AI in Gulf banking: where does the decision sit?

Information access, operational intelligence and decision authority require different evidence.

A banking assistant can retrieve policy, explain a transaction or help a colleague interpret customer conversations. Those activities carry different permissions. The first executive task is to identify what information the system receives and which decision can follow its answer. A bank-wide label hides precisely the boundary that a reviewer needs to inspect.

Start with the information boundary

A source-linked answer has a different operating role from an instruction to move money, amend a customer record or approve credit. Distinguish read access, recommendation, preparation of an action and authority to execute it. Record the accountable business owner, intended user and permitted data. A general statement about responsible AI cannot answer all of those questions for a particular system.

Follow an actual completed item: recover the source version, generated response, colleague’s intervention and accepted decision. This is a proposed evidence request, not a claim that the banks in this report lack those records.

Separate an answer from an accepted decision

Policy retrieval needs tests of accuracy, currency and ambiguity. Operational insight needs a trace to the decision it supports: which customer issue was accepted for action, who owned it, and what happened afterward? Access restrictions need a test where prohibited data or an impermissible action would enter the workflow. These are different evaluation plans.

The cases below illustrate different operating questions. They do not constitute a bank comparison. Their inclusion does not imply participation in Mayden research or endorsement of Mayden.

Attributed operating examples

These separate cases were selected by the operating question, not company standing. The diagram does not imply one connected system.

Customer conversation

Emirates NBD says PCA turns calls into recurring themes, intent and operational issues shared across teams. Named platform; decision-use quality not demonstrated. The next research question is: Which issue was acted on, and did the service outcome change?

Source: Turning millions of customer conversations into better banking experiences with AI ↗.

Policy answer

KFH says ShariaBot references specific supervisory-board fatwas when answering staff questions. KFH Kuwait; source links do not reconstruct the full decision. The next research question is: Can a reviewer recover the source version and check a disputed answer?

Source: KFH Reinforces Banking Leadership with Forward-Looking AI Initiatives ↗.

Permitted data

NBK says Copilot Web excludes confidential data and disables document upload and download. Specified access controls; broader framework remains on the roadmap. The next research question is: Can an attempted prohibited action demonstrate that the boundary is enforced?

Source: NBK Sustainability Report 2025 ↗.

Measure work completed, including the checking

Availability, active use and useful completion need separate denominators. Start with the employees or decisions eligible for a workflow; then observe actual use, accepted outputs, corrections, escalations and repeated work. A tool that saves drafting time can still increase verification effort. Include that effort and later rework.

The DWP Copilot evaluation records reported benefits and checking overhead, but had no pre-trial baseline or objective outcome metrics. Its survey helps frame questions; it cannot estimate a Gulf bank’s productivity gain. An Evaluation of DWP’s Microsoft 365 Copilot Trial ↗.

Give the board a decision-specific request

The business owner should explain the objective and decision boundary. The control owner should show a disputed output and the response. Finance should establish the full cost and outcome denominator. The sponsor should decide whether to expand, constrain or stop the workflow using that record.

The next research wave should examine the same defined work over a stated period, seek an operator’s account alongside leadership’s, and record changes in data access and responsibilities. That can make a private assessment useful without publishing a league table of banks.

Leadership agenda

Business owner: define one recurring decision and its permitted inputs and actions.

Control owner: trace a disputed output through intervention and correction.

Finance and operations: measure accepted work, verification, rework and cost over the same period.

Scope and reading boundaries

The source corpus contains 80 purposefully selected entity records across eight sectors, ten per sector. Headquarters markets are Saudi Arabia, the UAE, Qatar, Kuwait and Bahrain; Oman is outside this edition. Groups, subsidiaries and specific operations have different scopes. This is not a representative sample. Source cutoff: 10 October 2026; publication edition: 11 October 2026.

Source extraction and challenge were AI-assisted, not independent human assurance or verification of current operations. Source visibility is not adoption prevalence. Unreported details are unresolved questions, not absent capabilities. Named examples imply neither participation, endorsement, confidential access nor a Mayden client relationship.