The Readiness Paradox: Training Alone Is Not Enough

82% of professionals in the Gulf use AI at least once a week, and one in three uses it every day. That means AI is no longer a luxury. It is a reality we all have to deal with.

Employees use it today to write emails, prepare reports and build presentations. Training, on the other hand, is almost nonexistent. Technology is clearly moving faster than government entities and private organizations can keep up, and the question is: do organizations have a clear AI usage policy, and frameworks to deal with this technology?

The readiness paradox

We are living through what could be called the readiness paradox. Organizations ask employees to deliver more, and AI really does help them multiply their output. Yet only 20% of professionals have received extensive training. Only 39% feel highly confident using AI, and the rest hesitate for fear of the consequences.

And the training that exists does not reach the people who need it most: 36% of senior leaders received extensive training, compared with only 8% of frontline employees. Those are the people who prepare the reports, answer customers and build the presentations.

Imagine buying Ferraris, handing them to your employees and telling them: go on, enter the race, we want you to beat the competition. But you never taught them to drive, and some of them may not even know where the brakes are. You are heading for a disaster.

The employee does not know whether they are putting the organization’s data security at risk, whether they are breaking a regulation, or whether its data will end up with competitors. They can cause a serious problem without meaning to.

This article draws on three references: the Al-Futtaim study of AI use among Gulf professionals (1,143 respondents in 6 GCC countries, March 2026), the National AI Risk Management Framework from the Saudi Data and AI Authority (SDAIA), and the Awareness Guide for AI Adoption in Technology Companies from the Communications, Space and Technology Commission (CST).

Training alone is not enough: why you need an AI usage policy

However well an organization trains its people to write the best prompts, if it does not give them a clear policy on which data and which uses are allowed, employees will either feel threatened or get into trouble without knowing it.

There has to be clear AI governance that protects the employee, the organization and the customer at the same time. Customer data is already flowing into AI tools today, so who protects the customer?

Why AI is different from traditional software

Every piece of software carries risk, but AI is very different.

Traditional software follows clear paths defined from the start. Put in certain data and the output is that data after processing. So you define the paths and test them before launch, and the system works the way you tested it.

AI works on probabilities. Give it the same prompt more than once and you may get different results, because it does not follow a fixed path. It also hallucinates, and when an output is wrong, it is hard to trace the error to a specific line and fix it the way you would with traditional software. It also suffers from bias: if it is trained on biased data, it will most likely repeat that bias in its decisions.

Think of traditional software as a train. You lay the track and it never leaves it, whatever happens. AI is more like a 4x4 in an open desert. This time it decides one route is better, next time another. You cannot tell where it will go. It may turn right or left, climb the dune or drop down it suddenly, depending on the terrain.

That is why the National AI Risk Management Framework was built.

The National AI Risk Management Framework

SDAIA’s framework focuses on a full risk management life cycle that repeats continuously. It starts by defining the system’s context and scope, followed by four main steps: identifying risks, assessing them, treating them and monitoring them.

Take an example: a bank decides to use an AI tool to analyze loan applications and issue an initial recommendation.

1. Identifying risks

The bank maps out the possible scenarios. For example, if the model is trained on data that tends to reject a certain group of customers, it may reject them with unfair bias. Customer data could also leak if the model is hosted by a third party.

2. Assessing risks

The bank calculates the likelihood and impact of each risk in numbers. How likely is the model to reject an important customer? What is the financial and legal impact if it does?

Here is a risk few people talk about: the erosion of human skills. Picture an employee who has stopped thinking and simply applies whatever the AI produces. Over time their abilities weaken, because the AI now does the thinking for them and they no longer need to develop themselves. The framework itself lists over-reliance on the system among the risks of human-machine interaction.

3. Treating risks

Treatment is not necessarily technical. It can be administrative, organizational or technical. For example, to treat the risk of skill erosion or bias, the employee must justify every decision made with the help of AI, whether accepting or rejecting it: I agree with the recommendation for reasons 1, 2 and 3, or I reject it for reasons 1, 2 and 3.

