The Technology Seat on the Gulf Board
Gulf boards have added AI to the risk register without naming who answers for it: the CTO, the CIO and a new chief AI officer each carry only part of it.
- Gulf boards have added artificial intelligence to the risk register faster than they have named a single executive accountable for it.
- The chief technology officer, the chief information officer and, at a small but growing number of groups, a new chief AI officer each carry a share of the accountability, and JOH's reading finds none of the three routinely carries all of it.
- This report does not draw on a proprietary JOH survey. It is built on cited public sources, national AI strategy documents, disclosed board and committee structures, and JOH's own qualitative read from its technology and digital senior mandates, labelled explicitly as observations.
- It sets out what the technology seat actually covers now, where the accountability gap sits, and what a board should do to close it before an AI failure forces the question.
Gulf boards have added artificial intelligence to the risk register faster than they have decided which single executive answers for it. The chief technology officer, the chief information officer and, at a small but growing number of groups, a newly created chief AI officer each hold a genuine piece of the accountability, and JOH Partners' reading of governance practice across its technology and digital senior mandates finds that, at most Gulf boards, none of the three holds all of it. This report sets out what the technology seat on a Gulf board actually covers now that AI has entered it, where the resulting accountability gap sits, and what a board should do to close it before a genuine AI failure forces the question in public.
8. Strategic objectives in the UAE's National Strategy for Artificial Intelligence 2031, one of which is governance
AED 335bn. Estimated potential UAE economic gain from AI deployment across priority sectors, cited in the national strategy
3. Titles now competing for technology accountability at many Gulf boards: CTO, CIO and chief AI officer
1,000+. Senior mandates JOH Partners has closed across the Gulf, the UK and Singapore since 2014
The technology seat used to be one job
For most of the past two decades, the technology seat on a Gulf board's executive team was, in practice, one job wearing one of two titles. The chief information officer owned the company's internal systems: infrastructure, enterprise software, cybersecurity and IT service delivery, largely a cost-and-reliability mandate reporting through the CFO or directly to the chief executive. The chief technology officer, where the title existed at all outside genuinely technology-native businesses, owned the technology embedded in the company's own products or client-facing operations, a smaller and more specialist population concentrated in banking, telecoms and a handful of industrial groups with real engineering depth.
Artificial intelligence has collapsed that clean division. A large language model embedded in a customer service function touches the CIO's infrastructure and security remit and the CTO's product and client-experience remit simultaneously, and a credit-scoring or underwriting model built on the same technology touches the CFO's risk appetite and, increasingly, the board's own fiduciary exposure directly. JOH's earlier research into Gulf boardroom AI readiness documented the resulting readiness gap from the director's side of the table: fewer than one in ten boards in JOH's network has a director who can credibly challenge management on model risk or data provenance. This report extends that finding from the boardroom to the executive floor immediately beneath it, where the accountability gap is, if anything, structurally harder to close, because it is split across titles rather than concentrated in a single absent skill.
A board that cannot name the one executive accountable for its AI exposure has not delegated that accountability. It has simply lost track of where it sits.
What regulators and national strategies actually ask boards to own
The clearest regional signal on how seriously governments now take this question comes from the national strategy level rather than corporate governance codes specifically. The UAE's National Strategy for Artificial Intelligence 2031 names strong governance and effective regulation as one of its eight core strategic objectives, tasking the UAE Artificial Intelligence and Blockchain Council, drawing representation from federal and local government entities, with reviewing national approaches to data management, ethics and cybersecurity as AI adoption accelerates. The strategy estimates a potential AED 335 billion gain in economic output from AI deployment across the UAE's priority sectors, a figure that signals the scale of adoption pressure boards are operating under well before governance structures have caught up to match it.
