Middle East compliance risks outpace AI governance, Kiteworks survey finds

Kiteworks’ 2026 survey says Middle East and Africa organizations have the lowest security and AI governance maturity of any region, even as they report the highest compliance consequence rate. The findings suggest AI adoption is moving faster than controls, with major gaps in third-party access, auditability and AI-specific regulation readiness.

Why it matters: - Middle East and Africa organizations are adopting AI quickly, but governance and compliance controls are not keeping up. - The region’s high consequence rate suggests weak controls are already turning into real operational and regulatory problems. - The survey points to a broader risk: AI growth without purpose-bound data controls, auditability and containment.

What happened: - Kiteworks released Middle East findings from its 2026 Data Security and Compliance Risk: Annual Survey Report on July 29, 2026. - The report is based on primary research with 459 security, compliance, risk and IT professionals across 10 industries and three global regions, including organizations across the Middle East and Africa. - The Middle East and Africa region posted the lowest mean Data Security Maturity Score, or DSMS, at 35.7 out of 100. - Europe scored 40 on DSMS and North America scored 38. - The region’s mean AI Governance Maturity Score, or AIGMS, was 34, below North America’s 39. - The region’s mean Data Security and Compliance Readiness Index, or DSCRI, was 15, tied with Europe for the lowest regional score. - Middle East and Africa organizations reported a 76% compliance consequence rate, the highest of any region. - The region’s AI incident rate was 78%, above Europe’s 75% and below North America’s 84%.

The details: - Tim Freestone, Kiteworks chief strategy officer, said the Middle East is deploying AI fast and governance for people and agents has not caught up. - Freestone said the 76% compliance consequence rate and low security maturity point to a controls problem, not a knowledge problem. - Fifty percent of Middle East and Africa organizations have tested third-party access revocation through an actual incident response, the highest rate of any region. - That compares with 35% in North America. - Only 7% of Middle East and Africa respondents rank AI-specific regulation as their top compliance concern. - By comparison, 29% of EU/UK respondents name AI-specific regulation their top concern. - Patrick Spencer, Kiteworks SVP of Americas Marketing and Industry Research, said the region is responding to breaches and enforcement actions rather than building preventive controls. - Spencer pointed to purpose binding, SIEM integration for AI systems and audit trails that can be produced in a day as key fixes. - Worldwide, 74% of organizations lack purpose binding for AI data use. - No AI containment control measured in the survey is deployed by more than 31% of organizations. - Fifty percent of organizations cannot produce a complete AI data access audit record within one business day. - The report says the gap between the top and bottom of the survey is 38 DSCRI points. - Nineteen percent of organizations in the Resilient quadrant, where DSMS and AIGMS are both at least 50, have a mean DSCRI of 46. - Sixty-six percent of organizations in the Exposed quadrant, where both scores are below 50, have a mean DSCRI of 8. - The report says raising AIGMS from 35 to 60 at the survey mean DSMS of 39 adds roughly 10 DSCRI points. - That gain is nearly double the improvement from adding four security controls while AIGMS stays fixed. - The report’s seven priorities are to classify and enforce sensitive data, deploy AI-specific DLP through a centralized policy engine, integrate MFT and AI infrastructure with a SIEM, implement and test an AI kill switch, build audit trails that meet regulatory production timelines, assign dedicated AI data governance ownership and consolidate sensitive data exchange platforms. - Centiment conducted the research on behalf of Kiteworks in Q2 2026. - The full report includes global, industry, regional and organization-size breakdowns, and Kiteworks makes the report available for download. - Kiteworks says its platform provides a secure data exchange and unified control plane for governance, compliance and protection of private data. - Kiteworks says it protects more than 100 million end-users and thousands of global enterprises and government agencies. - Kiteworks is headquartered in Silicon Valley.

Between the lines: - The survey suggests the region’s weakest point is not AI adoption itself, but the governance layer needed to control data use, agents and third parties. - The low priority given to AI-specific regulation in the Middle East and Africa may reflect a gap between actual exposure and perceived urgency. - The biggest performance gains appear to come from AI governance controls, not from security controls alone.

What's next: - Organizations looking to close the gap will need to focus on sensitive data classification, AI-specific controls and faster audit production. - Kiteworks says the report’s framework can help teams map where AI governance is lagging and which controls can move DSCRI fastest. - The broader implication is that compliance pressure may rise as AI deployments expand before governance matures.

The bottom line: - Middle East and Africa organizations are seeing the highest compliance fallout while also showing the weakest security and AI governance maturity, making AI control frameworks an urgent operational issue.