Some months ago I started an AI working group at MHG. It was my own initiative and it had nothing to do with governance; the aim was awareness. I picked members from different departments, and every couple of weeks we sat down to look at who was using the tools, for what, and with what result. Adoption ran highest in product portfolio management, where work that used to take fourteen days was being done in one. Customers got answers faster, and analysis began arriving before decisions rather than after them. One colleague went further and built, on a general-purpose AI model, a working tool that draws on our ERP data to support day-to-day operating decisions.
I am proud of that group. I also noticed, in those meetings, that every result we recorded was measured in days. Nobody could tell me what fourteen days into one was worth in riyals, because nothing had been baselined in money before we started, and nobody had asked whether the thirteen days released had gone into more work, better work or nothing at all. None of it came near the board. The sums were far too small.
I have taken a company through its Main Market listing and I use these tools every day, so I am not arguing that anyone should slow down. My argument is that boards are approving AI on the wrong instruments. The money goes out as operating expense, in pieces below the thresholds a board watches. The return comes back as hours, which the accounts do not record. And a third thing grows in between: the systems staff now build for themselves, which no board has been asked to approve because nobody thought of them as systems.
Use is not value
Among the large firms that answer surveys, use of AI is widespread. Financial results are not.
The strongest single source is an NBER working paper published in February 2026 and revised in October, built on national business panels in seven countries, most of them run by central banks. Yotzov, Barrero, Bloom, Davis and colleagues asked nearly 9,000 chief executives, finance chiefs and other senior executives what AI had done to their firms. Seventy-eight per cent of the firms use it. On average, 83% estimate no effect on productivity over the past three years. American firms in the sample plan to spend around $2,000 per employee on AI in 2026. These are estimates, not audited results, but they come from the people closest to the numbers.
McKinsey’s annual survey points the same way. In its 2025 edition, 88% of respondents reported regular use of AI in at least one function and 39% attributed any EBIT impact to it, most of them less than 5%. The 2026 edition, published in August, put that figure at 37%, and the group McKinsey calls high performers, those attributing 5% or more of EBIT to AI and reporting significant value, stayed at about 6%.
When Statistics Canada matched AI adoption to administrative data on firms, in April 2026, adopters were 16.8% more productive than non-adopters. The premium fell to 10.2% once the authors controlled for how productive the firms had been before they adopted, and to 5.1%, no longer statistically significant, once they controlled for the firms’ other capabilities. On this evidence better firms adopt AI, and the data does not yet show AI making firms better.
None of this proves AI does not pay, and the better research shows why. Where firms run proper tests, value appears. Fang, Sarvary and colleagues ran randomised field experiments across seven AI applications at a large cross-border online retailer, involving millions of users, and found sales effects ranging from nothing detectable to 16.3%, with four applications raising sales and no deterioration in returns or customer ratings. The evidence on where the value lands also cuts against the usual business case. Babina, Fedyk, He and Hodson, in the Journal of Financial Economics in 2024, found that AI investment at American public companies between 2010 and 2018 was associated with faster growth, primarily through new products, rather than with the cost savings most AI proposals promise; the authors suggest efficiency gains may come later, and their data predates generative AI. Read together, the evidence says the return is not yet visible in the unit the board approves budgets in, and that few boards have asked for it to be measured.
Hours are not riyals
The British government’s guide to benefits management for major projects, published by the Infrastructure and Projects Authority in 2017, draws the line most AI reporting erases. A cash-releasing benefit “will directly reduce a Departmental budget.” A non-cash-releasing benefit “will result in a Departmental efficiency but not necessarily a budget reduction.” Each benefit must be baselined “during project initiation,” and each has a named owner accountable for delivering it.
Our fourteen days into one is a non-cash-releasing benefit until someone decides what to do with the other thirteen. There are four honest answers. The cost can come out, which releases cash. The same team can serve more customers, which becomes revenue. The business can grow without hiring people it would otherwise have needed, which is cost avoided. Or the team can spend the time on better work that nobody measures, which the accounts will never show. All four can be the right choice. Only the first is a saving in the sense a budget understands, and none of them happens on its own.
