By Anirban Mukherjee, Regional Director of Solution Architecture, MENA, Red Hat

4th November, 2026 - At recent events I attended in the UAE, including AI Everything in Abu Dhabi and Red Hat Summit Connect: Dubai, the loud conversation was about the rapid pace of AI innovation and national mandates for Sovereign AI. Technology leaders were comparing notes on agentic AI running in their production environments. The quieter conversations, away from the main stage, were sharper: what happens if a model, a technology provider, or a geopolitical shift moves against us?
That question matters because the UAE is no longer debating whether AI is useful its their businesses. In early 2026, leaders in the country set a world-first framework to put agentic AI into half of government sectors and operations within two years. Abu Dhabi is pushing to become the first fully AI-native government across digital services by 2027. CIOs now need to turn these ambitions into reality.
Key Architectural Questions
Few enterprises in the region can show a clear answer to three board questions. Where does sensitive data and decision logic actually live for their AI applications? Who can operate, audit, and recover the stack without waiting on a foreign control plane? If we need to change a model, service provider, or location within a reasonable period of time, is that an operational task or a rebuild of the business process?
These concerns are neither anti-cloud nor anti-innovation. While global public clouds and popular AI services are ideal for swift experimentation and scalable capacity, the risk lies in assuming every AI workload can permanently remain on its initial pilot platform. When AI models, business logic, and institutional decision-making become locked into immovable services offered by one provider then flexibility, choice and freedom may be compromised.
Action Plan for CIOs
1. Data Classification and Regulatory Compliance
Classify and structure data in strict compliance with regulations and governance. Connecting fragmented data and legacy systems to modern AI remains challenging, but rigorous data quality and control are critical for success.
2. Production-Grade Governance and Control
Assess requirements for security, guardrails, traceability, explainability and auditability to align with compliance needs. Agentic AI is capable of performing highly sensitive functions such as accessing databases, approving payments, or modifying regulated systems, it therefore requires strict controls, continuous monitoring, and auditability.
3. Token Economics, Infrastructure Choices and Value Realization
Balance technical prerequisites (security, compliance, explainability, etc.) with practical considerations like token costs, GPU availability in your own data centre or sovereign cloud provider, and AI skills within your team to deliver measurable business value.
4. Build deliberate Exit Strategies and Architectural Agility
Avoid dependence on specific vendors or technology stack for AI in order to maintain operational flexibility across AI models, service providers, and technology building blocks. The field of AI is evolving very rapidly and the last thing organizations want is vendor lock-in.
5. Talent Investment and Sovereign AI Capability
Invest in recruiting and upskilling talent to build, deploy, and maintain a sovereign AI platform, enabling teams to safely scale AI at market speed.
Across each of these areas, open-source software and open-weight models serve as a dependable foundation for an enterprise AI platform providing full inspectability, seamless interchangeability, and uncompromised architectural control.
What good looks like in practice
In banking, AI adoption varies by use case. Non-regulated tasks like customer service voice assistants leverage specialized multimodal AI service providers. In contrast, systems like fraud detection that interact with a bank's core banking system require on-premises AI infrastructure running open-weight models fine-tuned for inference and accuracy.
In healthcare, data classification and security regulations are even more stringent. Regulators require all AI systems to have full audit trails, traceability and explainability. Some AI applications are hosted on local sovereign cloud providers that have built sovereign controls specifically for these types of industries. Other applications may need localized infrastructure within a hospital with small language open weight models trained for such particular requirements.
In the energy sector, AI models may be onboarded centrally by the IT organization across hybrid cloud platforms and scaled based on demand. AI tools automate repetitive, data-heavy work, such as analyzing drilling and plant data, helping engineers finish their tasks about 10 times faster.

Across all these settings, the CIO scorecard is simple: how long it takes to exit, how much of a rewrite is required to switch service providers, how much of the stack the organization's own teams can run, and how quickly they can show a regulator what happened.
Move fast without compromise
The UAE boasts advanced digital infrastructure, heavy AI investments, a rich talent pool, and rapid enterprise adoption across key sectors. This setting rewards CIOs who create architectures built for both speed and long-term flexibility.
True AI maturity is defined by scaling valuable production use cases while retaining operational control. Long-term success relies on maintaining strategic ownership as models and vendor landscapes evolve. Operational sovereignty provides the foundation for rapid execution while keeping technology choices adaptable.
-ends-