Where GCC technology and AI governance guidance currently sits
| Body | What it has published | What it does not prescribe |
|---|---|---|
| UAE AI Office / AI and Blockchain Council | National Strategy for Artificial Intelligence 2031, naming governance as one of eight core objectives | A specific board-committee or named-executive structure for individual companies |
| Saudi Arabia, Vision 2030 National Transformation Program | Government digital-enablement and data-strategy direction linked to the Saudi Data and AI Authority's national programme | Corporate-level AI accountability requirements for listed companies specifically |
| Abu Dhabi Global Market (ADGM) | Supervisory guidance and standards covering technology risk for regulated financial entities | A single mandated technology-accountability title across all ADGM-regulated firms |
| Dubai International Financial Centre (DIFC) | Published data protection and technology-related regulation for DIFC-registered entities | A prescribed reporting line for AI risk within a company's own executive structure |
Saudi Arabia's parallel push runs through the Saudi Data and AI Authority's national programme for data and AI, positioned within the wider Vision 2030 National Transformation Program, which centres on government digital enablement and private-sector data capability as much as it does on individual corporate governance structures. The financial free zones take a narrower, more directly enforceable approach: both the Abu Dhabi Global Market's supervisory authority and the Dubai International Financial Centre publish technology and data-related guidance for regulated entities within their jurisdictions, but neither, in JOH's reading of the published material, mandates a specific named-executive or board-committee structure for AI accountability at the level this report is concerned with. The direction of travel across all four is consistent: governments and regulators are setting expectations and, in the free zones, binding rules, without yet prescribing exactly which seat inside a company must answer for AI specifically. That decision is left to the company, and JOH's mandate experience suggests most Gulf boards have not yet made it deliberately.
Three titles and the gap between them
Where accountability for AI typically sits, by seat
Typical remit| Seat | What it typically owns | What it typically lacks for full AI accountability |
|---|---|---|
| Chief Information Officer | Infrastructure, enterprise systems, cybersecurity, IT service delivery | Product and client-facing authority; often no board-level reporting line of its own |
| Chief Technology Officer | Product and client-facing technology, engineering delivery | Enterprise risk and compliance authority; frequently reports through the CIO or COO rather than directly to the board |
| Chief AI Officer, where the seat exists | Cross-functional AI strategy and standards, in principle | Budget and headcount authority in most appointments JOH has observed; frequently a coordination role layered onto an existing mandate |
The chief AI officer title is the newest and, in JOH's direct search experience across the region, the least consistently resourced of the three. At a minority of Gulf institutions, concentrated among the larger banks and sovereign-adjacent platforms, JOH has observed the role appointed as a genuinely new seat, with its own budget, its own reporting line, and real authority over AI standards and deployment decisions across business units. JOH's search building Chief Technology Officer leadership for a tier-one GCC universal bank, anchoring a multi-year core banking modernisation and digital transformation programme, illustrates the scale of technical and governance authority a well-resourced version of this seat now carries at a mature institution. At considerably more Gulf companies, however, JOH's reading finds the chief AI officer title layered onto an existing CTO's or CIO's remit as an additional label, without a corresponding increase in budget, headcount or board access, which leaves the underlying accountability question exactly where it was before the title was created, dressed in language that suggests the problem has already been solved.
Why the gap persists at board level
The persistence of this gap is not simply an oversight; it reflects a genuine structural difficulty in assigning AI accountability cleanly. Unlike financial risk, which has a natural home in the CFO's remit and a natural board committee in the audit committee, AI risk cuts across categories that Gulf boards have historically kept separate: technology risk, which sits with IT; operational risk, which sits with the COO; conduct and regulatory risk, which sits with compliance or legal; and increasingly reputational risk, which sits, functionally, with nobody in particular until it has already materialised. A board asked to name the single committee that owns AI oversight is, in most cases JOH has observed, choosing between several imperfect answers rather than selecting an obviously correct one.
Family-controlled group holdings carry an additional version of this difficulty. Where the technology function has historically been treated as a cost centre rather than a strategic capability, board-level appetite to create and properly resource a genuinely new senior seat for AI specifically is often lower than the scale of the exposure would justify, particularly where the group's core business is not technology-native and the board's collective technical literacy, consistent with JOH's earlier finding that fewer than one in ten Gulf boards has a director who can credibly challenge management on AI, is not yet strong enough to make the case for investment convincingly from inside the boardroom itself.
