Governance Priorities for Gulf Boards: Three Decisions to Make Before 2027

Why 2027 Is an Inflection Point for Gulf Boards

Three forces converge in 2027. Vision 2030 in Saudi Arabia enters its final delivery window, with sovereign and government-linked entities under pressure to demonstrate outcomes, not intentions. The UAE's climate commitments and corporate tax regime, phased in from 2023 to 2025, will have their first full cycle of enforcement and disclosure. And the generational transition inside Gulf family conglomerates, many founded in the 1970s and 1980s, is no longer approaching. It has arrived.

For chairs and directors, this shifts the governance conversation from posture to proof. Regulators, investors, rating agencies, and sovereign shareholders are asking sharper questions. So is the next generation of family owners. The boards that resolve their architecture before 2027 move into the next cycle with authority. The boards that treat governance as a compliance exercise will find their room to manoeuvre narrowing.

Velarys works with boards across the region on precisely this problem: building the governance architecture that anchors direction in place and stays until the organisation holds its own course.

Decision One: Put AI Under the Board's Mandate, Not Just IT

Direct answer. AI is now a board matter because it reshapes risk, cost structure, workforce composition, and customer trust at the same time. Delegating it to a CIO or a digital committee leaves the board accountable for outcomes it has not defined.

The question for Gulf boards is not whether to adopt AI. It is who decides what the organisation will and will not do with it. That is a governance question, not a technology one, and adoption is already well underway. On PwC Middle East's own figures, around 70% of regional software teams use generative AI at moderate to high levels.

Practical board decisions to resolve before 2027:

• Decision rights. Which AI use cases require full board approval, which sit with a designated committee, and which can be authorised at executive level.
• Risk appetite. What categories of AI risk, from model bias to data leakage to regulatory exposure under UAE and Saudi data protection law, the board will accept, monitor, or refuse.
• Disclosure. How the organisation will report AI use to regulators, investors, and customers, especially where financial services, healthcare, or public sector clients are involved.
• Talent and vendor governance. Whether AI capability is built, bought, or partnered, and how third-party model risk is monitored.

A useful test: if the board cannot describe, in one page, its position on generative AI in customer-facing operations, the mandate has not been set. That page is a governance decision, not an IT deliverable.

Decision Two: Make Succession and National Talent a Board Decision

Direct answer. Succession, at CEO, chair, and senior executive level, and the fulfilment of national talent commitments are the two questions Gulf boards most often defer. Both belong on the board's standing agenda, with named owners and measurable milestones.

Around nine in ten private-sector businesses in the UAE and Saudi Arabia are family-owned, on Atlantic Council estimates. For these groups, succession is not an HR exercise. It is the transfer of authority, ownership, and strategic direction across generations. When it is handled informally, or left to the founder alone, the drift becomes structural.

Governance Priorities for Family-Owned Businesses in the Gulf

The core priorities are the separation of family, ownership, and management; a family council or family constitution with defined scope; and a board with genuine independent representation. A family office often sits alongside these structures to hold investment, philanthropy, and next-generation development.

Practical steps most Gulf family boards need to complete:

1. Document a written succession framework covering chair, CEO, and key operating roles, with a two-name shortlist for each.
2. Formalise the relationship between the family council, the board, and the executive.
3. Define what next-generation family members must demonstrate before board or executive appointment.
4. Review the shareholders' agreement and constitutional documents against actual practice.

The family business succession planning guide sets out the structural sequence in more detail, and the succession planning for business owners view addresses the founder question directly.

National Talent as a Board Matter

Emiratisation, Saudisation, and Qatarisation targets are no longer aspirational. In the UAE, private-sector Emiratisation quotas carry financial penalties for non-compliance. In Saudi Arabia, Nitaqat bands directly affect visa quotas and market access. The board's role is to set direction, approve the workforce plan, monitor progress, and hold executives accountable. It is not to run the recruitment process.

Decision Three: Move to One View of Risk

Direct answer. Most Gulf boards see risk in fragments. The audit committee sees financial risk, a separate committee handles cyber, ESG lives with a sustainability lead, and geopolitical risk sits nowhere. Consolidating these into a single, board-level view is the third decision.

The priority categories for 2026 to 2027 are:

• Regulatory and disclosure risk under new corporate tax, ESG, and data protection regimes across the UAE, Saudi Arabia, and Qatar.
• Cyber and AI-related risk, including third-party model exposure.
• