01Shadow AI, defined for a regulated Gulf institution
Almost every bank, insurer and government entity in the Gulf now runs AI systems it did not register. Some are chat assistants in a browser tab. Some are extensions, coding agents or AI features inside software you already approved.
Policy, audit and procurement need one shared definition. We suggest this one.
Shadow AI is any AI system that processes the institution's data but is not on the institution's AI register. A system is registered when it has a named owner, an approved use, a risk assessment, a contract, and a list of the data classes it may receive.
The definition does not depend on the brand. A well-known assistant is still shadow AI on a personal account. The test is simple: can you show a regulator who used it, what data went in, and which control applied?
In practice, shadow AI takes three forms:
- Unsanctioned apps. Public chat, translation, transcription and coding tools that nobody approved.
- Sanctioned apps through personal accounts. The approved tool, used on a personal login that sits outside your contract and your logs.
- Embedded and autonomous AI. Browser extensions, AI features in approved SaaS, desktop AI apps, local models, coding agents and MCP servers.
02Why shadow AI is a data leak, not an IT hygiene issue
Many institutions file shadow AI under IT asset management. That framing is too small. Each prompt, paste or upload is a transfer of data to a third party. When the account is personal, that third party has no contract with you, no processor terms and no obligation to keep the data in the country.
The Verizon 2026 Data Breach Investigations Report (DBIR) shows the scale.
Source: Verizon DBIR 2026, as summarised by Suzu Labs
The same report ranks shadow AI as the third most common non-malicious insider action in DLP datasets. Source code is the number one data type uploaded to unauthorised AI services. And 15% of users run unauthorised AI browser extensions, which can read the pages they sit on.
Now apply this to a Gulf institution. A claims handler pastes a claim note into a personal chat account. The note holds the claimant's Emirates ID and IBAN. Personal data has now left the institution. Under the UAE PDPL, or the Saudi PDPL for a Saudi data subject, that raises questions about lawful processing, processor controls and cross-border transfer. Those questions belong to the DPO, the CISO and the incident process.
The harder problem is visibility. Most legacy controls were built to watch files. AI use happens in sessions.
Figure 1. The session blind spot. File-based controls see one lane of four.
03Why bans fail
The first reaction is often to block the best-known AI domains. It feels decisive. It fails for five reasons.
- Use moves, it does not stop. When the corporate path is closed, staff switch to personal accounts, personal phones or less known tools. The DBIR figure of 67% on non-corporate accounts shows this move has already happened.
- Block lists lag. New AI apps, extensions and features appear every week. Many arrive inside approved software, so a domain list never catches up.
- The control sees the wrong thing. Proxies and legacy DLP see domains and files. They do not see the prompt text, the paste or the agent tool call (Figure 1).
- There is no approved path. A ban tells staff what not to do but not what to do instead. Exceptions follow, and without an expiry date they become permanent.
- A ban produces no evidence. A block rule shows what was stopped. It cannot show what was used, by whom, with which data. A supervisor will ask exactly that.
The goal is not zero AI. The goal is known AI: every tool on the register, controls at the moment of use, and a record that proves it.
04What AI Usage Control is
AI Usage Control is the set of controls that discovers AI use, classifies the data in each interaction, applies a policy decision at the moment of use, and keeps a record that proves it. It works at the level of the session and the prompt, not the file or the domain.
Figure 2. The AI Usage Control loop. Each step feeds the next.
Discover
Build an inventory of every AI app, AI browser extension, desktop AI app, local model, agent and MCP server in use. For each one, record whether the account is corporate or personal, and who uses it. For agents and MCP servers, record the tools and data they can reach.
Classify
Inspect what goes into each interaction across three lanes: the prompt, the paste and the upload. Label it with data classes that match your institution. For Gulf institutions, generic "PII" is not enough. You need Emirates ID, Saudi National ID, Iqama, IBAN, card numbers, MNPI, source code and secrets as separate classes.
Govern
Class each app as sanctioned, tolerated or unsanctioned. Then set a decision per app, per user group and per data class. Identity comes from your SSO. Every exception has a named approver and an expiry date.
Prove
Keep a decision log with timestamps and user attribution. Map it to the frameworks you report against. Export it to your SIEM and to a format an auditor can read.
AI Usage Control does not replace DLP, CASB or SSE. It fills the session gap those tools leave. SentraGuard, from SovereignAI Security Labs, is one implementation. It covers the browser, IDEs, an SDK and API gateway, and an endpoint agent, with one backend that can run in the cloud, on premise or air gapped.
05The four decisions
"Allow or block" forces a choice between risk and productivity. Four decisions let you match the control to the data.
Figure 3. The four-rung ladder. Use the lowest rung that controls the risk.
Here is one worked example for each rung. The people and scenarios are illustrative.
Allow Public text, sanctioned app
UAE bank · compliance analyst
An analyst asks the bank's sanctioned assistant, on a corporate account, to summarise a public CBUAE consumer protection notice. No regulated data class is present. The prompt proceeds and the event is logged. The log builds the usage baseline.
Coach Personal account, no sensitive data
Saudi insurer · underwriter
An underwriter opens a tolerated public chatbot on a personal account to rewrite a broker email. No sensitive data is detected. A banner names the corporate assistant and links to it. The prompt proceeds.
Redact Emirates ID and IBAN in a claim note
UAE insurer · claims handler
A claims handler pastes a claim summary into the sanctioned assistant. The text contains the claimant's Emirates ID and IBAN. Both identifiers are stripped before the prompt leaves. The rest goes through, so the handler still gets a useful summary.
Block Iqama and National ID list to an unsanctioned tool
Saudi government entity · HR officer
An HR officer pastes a staff list with Iqama numbers and Saudi National IDs into an unsanctioned translation site. The paste is stopped and logged. The officer sees the reason and the approved translation route. The same rung fits MNPI sent to any public tool, and source code with API keys sent to an unapproved coding assistant.
Start with a simple matrix and tune it by user group. This is a sample starting policy, not a recommendation for every institution.
| Data class | Sanctioned app | Tolerated app | Unsanctioned app |
|---|---|---|---|
| No regulated data | Allow | Coach | Coach |
| Customer PII | Redact | Redact | Block |
| Emirates ID, Saudi National ID, Iqama | Redact | Block | Block |
| IBAN, card number (PAN) | Redact | Block | Block |
| API keys and secrets | Redact | Block | Block |
| Source code | Allow (approved IDE assistant) | Block | Block |
| MNPI | Block, unless an approved exception | Block | Block |
06Agents and MCP servers
Agents do not wait for a prompt. They read files, call APIs, run commands and write results. MCP servers give a model tools and data sources through one standard interface. Developers install both in minutes, without procurement.
This changes the risk in three ways.
- Data moves through tool calls, not typed text. A coding agent that queries a customer database sends the result to the model provider. No human pasted anything.
- Write access matters. An agent that can only read is a disclosure risk. An agent that can write to a repository, a ticket system or a database is also an integrity risk.
- Local does not mean registered. A model running on a laptop through Ollama or LM Studio keeps data on the device. It is still an unregistered AI system under the definition in section 1.
The controls follow the same loop. Discover every agent and MCP server, with the tools and data each can reach. Flag those with write access. Then apply the same four decisions to tool calls. If a tool call returns rows with IBANs and the agent is about to send them to a public model, redact or block. Record the decision like any other.
Ask your developers one question this week: which MCP servers are configured on your machine, and what can they reach?
07What UAE and Saudi regulators expect
No Gulf regulator has a rule called "shadow AI". The expectations already sit in frameworks on outsourcing, data protection, asset management and logging. The table summarises them in general terms. Confirm the current text with your legal and compliance teams.
| Framework | What it expects | Evidence that answers it |
|---|---|---|
| CBUAE regulations and standards | Control of outsourcing and third parties, consumer data protection, incident reporting | Inventory of AI providers in use, corporate vs personal; decision log; incident records |
| UAE Information Assurance Regulation | Asset inventory, data classification, monitoring and logging | AI app inventory; data class on each event; logs in the SIEM |
| UAE PDPL (Federal Decree-Law 45 of 2021) | Lawful processing, processor controls, cross-border transfers | Record of which personal data reached which provider; redaction and block records |
| DIFC Data Protection Law 2020; ADGM Data Protection Regulations 2021 | Lawful processing, processor obligations, cross-border transfers | The same records, filtered by legal entity |
| SAMA Cyber Security Framework | Data leakage protection, logging, third-party security | Redact and block decisions with timestamps; SIEM feed; AI third-party list |
| NCA Essential Cybersecurity Controls | Asset management, event logging, external and cloud services | Inventory that includes agents and MCP servers; retained event logs |
| Saudi PDPL | Processor controls, transfer restrictions, breach notification | Per-event record of personal data in prompts; blocked transfers; timeline for notification decisions |
| SDAIA AI Ethics Principles | Accountability, privacy, transparency | Named owner per app; user attribution; exceptions with approver and expiry |
| ISO/IEC 42001; NIST AI RMF | An AI management system; Map, Measure, Manage, Govern | Inventory (Map); usage metrics (Measure); policy decisions (Manage); exception review (Govern) |
Under the Saudi PDPL (Royal Decree M/19), disclosure of sensitive data with intent to harm or for personal benefit can lead to up to 2 years' imprisonment and a fine of up to SAR 3 million, or either. Other violations carry administrative fines of up to SAR 5 million. Fines can be doubled for repeat offenders (DLA Piper). SDAIA moved to active enforcement of the PDPL in 2026 (Global Privacy Blog).
