Sovereignty in the AI age: A foundation for the Gulf’s next phase of innovation

Abdelilah Nejjari, Managing Director, Gulf, Levant, Türkiye, Caucasus and Central Asia, Cisco, outlines how the value AI can deliver for the region depends on the security, privacy and control of data in this exclusive op-ed.

For years, discussions surrounding digital infrastructure in the Gulf have largely focused on pace: how quickly services could be digitised, networks expanded and new technologies adopted. Artificial intelligence (AI) is changing the nature of that discussion. As AI moves from pilot projects into the core of how organisations operate, a more fundamental question comes into focus: who controls the data, the systems and the infrastructure required to maintain autonomous, data-driven operational control?

In the UAE, this question is no longer theoretical. The country set out its ambitions early, launching the UAE National Strategy for Artificial Intelligence 2031 and appointing the world’s first Minister of State for Artificial Intelligence in 2017. That long-term commitment has placed AI at the centre of national development and economic growth. It also brings a clear responsibility to ensure that the infrastructure supporting AI is secure, resilient and remains firmly under the right control.

Government entities, financial institutions, healthcare providers and energy operators are responding accordingly. They are seeking to accelerate innovation while maintaining tighter guardrails over their most critical data, systems and operations.

Why AI raises the stakes

AI, security and infrastructure strategies are becoming increasingly interdependent. AI workloads draw on an organisation’s most sensitive information, such as financial transactions or operational data from critical facilities. The value AI can deliver therefore also depends on the security, privacy and control of that data.

This is why sovereignty is better understood as a foundation for AI, rather than as a constraint on it. Organisations that know where their data resides, who can access it and how their infrastructure is governed are in a stronger position to innovate with confidence.

Sovereignty is not isolation

Sovereignty is sometimes interpreted as a move away from global technology or cloud services. In practice, the organisations we work with across the region take a more practical view. For them, sovereignty is about control and choice.

There is no single model that suits every organisation. Some workloads, such as those underpinning national services or critical operations, may call for fully on-premises, air-gapped environments where the organisation alone controls operation and access. Others may be well served by hybrid approaches that combine sovereign infrastructure with private or public cloud services. The objective is not to choose one model over another, but to make deliberate decisions, based on sensitivity, regulation and business need.

Three questions for leaders

For governments and businesses assessing their approach, three questions provide a practical starting point.

What must remain fully under our control? Not all data and systems carry the same level of criticality. Identifying which workloads are mission-critical allows sovereignty to be applied where it matters most, rather than uniformly across every system.

Do we have the capability to operate it? An air-gapped infrastructure hosted by the organisation itself places greater responsibility on its own governance, processes and staff, from managing updates on its own schedule to running environments without reliance on external connectivity. Skills, processes and access to specialised support are as important as the technology.

Do our technology partners’ principles align with our own? Organisations should expect clarity on who can access their environments and how security is assured. In a sovereign model, choice and control over infrastructure, data and access should sit with the customer.

Trust is built on principles and capability

Trust in critical infrastructure is earned through clear principles applied consistently and with transparency. That means product development practices that prohibit any intentional features designed to allow unauthorised access or bypass security controls. It also means operating models in which the technology provider does not run, access or control the customer’s environment.

Capability matters equally. Sovereignty depends on people who can design, operate and secure these environments. Continued investment in skills development and specialised technical support, delivered in collaboration with local partners, helps ensure that sovereignty is sustainable rather than aspirational.

At Cisco, these principles shape our Sovereign Critical Infrastructure approach, which gives organisations in the region the option to build and operate infrastructure they fully control, on their own premises.

A shared responsibility

The UAE’s national commitment to AI continues to advance. This year, the country unveiled a new government framework to deploy agentic AI across 50% of government sectors and operations within two years, an initiative announced as a world first.

The ambition reflects a broader shift. As AI systems move from supporting decisions to acting on them, the integrity, resilience and control of the infrastructure beneath them become more consequential. When AI agents operate across public services, questions of who controls the data, the systems and access to them become matters of public trust as well as technology.

The Gulf, and the UAE in particular, has an opportunity to define what sovereignty in the AI era looks like in practice: open to global innovation, grounded in local control, and built on trusted partnerships between governments, industry and technology providers.

Achieving this is a shared responsibility. The organisations that approach sovereignty as a deliberate, strategic choice, rather than a defensive reaction, will be best placed to turn AI’s potential into lasting value for their economies and communities.

Image Credit: Cisco