GCC Businesses Face $31m AI Breach Risk

SPEAKER_1 (0:00)

This is the Morning Drive, it's Mira Business FM. AI use is surging across the GCC, as it is across the world, but the legal framework around it is still developing. IBM's 2026 data shows the average Middle East data breach costs around $8 million, while 26% of malicious breaches are now AI enabled. So when AI goes wrong, who is legally responsible? There's a question. So here to discuss the accountability gap is Jouslin Khairallah, who is a senior Emirati lawyer, and she is also the founder and the managing director of KH Legal, joins me in the studio. It's nice to meet you.

Jouslin Khairallah (0:43)

Nice to meet you too.

SPEAKER_1 (0:44)

Thank you for coming in. Let's start, if we can, with that legal accountability gap. Just how big is that gap around AI and the UAE, and I guess across the GCC right now, do you think?

Jouslin Khairallah (1:00)

We cannot say there is a legislation not exist, and we still have the data protection law, we still have the cybercrime law, we still have the civil procedure law, the asset and data protection, the IFC law. But if we go to the exist legislation who is framing the work of AI, we still not have it. And more than this, we still not have a principle from the high courts, which we call it as a lawyer, the factory, the main factory of all the legislation. So to have the article activated and know how this article will be work, you need actually principle from the high court. So we don't have a many principle for now. The principle is still very, very, very low.

And we expect in the future to have more decision related to AI cases, and those more decision from judges of cassation courts, it will frame the work of AI properly.

SPEAKER_1 (2:29)

And I guess we're in a situation now, are we not, when AI is still developing, it's still relatively new, it's developing at speeds that maybe we haven't seen before, that much we know, but there isn't yet the precedent, is there?

Jouslin Khairallah (2:49)

We have article, president, we still not have. So basically, this is the place where we need experience of the legislation.

SPEAKER_1 (3:00)

Sure, sure. If an AI system causes a breach, causes a data breach, Jouslin, who could ultimately be held responsible? Is it the company, is it the employee, is it the lawyer using it, is it the AI provider?

How does it work?

Jouslin Khairallah (3:18)

It will be who's controlling the AI. So basically, whether this organization, employee or even a lawyer, so the cause of the AI will be 100% responsibility of the one who use it for the time being, until we will face different maybe faces of AI who develop themselves, and we don't know may they will take decision on behalf of the human, which now not exist. So for the existing user now, they will be who control AI, he will be responsible for all the mistakes.

SPEAKER_1 (4:02)

Okay.

We hear that this is the statistic I wanted to ask you about, one of a few actually. 26% of malicious breaches are now AI enabled. We talked to lots of different AI consultants, cyber security people. But that, I guess, is changing the legal risk for businesses, isn't it? Because that figure, unfortunately, is likely to increase internationally.

Jouslin Khairallah (4:32)

You know, we need to actually look at it like risk management. So we can add to the risk management in any businesses the AI.

So as soon as the, any businesses or any company, whether this medium size or a big size, they're using the AI, so it will be part of their risk management to make sure there is a policy exist. So I think, and actually, it's in my opinion, here the huge risk management of using AI, if there is no exist policy on those companies.

SPEAKER_1 (5:13)

The average Middle East data breach, I said this in the introduction, is $8 million, that's the cost that we have heard. Are current penalties enough to deter companies from maybe taking more risk in terms of AI related processes?

Jouslin Khairallah (5:35)

When we speak about penalties, we need to understand when the penalty will be available or exist. It's part of criminal acts.

So government represented by public persecution, it will put this penalty on the companies and the company will pay the penalty for the government, not as a compensation.

This is actually the penalty caused by criminal action of the companies. So when we said, is the penalty enough? So the penalty enough to cover the crime as per the legislation. But we still have a high consequences of this crime where the compensation, it will take place sooner or later. So the company who's using the AI will pay the penalty for the government and later on will pay compensation as a civil claim for the one who's have the cause of the AI.