The timing matters as much as the classification. Brynjolfsson, Rock and Syverson showed in 2021 that general-purpose technologies follow a J-curve: companies have to invest in process redesign, data and skills before measured productivity rises, so early numbers understate the eventual gain. A 2025 working paper by McElheran, Yang, Kroff and Brynjolfsson, using US Census data on some 28,500 manufacturing plants, found that AI adoption was followed by a short-term fall in productivity, with gains coming later and mainly to younger firms. About a third of the early loss came from plants that dropped structured management practices, their KPI reviews and target tracking, while they adopted, and the losses were concentrated in older plants.
Klarna shows how the claim and the accounts can tell different stories. In February 2024 the company announced that its AI assistant was doing the work of 700 full-time agents and was “estimated to drive a $40 million USD in profit improvement” that year, a forecast published in the assistant’s first month. In May 2025 its chief executive told Bloomberg that cost “unfortunately seems to have been a too predominant evaluation factor,” and that the company would invest in the quality of human support. Its third-quarter 2025 investor presentation, filed with the SEC, put the assistant at the equivalent of 853 full-time agents and $58 million of annual cost savings. The customer service and operations line in the same presentation rose to $50 million for the quarter from $42 million a year earlier, on an adjusted basis, while revenue grew by about 28%. Cost per dollar of revenue fell, so the saving was real in proportion, but it did not appear as a falling line. A board shown only the headline would not know that.
The Commonwealth Bank of Australia shows the other risk. In July 2025 it told 45 customer-service staff their roles were redundant after, Bloomberg reported, a voice bot cut call volumes by about 2,000 calls a week. The union took the matter to the Fair Work Commission, arguing that volumes were in fact rising. In August the bank reversed the decision, said its assessment “did not adequately consider all relevant business considerations,” and apologised to the employees. A benefit that had not been tested against the full picture drove a workforce decision, and the correction was made in public.
The cost the board never sees in one place
Saudi boards have the authority they need. Article 21 of the Capital Market Authority’s Corporate Governance Regulations gives the board the approval of “all kinds of estimated budgets” and oversight of “the main capital expenditures of the Company.” Article 22 requires a written delegation policy with “a matrix stating these powers,” and adds that the board “may request the Executive Management to submit periodic reports in respect of its exercise of such delegated powers.” The Regulations are otherwise silent on technology as a board matter; the only references are in Article 13, which lets general assemblies meet and vote using “contemporary technologies.” Any duty a board has over AI comes from its general powers over budgets, delegation, control and risk.
Those powers were built for discrete decisions: a plant, an acquisition, a system with a business case attached. AI does not arrive that way. It arrives as seats added to an existing software contract, a pilot charged to a department’s budget, a monthly subscription on a manager’s card, and increasingly a usage-based bill whose size depends on how much the tool is used after it has been approved. Each item sits comfortably under the delegation thresholds, and nobody adds up the total.
The cost data is explicit about this, though much of it comes from firms with an interest in the answer. A McKinsey survey of 75 enterprises, published in July 2026, found 93% had exceeded their AI budgets, and the authors, drawing on their client work rather than the survey, estimate that 20% to 30% of AI spending is “often unaccounted for” because it is spread across vendors, tools and pricing models. Zylo, which tracks software spending for its corporate clients, reported in January 2026 that spending on software bought through expense claims rose 267% in a year, that ChatGPT had become the most expensed application, and that business units now control 81% of software spending against 15% managed directly by IT. Vendors are also moving AI onto existing contracts. From July 2026 Microsoft raised the list price of its main business suites, citing AI features among the reasons; Microsoft 365 E3 went from $36 to $39 per user per month, whether or not anyone uses the new features.
The GCC adds a wrinkle. The directorship programme I completed notes that executive committees are common in the region partly because delegation-of-authority levels are lower, so more decisions travel upwards. In my experience low thresholds do not catch AI spending either, because each item is smaller than even a low threshold. McKinsey’s 2023 survey of GCC executives and directors, run with the GCC Board Directors Institute and reproduced in that programme, found that only about 40% of their organisations had formally budgeted for AI; 60% named the lack of an AI budget as a problem. Directors elsewhere are no further ahead. In the National Association of Corporate Directors’ 2025 survey of American public-company directors, 8.9% said their board had approved an annual budget for AI projects and 6.2% that it had set metrics for management to report against.