4. Monitoring

There must be a regular review of the model’s performance, and a review of employee performance independent of AI. Is the model getting better or worse? Is the data it was trained on still current, or has it gone stale? Is employee performance slipping, and do people need training in specific areas?

Levels of AI risk: no single ruler for every use case

If an organization applied these four steps with the same rigor to every tool, it would be better off not using AI at all. It makes no sense to treat an appointment booking app with the same rigor as a system that recommends medication for a human being. The result would be bureaucracy that kills the technology, and you would get no benefit from it.

That is why CST’s guide classifies risk into three levels, based on criteria that include the system’s degree of autonomy, the sensitivity of the data it processes, and its impact on individuals or the organization. The guide is aimed at technology companies, but its logic works for any government entity or private organization.

Think of risk assessment as airport security:

Level	Analogy	Examples	Controls
Low	Domestic flight, quick screening	Tools that summarize emails or organize meetings	Clear guidance for employees, a general usage policy and basic monitoring
Medium	International flight, strict screening and passports	Tools that answer customer inquiries or analyze data	Human review, regular monitoring of model performance and documented controls
High	A trip that needs a visa and special permits, with thorough screening on the way out and back	Hiring systems that screen resumes, and agents authorized to execute financial transactions without human intervention	Explicit approval from senior leadership before launch, clear escalation paths, the technical ability to stop the system and reverse its decisions, and continuous monitoring

The high level covers systems that affect people’s rights, or whose decisions directly affect the organization’s reputation. Amazon, for example, built an AI tool to rate resumes for technical jobs and trained it on resumes submitted over 10 years, most of them from men. The model learned to downgrade any resume containing the word “women’s”, as in “women’s chess club captain”, and to downgrade graduates of two all-women’s colleges. The company discovered the problem and shut the project down, according to Reuters in 2018.

What the organization gains

All of this lets the hesitant employee, and the hesitant organization, know there is something protecting them, so they feel encouraged to use AI. The result is a major gain in productivity.

It also builds a sustainable work environment. Employees know their rights and responsibilities, and so does the organization. The organization raises its productivity, and employees do their work with confidence.

An AI governance roadmap: 4 phases starting Sunday

Phase 1: Inventory and document every tool

• Full inventory: a single register of every AI application and system in the organization.
• Document the scope of use: each tool’s operational purpose, the data that goes into it, and its outputs.
• Assess data sensitivity: how confidential the data each tool processes is, and how it is classified.

Phase 2: Classify into three levels

• Level 1, internal operations: low-risk assistive tools that raise productivity.
• Level 2, customer-facing solutions: applications that interact directly with beneficiaries and require greater maturity.
• Level 3, autonomous agents: operational systems with permissions that make constrained decisions on their own.

Phase 3: Write the general policy for Level 1

• Acceptable use guidelines: a general policy that sets the basic controls for using the tools.
• Ban on entering sensitive data: an explicit ban on uploading confidential and classified data to these platforms.
• Awareness of the model’s limits: train employees to spot its errors and avoid over-relying on it.

Phase 4: Apply the “justify the decision” rule

• Documented justification: require the human reviewer to record the reasons for accepting or modifying the system’s outputs.
• Levels of human intervention: clear requirements for mandatory human approval of high-impact decisions.
• Monitor and audit usage logs: track performance gaps and document failures to update policies.

Conclusion

Government entities and private organizations that ban AI will fall far behind, because it is no longer a luxury but a reality. Those that leave it wide open without any rules will cause disasters for themselves, their customers and their employees.

The answer is responsible adoption, with the human mind as the final arbiter of any decision that comes out of an AI system.

References

• Al-Futtaim, study of AI use among Gulf professionals (2026), as reported by Middle East AI News, Oct 22, 2026 and Khaleej Times, Oct 22, 2026.
• SDAIA, National AI Risk Management Framework: executive summary (Arabic) (2026).
• CST, Awareness Guide for AI Adoption in Technology Companies (July 2026).
• Reuters, “Amazon scraps secret AI recruiting tool that showed bias against women,” Oct 10, 2018, as published by Arab News.