decision-making, or regulatory-reporting contexts. The requirements span governance structure, model lifecycle management, validation, monitoring, and reporting. CBUAE expects financial institutions to demonstrate that AI governance is integrated into enterprise risk management rather than operating as an isolated AI-specific function. This integration is significant: AI risk should be treated as equivalent to credit risk, market risk, operational risk, and compliance risk — with the same governance rigour, reporting cadence, and board oversight.

CBUAE’s model inventory requirement — centralised, maintained, current — applies specifically to AI models and must be reviewed at supervisory review. The model classification system — risk-tiering based on customer impact and regulatory reporting impact — determines the validation and monitoring rigour applied to each model. AI governance documentation must be available to CBUAE on request and must be comprehensive enough to allow CBUAE to form its own assessment of AI model risk independent of the institution’s assertion of compliance.

SAMA AI Requirements

SAMA’s model risk management framework applies to AI models implicitly and explicitly: AI models used in financial decision-making are subject to the same model risk requirements as statistical and econometric models. The core requirements — identified model inventory, model validation by independent function, model performance monitoring, and board reporting — apply to AI directly. SAMA has signalled that AI model governance will receive increasing supervisory attention as AI deployment in Saudi financial services grows, and institutions that have not yet fully implemented AI governance aligned to SAMA expectations should prioritise doing so before supervisory review visits.

Healthcare AI Governance: SFDA and DHA

Healthcare AI governance spans clinical governance — patient safety, clinical effectiveness, and clinical accountability — and regulatory governance — SFDA and DHA compliance requirements. The governance structure must include clinical oversight: a mechanism by which clinical professionals review, validate, and monitor AI clinical decision support systems. For SFDA-classified AI medical devices, clinical evidence requirements, technical documentation requirements, and post-market surveillance requirements must be embedded in AI governance processes. For DHA-registered systems, registration requirements, audit trail requirements, and consent management requirements must be governance-managed.

Government AI Governance: NCA, NESA, UAE AI Charter

Government AI governance — for systems used in or by government, processing government data, or processing citizen data — requires security governance in addition to standard AI governance controls. NCA Essential Cybersecurity Controls must be applied to AI infrastructure, model serving systems, and data pipelines. NESA UAE Information Assurance Standards apply to UAE government AI systems. The UAE AI Charter requires governance documentation demonstrating AI risk assessment, human oversight, transparency, and accountability. The AI Charter applies to government AI deployments but also to private sector AI systems that process government data or affect government service delivery — a broad scope covering many MENA AI deployments.

PDPL Compliance in AI Governance

Data protection compliance is embedded throughout AI governance rather than addressed as a single governance activity. Training data compliance — verifying legal basis, consent, minimisation, and retention requirements — occurs at development stage and must be documented. Inference data compliance — how data sent to production models is handled, retained, and protected — is an operational governance concern. Output compliance — ensuring that model outputs comply with data protection requirements — must be verified. Data subject rights — rights of access, correction, deletion, restriction, and objection to automated decision-making — require governance processes that can respond to data subject requests against AI systems.

Technical Controls for AI Governance

Governance is implemented through policy and process, but policy and process are only effective when enforced through technical controls. AI governance requires technical infrastructure that implements governance requirements in ways that are difficult to circumvent.

Model Registry and Model Governance Platform

A model registry or governance platform is the centralised repository for all AI governance information about deployed models. The registry maintains: model identity and version; model owner and custodian; development and deployment dates; risk tier classification; governance documentation location; performance metrics and monitoring results; validation reports; approval records; and any governance events — incidents, changes, retraining events, privilege changes. The registry provides a single source of governance truth that enables governance reporting, audit preparation, and regulatory review. Several commercial and open-source governance platforms address AI governance requirements; organisations with complex AI portfolios should invest in a governance platform from the outset rather than managing governance documentation through ad-hoc systems.

Data Lineage and Quality Monitoring

Data lineage — tracking the provenance of every data element from source through transformation to model input — is essential for AI governance because it enables understanding of why models behave as they do when performance changes. When a model’s performance degrades, lineage investigation traces the degradation to its source: a data change, a schema change, a upstream processing change, a data supplier change. Lineage is also required for regulatory compliance: demonstrating to CBUAE, SAMA, or PDPL authorities where a model’s training and inference data originated and what processing it underwent. Data quality monitoring provides continuous assessment of the quality of data entering AI systems, with alerts when quality thresholds are breached.

Model Performance and Drift Monitoring

Continuous monitoring infrastructure implements the operational governance requirement for ongoing model assessment. Monitoring infrastructure tracks model performance metrics — accuracy, precision, recall, F1, latency, throughput — across time and alerts when performance degrades below defined thresholds. Drift monitoring — detecting changes in input data distribution, output distribution, or feature distributions — alerts when environmental changes may degrade model performance even before performance metrics decline. Both types of monitoring are required for operational governance: performance monitoring validates the model’s continued fitness for purpose, and drift monitoring detects the conditions that produce performance degradation before they affect model behaviour.

Explainability and Audit Logging

Explainability infrastructure produces explanations for individual model predictions that are suitable for governance review, customer communication, and regulatory reporting. For high-risk AI use cases — credit decisions, fraud decisions, healthcare recommendations, eligibility decisions — the ability to explain why a model produced a particular output is both a governance requirement and a regulatory requirement under PDPL and emerging AI governance frameworks. Audit logging creates tamper-evident records of all model decisions, governance actions, and governance events that can be produced to regulatory authorities and auditors on request.

Model Risk Committee: Operationalising Highest-Level AI Governance

A well-functioning Model Risk Committee is the operational centre of an AI governance programme. The MRC is not a passive review body — it is an active decision-making forum with the authority to approve or reject models, recommend governance changes, and escalate issues to the board. The MRC should be composed of: independent senior representation — the Chief Risk Officer or equivalent, the CTO or CIO, the Head of Data or CDO, an independent senior representative from an AI-expert function that is not directly involved in model development; a defined charter specifying scope, authority, decision rights, meeting cadence, and escalation procedures; a structured review process with defined inputs — model documentation, validation reports, compliance assessments, risk assessments; and documented decision records — every MRC decision must be documented with rationale, conditions, and follow-up requirements.

MRC effectiveness depends on preparation: quality documentation prepared before MRC review, clear risk frameworks that enable comparative assessment across models, and MRC members who have developed AI literacy sufficient to provide substantive oversight rather than rubber-stamping developer recommendations. Board investment in MRC capability — through MRC member AI training, expert briefings, and structured MRC meetings with agenda and documentation standards — is among the highest-ROI governance investments an organisation can make.

AI Governance Maturity Model