The system nobody registered
The tool our colleague built is the part of this story I think about most. The reason for building it is one most companies will recognise: changes requested through the formal systems route took months, and with the tool the answers arrive in days. It is still a personal tool, built and maintained by one person and fed from ERP data. Its builder has just opened it to colleagues so they can test its outputs, and I have asked for a comparison of what it does against what the ERP could do, so that the parts worth keeping can move into the controlled system. A second owner, a documented copy of its logic and a decision on which data may leave the ERP for an external model are the next steps.
Finance people know this pattern under a duller name. End-user computing, the spreadsheets and small databases staff build outside the IT function, has an expensive record. JPMorgan’s own task force into the 2012 London Whale losses found that a new risk model ran on spreadsheets “completed manually, by a process of copying and pasting data from one spreadsheet to another,” and that one calculation divided by a sum instead of an average, which “likely had the effect of muting volatility by a factor of two.” The spreadsheet was not the cause of the loss, but it kept the risk out of sight of the people responsible for watching it.
AI changes the scale. A spreadsheet took skill to build; a working application now takes an afternoon and a clear description. The controls that grew up around spreadsheets are known: an inventory of the ones that matter, an owner, a test and a change log. Bank regulators already require them. The Bank of England’s model risk principles list “end-user computing (EUCs) applications” among the tools that support decisions and call for a complete inventory. The COSO guidance on internal control over generative AI, released in February 2026, starts in the same place: an inventory of AI use cases mapped to business processes, with uncontrolled adoption, which it calls shadow AI, treated as a risk in its own right.
IBM’s 2025 Cost of a Data Breach study found that one in five organisations had suffered a breach involving shadow AI and that high levels of it added about $670,000 to the average breach; in its 2025 regional findings only 38% of Middle East organisations surveyed had a formal AI governance policy. The 2026 edition puts the average breach in the region at $8 million. Saudi rules reach part of this. The Personal Data Protection Law governs what data such a tool may process, and the National Cybersecurity Authority consulted in July and August 2026 on draft AI cybersecurity guidelines. The Saudi Data and AI Authority’s guidance, from the AI Ethics Principles of 2023 to its adoption framework, is not binding and is addressed to management, which its adoption framework reportedly advises to budget for AI and track it against KPIs. None of it tells a board how to account for what AI costs or what it returns.
Nobody wants the tool shut down; the gap between months and days is the most useful thing it has shown us. A tool like this is a demand signal as much as a risk, and an inventory of such tools doubles as a list of where the formal systems are falling behind. What it needs is the control any business asset gets: an owner, tested outputs, a copy of its logic somewhere other than one person’s account, and a decision on its data. It needs them before more people come to depend on it.
When the claim leaves the building
Sooner or later an AI benefit gets written down where investors will read it, in a results presentation, an annual report or a chief executive’s interview. At that point it becomes a disclosure, and disclosure rules apply. When we prepared our prospectus, every figure in it had a source and a person who would answer for it. AI benefit figures deserve the same treatment, and mostly do not get it.
In January 2025 the US Securities and Exchange Commission settled what has been widely described as its first AI-washing case against a public company. It found that Presto Automation had told investors its drive-through voice product removed the need for human order-taking, when “the vast majority of drive-thru orders placed through this version of Presto Voice required human intervention.” Presto settled without admitting or denying the findings and paid no penalty. The finding that matters to a board is the rule cited alongside the misstatement, Exchange Act Rule 13a-15(a), which requires disclosure controls and procedures.
The better practice is to publish the number with its method. Saudi Aramco reported “Technology Realized Value of $5.3 billion from AI, digital, and other solutions in 2025,” and $11.3 billion cumulatively since 2023. Few issuers in the region put any figure on the value of their technology programmes, and Aramco’s lead is worth following. The measure is defined by the company and covers digital solutions as well as AI; a fuller published method, with independent assurance, would make it a benchmark others could adopt.
The honest counter-argument
The strongest objection comes from my own working group. Nothing we achieved would have survived a business case. Sent through the capital process, our colleague’s tool would have been refused or delayed until the moment passed. Heavy governance kills exploration, and exploration is where the J-curve begins.
The objection is fair about the process. The capital-expenditure process is the wrong tool for a small experiment, but that is an argument for a different tool, not for none. The answer is an exploration budget the board approves once a year with a ceiling, a register of what was tried, and a rule for when an experiment becomes a system: when it starts to drive decisions, touch customer or financial data, or replace a step in a controlled process, it gets an owner, a baseline and a place in the inventory. And because the strongest evidence finds AI’s value in growth and new products, a regime that only recognises cost savings will push management towards the least valuable uses.