AI risk does not respect the org chart Gulf companies built for a world before AI existed. Boards that keep asking the existing chart to answer a question it was never designed to answer will keep getting an answer nobody can be held to.
The accountability gap is compounded by a talent scarcity problem running in parallel. The population of candidates who combine genuine technical depth in AI systems with the seniority, board fluency and cross-functional standing to hold a seat that spans product, infrastructure and enterprise risk simultaneously is small, and Gulf technology and digital institutions are competing for the same narrow pool as banks, technology companies and sovereign wealth platforms in London, Singapore and the United States. JOH's guide to what a board tests in a chief technology officer interview sets out how this shift has changed the interview itself: boards are now testing less for architecture knowledge and considerably more for AI accountability and cyber exposure, because that is the part of the role the board can no longer safely assume someone else is covering.
What a functioning technology-oversight structure looks like
Boards that have closed this gap, in JOH's observation, share four practices. The first is naming one executive as the board's single point of accountability for AI risk and strategy specifically, regardless of which existing title carries it, and documenting that accountability explicitly rather than leaving it to be inferred from whoever happens to present on technology matters at a given board meeting. The second is assigning that accountability a defined board committee home, whether an existing audit or risk committee with an expanded charter or, at larger and more AI-exposed institutions, a dedicated technology or innovation committee, so that oversight has a formal channel rather than an informal one that depends on a particular director's personal interest.
The third practice is closing the board's own literacy gap directly, whether through director education, the addition of an AI-literate non-executive director, or both, so that the committee receiving AI reporting can actually interrogate it rather than simply receive it. The fourth is reviewing the accountability structure itself on a defined cycle, treating it as a live governance question that evolves with the technology and the company's own AI adoption, rather than a one-time decision made when the first AI-related risk surfaced and then left unrevisited.
Boards seeking ongoing visibility into how this accountability structure is actually functioning between formal review cycles, rather than reconstructing the picture only after an AI-related incident forces the question, increasingly use platforms such as Board Pulse to track governance and executive-layer signals on a continuous basis. Farooq Shaikh's account of building LogiPoint's digital transformation under Vision 2030 offers a useful adjacent illustration of the same underlying discipline from inside an operating business: technology transformation succeeds when accountability for it is genuinely clear at the top, not distributed informally across whichever functions happen to touch the system.
A forward view
Three developments are likely to accelerate the pressure on Gulf boards to resolve this accountability question over the next two to three years. The first is the continuing gap between the pace of AI adoption, which the UAE's own national strategy frames explicitly in terms of tens of billions of dirhams in near-term economic opportunity, and the pace at which governance structures are catching up, a gap JOH's earlier boardroom AI readiness research already found unusually wide in the region. The second is the likelihood that free-zone regulators such as ADGM and DIFC extend their published technology and data guidance further into AI-specific territory over the coming reporting cycles, following the pattern JOH has observed elsewhere in Gulf financial regulation, where free-zone rules tend to move first and onshore requirements follow. The third is straightforward competitive pressure: as more Gulf institutions appoint genuinely resourced chief AI officers with real budget and board access, the ones that have layered the title onto an existing role without the authority behind it will find that gap increasingly visible to investors, regulators and, eventually, their own boards.
None of these developments will resolve the accountability question on its own, and a board waiting for external pressure to force the decision is choosing to make it under worse conditions than the ones available today. The practical task for any Gulf board reading this now is immediate and specific: decide which single seat, by whatever title, holds AI accountability, write that decision into the relevant committee's terms of reference, and give the seat the budget and board access the accountability actually requires rather than the accountability the existing budget happens to allow.
Key findings
Methodology and evidence base
This report does not draw on a proprietary JOH survey or dataset; no sample of Gulf boards was scored specifically for this question, and none is claimed. It is built on two layers of evidence, consistent with the standard JOH applies across its published research. The first is public, citable sources: the UAE's National Strategy for Artificial Intelligence 2031, published by the UAE AI Office; Saudi Arabia's Vision 2030 National Transformation Program and its associated national data and AI programme; published supervisory guidance from the Abu Dhabi Global Market and the Dubai International Financial Centre; and the GCC Board Directors Institute's 2026 board review, previously cited in JOH's AI governance research, which found Gulf boards falling short specifically on AI readiness relative to other governance dimensions.
