The ban is on paper
If your organisation has banned public AI tools, you may already have met the result. As a first reflex a ban is sensible. It also tends not to work, and what follows is sometimes called shadow AI.
Surveys of GCC employees point the same way. A BCG survey from September 2025 found that 87% of employees in the GCC use AI at work several times a week, and that 63% would use AI tools without authorisation. BCG survey of GCC employees, September 2025
On the governance side, Deloitte’s February 2026 research found that 10% of GCC tax and finance organisations have an enterprise-wide AI strategy and governance. Deloitte, February 2026
Put those together and the picture is familiar: staff are using AI, the organisation cannot see it, and nobody owns the risk.
What a ban costs
“Use AI or be left behind” is not a useful argument, and this is not that argument. The costs of a ban on paper are specific:
- Client data goes into personal AI accounts that IT cannot see.
- Teams buy duplicate licences, or expense them.
- Work is redone because nobody shares what works.
- Nobody can answer a simple question: who is using AI, and for what?
Three stages most organisations pass through
- A ban on paper. Staff use AI anyway, out of sight, on their own accounts.
- Scattered use. Every team picks its own tools. Nobody owns the risk or the bill.
- Managed adoption. One workspace, approved models, supported sensitive data in chat text masked, and a team accountable for keeping it current.
Moving from the first stage to the third does not need a long programme. It needs a decision about who is accountable, and somewhere approved for people to go.
Five questions to test where you are
How many of these can you answer today?
- Who is using AI, and for what?
- What client data is leaving with it?
- Which models, at what cost?
- Is it making us better?
- Who is looking after it?
Answering them takes four things:
- One approved place to work, on models the organisation has chosen.
- Protection between people and the model: supported sensitive data in chat text masked before a request reaches it, and rules for which files can be shared.
- A view for whoever owns AI: adoption, usage, and where adoption is lagging.
- Someone to keep it current, because models and rules change every month.
Where to start
Start with one team and one workflow. Measure it before and after. Use the result, in your own numbers, to make the case for the rest of the organisation.
That is how we run Mazun: a free AI exposure check of about an hour, a 30-day pilot with one team, then a roll-out. If your organisation has a ban on paper, book a meeting and we will look at how your people use AI today. See how the workspace works in the UAE or Saudi Arabia, and what masking covers in the UAE or Saudi Arabia.