A chairman will raise a second objection: the sums are small. AI spending is a small share of operating cost at most industrial groups, and no single item comes near a board threshold. That is true today, and it is the point. The instruments fail while the cost is small and the dependence is growing, and by the time the sums are material the habits will be set. Cost is also the narrower question. What AI does to our competitors and our channels is a strategy question, and it deserves its own article.
The region’s internal auditors have reached the same view. In the Institute of Internal Auditors’ Risk in Focus survey of 179 chief audit executives and directors in the Middle East, published for 2025, digital disruption including AI ranked fifth among their risks and second three years out. The report’s authors note that “Boards are asking CAEs whether their organizations are seeing a return on their substantial investments in digital technologies,” and its list of board considerations includes ensuring “that the business is achieving return on its investments in digital technologies.”
What would need to change
Each change below sits within powers the CMA text already gives the board. On cost, use the reporting power in Article 22. Ask management for one annual view of AI spending across every cost centre, contract and expense channel, with the scope defined: spending whose main purpose is AI, meaning models, AI tools, AI add-ons and usage-based AI charges, with vendor price rises on existing suites shown as a separate memo line. Set it against whatever was approved, if anything was. The first version will be incomplete; that gap is itself the finding. Where usage-based commitments can grow without a further decision, set a ceiling above which they come back for approval.
On benefit, apply the discipline the board already applies to capital projects. Every AI initiative large enough to need a delegated approval gets a baseline taken before it starts, a named owner, and a statement of which of the four benefits it promises. Review it against the baseline and leading indicators at six months, and against the accounts at twelve to twenty-four months and again after that, because the research does not say how long the dip lasts. Where the business allows, compare a group that has the tool with one that does not yet have it, which is how the retail experiments found real sales effects. Article 70 requires an internal control system that ensures “clear accountability standards at all executive levels”; a claimed benefit with no owner is hard to square with that.
On systems, management should build and own an inventory of AI-built and AI-dependent tools that drive decisions, tiered by what they touch. The audit committee, which under Article 52 reviews the company’s “internal and financial control systems and risk management system,” should require it; internal audit should give assurance over it. The top tier gets an owner, output testing, a documented copy and a decision on data, and the inventory as a whole tells the board where the formal systems are too slow. The risk committee, charged by Article 68 with “determining and maintaining an acceptable level of risk,” should decide in which processes no tool outside the inventory is acceptable.
On disclosure, any AI value figure that reaches a results presentation or annual report should pass through the same disclosure controls as the financial numbers, with its method written down. And put the largest claimed benefits into the internal audit plan each year.
Five questions for the next board meeting
- What did we spend on AI last year across every channel, and how much of it did anyone approve? (Board, under Article 22)
- Of the AI benefits management has reported, which have a baseline, an owner and a verified outcome, and which are still stories? (Board)
- Which AI-built tools now drive decisions on stock, pricing, customers or reporting, and who tests their outputs? (Audit committee)
- In which processes will we allow no AI tool that is not in the inventory? (Risk committee)
- Have we approved an exploration budget, and a rule for when an experiment becomes a system? (Board)
These are the questions I am now asking of my own working group. The next time someone tells me a task takes one day instead of fourteen, I will ask what we did with the other thirteen. A saving the board cannot find in the accounts is a story, and boards are not paid to approve stories.
Views are my own.
Sources
- Yotzov, I., Barrero, J. M., Bloom, N., Bunn, P., Chawla, C., Davis, S. J., et al., “Firm Data on AI,” NBER Working Paper 34836, February 2026, revised October 2026, p. 22. DOI 10.3386/w34836. https://www.nber.org/papers/w34836
- McKinsey & Company, The state of AI in 2025: Agents, innovation, and transformation, 5 November 2025 (n = 1,993); The State of AI, 25 August 2026 (n = 1,719). https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai
- Li, J. and Liu, H., “Artificial intelligence adoption and productivity in Canadian firms,” Statistics Canada, Economic and Social Reports 36-28-0001, 22 April 2026. https://www150.statcan.gc.ca/n1/pub/36-28-0001/2026004/article/00002-eng.htm
- Fang, L., Yuan, Z., Zhang, K., Donati, D. and Sarvary, M., “Generative AI and Sales Productivity: Field Experiments in Online Retail,” arXiv 2510.12049, v6, 29 June 2026 (working paper). https://arxiv.org/abs/2510.12049
- Babina, T., Fedyk, A., He, A. and Hodson, J., “Artificial intelligence, firm growth, and product innovation,” Journal of Financial Economics, 151, 2024, 103745. DOI 10.1016/j.jfineco.2023.103745.