The second layer is JOH Partners' own qualitative read, drawn from twelve years of practice since 2014 and more than 1,000 senior mandates across the Gulf, the United Kingdom and Singapore, concentrated for this report in the firm's technology and digital senior search practice. This qualitative layer is presented as observation, not as measurement: where a claim in this report rests on JOH's own mandate experience rather than a citable public source, that is stated explicitly in the text, most directly in the illustrative framework in Exhibit 2. No figure in this report is attributed to a JOH dataset that does not exist, and no source cited is a competing executive search, recruitment or staffing firm.
JOH Partners is an executive search and senior executive recruitment firm advising boards, family groups and sovereign-adjacent platforms on chief technology officer, chief information officer and chief AI officer appointments across the GCC, the UK and Singapore. For the full report, download the PDF above, then engage a partner for a confidential conversation about technology and AI leadership appointments. Boards wanting continuous visibility of governance and executive-layer accountability can also request a Board Pulse demo.
Oliver Helvin
Founder and Managing Director
Oliver Helvin is the Founder and Managing Director of JOH Partners, based in the Middle East. With over 20 years of experience in multinational corporations across Europe and the Middle East, he has held pivotal roles at Gulftainer, Al Futtaim, BP and AstraZeneca, where he led recruitment functions and built the policies, processes and KPIs that drove change and efficiency in each organisation he served. He founded JOH Partners in 2014 to deliver retained executive search the way it should be done: partner-led, research-rigorous and accountable for retention twenty-four months after the hire.
LinkedIn ↗Send me a copy.
We’ll email the PDF to your work inbox and add you to our research distribution list. Unsubscribe anytime.
Questions about this research.
Who should own AI accountability on a Gulf board: the CTO, the CIO or a chief AI officer?
There is no single correct title, and JOH's reading of practice across the region finds most boards have not yet settled the question either. What matters more than the title is that one named executive holds clear, board-documented accountability for AI risk and strategy, with a defined reporting line to a specific board committee, rather than the accountability sitting informally across two or three seats at once.
What is the difference between a chief technology officer and a chief information officer?
In the traditional Gulf group holding structure, the chief information officer typically owns internal systems, infrastructure and IT security, while the chief technology officer owns the technology embedded in the company's products, services or client-facing operations. Artificial intelligence cuts across both remits, which is a large part of why accountability for it has become genuinely unclear at many Gulf boards.
Is a chief AI officer a genuinely new seat, or a rebranded existing role?
Both, depending on the organisation. At a minority of Gulf groups, particularly larger banks and sovereign-adjacent platforms, JOH sees a chief AI officer appointed as a genuinely new seat with its own budget and reporting line. At many others, the title is layered onto an existing CTO or CIO's remit without a corresponding increase in authority or headcount, which leaves the accountability question as unresolved as it was before the title existed.
What does the UAE's national AI strategy say about governance?
The UAE's National Strategy for Artificial Intelligence 2031 names strong governance and effective regulation as one of its eight core objectives, tasking the UAE Artificial Intelligence and Blockchain Council with reviewing national approaches to data management, ethics and cybersecurity. It sets a national direction; it does not prescribe a specific board-level accountability structure for any individual company, which is the gap this report addresses.
How should a board start closing the technology accountability gap?
By naming one executive as the board's single point of accountability for AI risk and strategy, documenting that accountability and its reporting line in the board's own committee terms of reference, and reviewing it on a defined cycle rather than leaving it to accumulate informally across whichever seats happen to touch technology at a given moment.
A standing brief on the executive market.
New research, perspectives and market notes — direct to inbox. Read by chairs, chief executives and investors across three regions.
Tell us about the seat.
We’ll tell you who’s right.
Confidential conversations with the partner leading the practice you need. We respond within one business day.