08Evaluation checklist: 12 questions for any vendor
Use these questions in an RFI or a first call. Ask for the answers in writing. A vague answer to any of them is a finding.
| # | Question | What a good answer looks like |
|---|---|---|
| 1 | Surfaces. Which surfaces do you cover: browser, IDE, API and SDK, desktop apps, CLI agents? | A named list per surface, with gaps stated |
| 2 | Personal accounts. Can you tell a corporate account from a personal account in the same app? | Yes, per session, visible in the inventory |
| 3 | Gulf data classes. Do you detect Emirates ID, Saudi National ID, Iqama and IBAN? How do you handle Arabic text? | Named detectors; a test on your own samples during the pilot |
| 4 | On premise and air gap. Can the backend run on premise or air gapped? Does any data reach the vendor then? | Yes; no data leaves; updates arrive as signed bundles |
| 5 | Data residency. In a cloud deployment, where are prompts and logs processed and stored? | A named region, written into the contract |
| 6 | Agent coverage. Do you discover agents and MCP servers? Can you act on tool calls? | Inventory with tools, data reach and write access; the same decisions on tool calls |
| 7 | Evidence format. What does an auditor receive? | Inventory, timestamped decision log, exceptions, framework map, signed export; PDF and CSV |
| 8 | SIEM. Which SIEMs do you feed? | Your SIEM by name, for example Splunk, IBM QRadar, Microsoft Sentinel or ArcSight |
| 9 | Deployment time. How long from contract to first inventory? | Days, through your existing device management; a written deployment guide |
| 10 | Pilot. Will you run a short pilot on one business unit, on our data, with live controls? | Yes, with a fixed length and fixed deliverables |
| 11 | Licensing. What is the licence unit? | A clear unit, such as per protected user per year, that does not grow with prompt volume |
| 12 | Exit. If we leave, what do we keep? | Full export of logs and evidence in open formats; clean removal through device management |
Ask every vendor, including SentraGuard, to answer all twelve before you start a pilot. Then check the answers during the pilot.
09A 90-day rollout plan
You can govern the first business unit in one week, then scale to the whole institution within a quarter. See first, decide second, enforce last.
| When | Phase | Actions | Output |
|---|---|---|---|
| Day 0 | Discover | Deploy to the first business unit. Push the browser plugin and endpoint agent through Intune, Jamf or Google Admin. | First inventory the same day: apps, personal accounts, agents and MCP servers |
| Days 1 to 7 | Govern the first unit | Class apps as sanctioned, tolerated or unsanctioned, and agree data classes with the DPO. Switch on Coach and Redact, then Block for unsanctioned tools. Set up exceptions with an approver and an expiry date. | Full governance of the first unit: all four decisions live; first evidence pack |
| Weeks 2 to 6 | Scale | Extend to more business units. Name an owner per app. Tune policies per user group. Tell staff what the approved path is. | Decision log across units; exception register |
| Weeks 7 to 13 | Prove at scale | Cover the remaining units. Connect the SIEM. Review exceptions that are near expiry. | Institution-wide evidence pack; quarterly report to the board risk committee |
SentraGuard's one-week Shadow AI Governance pilot covers the first two phases for one business unit. It is not observe-only. On day 0 you deploy and see a first shadow AI inventory the same day. Days 1 to 2 classify apps and map sensitive data by class and lane, with the corporate vs personal split. Days 3 to 4 put Coach and Redact live for the pilot groups. Days 5 to 6 add Block for unsanctioned and training-by-default tools, with exceptions that carry an approver and an expiry date. On day 7 all four actions are live, and you receive an AI Usage Evidence Pack, an executive readout and a quote priced from the pilot data.
What does a quarter-end report look like? The figures below come from a demo tenant. They are not customer data.
2,140 users in scope. 63 AI apps discovered, 41 with personal-account sessions. 9 agents and MCP servers, 4 with write access. Decisions: 18,402 allow, 1,207 coach, 388 redact, 52 block. 212 prompts with regulated data.
10Frequently asked questions
Is AI Usage Control the same as DLP?
No. DLP is built around files, email and known channels. AI Usage Control works inside the AI session and keeps an inventory of AI apps and accounts. The two work together and should feed the same SIEM.
Do we need to block public chat assistants?
Not by default. Block the combinations that carry real risk, such as national IDs or MNPI sent to unsanctioned apps. Coach the rest. A blanket ban moves use to personal devices.
Does this mean we read every employee prompt?
It means prompts are inspected for data classes, in the same way email is inspected for DLP. Tell staff what is inspected and why. Limit access to the logs by role. Set a retention period. Involve HR and your DPO before you start.
What about AI features inside software we already approved?
Treat them as AI systems in their own right. Put each on the register with an owner and a list of permitted data classes. Approval of the host software does not approve every AI feature added to it later.
How long does it take?
Discovery starts on the day you deploy. One business unit can reach full governance, with all four decisions live, in one week. Scaling to the whole institution takes about a quarter.
Sources
- Verizon 2026 Data Breach Investigations Report, as summarised by Suzu Labs: "The AI governance gap". suzulabs.com
- DLA Piper, Data Protection Laws of the World: Saudi Arabia, enforcement. dlapiperdataprotection.com
- Global Privacy Blog, "Active enforcement of Saudi Arabia privacy regime: implications for businesses", May 2026. globalprivacyblog.com