- Infrastructure and Projects Authority (UK), Guide for Effective Benefits Management in Major Projects, October 2017, §7.28 and §7.35-7.36. https://apm.org.uk/media/5csnk4oe/guideforeffectivebenefitsmanagementinmajorprojects.pdf
- Brynjolfsson, E., Rock, D. and Syverson, C., “The Productivity J-Curve: How Intangibles Complement General Purpose Technologies,” American Economic Journal: Macroeconomics, 13(1), 2021, pp. 333-372. DOI 10.1257/mac.20180386.
- McElheran, K., Yang, M.-J., Kroff, Z. and Brynjolfsson, E., “The Rise of Industrial AI in America: Microfoundations of the Productivity J-curve(s),” working paper, 20 April 2025.
- Klarna, “Klarna AI assistant handles two-thirds of customer service chats in its first month,” press release, 27 February 2024; Q3 2025 investor presentation, SEC Form 6-K, Exhibit 99.2, November 2025. https://www.sec.gov/Archives/edgar/data/2003292/000162828025052805/exhibit992klarnapresenta.htm ; CEO remarks to Bloomberg, May 2025.
- Commonwealth Bank of Australia, statement of 21 August 2025, as reported by Bloomberg and Information Age (ACS).
- Capital Market Authority (Saudi Arabia), Corporate Governance Regulations, Resolution 8-16-2017, amended by Resolution 8-5-2023; Articles 13, 21(1)(b)-(c), 22, 52(b), 68, 70. https://cma.gov.sa/en/RulesRegulations/Regulations/Documents/CorporateGovernanceRegulations1.pdf
- Sachdeva, P., Lala, W., Javaji, A., Takkar, K. and Arora, P., “The cost of intelligence: How CIOs can manage AI demand at scale,” McKinsey Quarterly, 20 July 2026 (McKinsey Enterprise AI FinOps survey, May 2026, 75 qualified respondents).
- Zylo, 2026 SaaS Management Index, 29 January 2026. https://zylo.com/news/2026-saas-management-index
- Microsoft, Microsoft 365 blog, 4 December 2025; “2026 Microsoft 365 packaging and pricing updates,” licensing news, February 2026.
- GCC Board Directors Institute, Certificate in Board Directorship, Module 2 Participant Manual, §6.6.
- McKinsey & Company with the GCC Board Directors Institute, The state of AI in GCC countries and how to overcome adoption challenges, 30 May 2023 (n = 119), Exhibit 5; reproduced in the GCC BDI Module 3 Participant Manual, p. 45.
- National Association of Corporate Directors, 2025 Public Company Board Practices and Oversight Survey, AI oversight data, 28 July 2025 (n = 146).
- JPMorgan Chase & Co., Report of JPMorgan Chase & Co. Management Task Force Regarding 2012 CIO Losses, 16 January 2013, Appendix.
- Bank of England Prudential Regulation Authority, SS1/23 Model risk management principles for banks, May 2023, para 2.2 and Principle 1.2.
- COSO, Achieving Effective Internal Control Over Generative AI, 23 February 2026.
- IBM and Ponemon Institute, Cost of a Data Breach Report 2025, 30 July 2025, and Middle East findings 2025; Middle East findings 2026, 3 August 2026. https://mea.newsroom.ibm.com/codb-me-findings-2026
- Personal Data Protection Law, Royal Decree M/19 of 1443H, as amended; National Cybersecurity Authority, public consultation on AI Cybersecurity Guidelines, July-August 2026. https://nca.gov.sa/en/public-consultations/ai-cybersecurity-guidelines/
- Saudi Data and AI Authority, AI Ethics Principles, September 2023; AI Adoption Framework.
- US Securities and Exchange Commission, In the Matter of Presto Automation Inc., Securities Act Release 33-11352, 14 January 2025.
- Saudi Aramco, full-year 2025 results, press release, 10 March 2026.
- Institute of Internal Auditors / Internal Audit Foundation, Risk in Focus 2025 Hot Topics: Middle East (n = 179), pp. 10, 15-16.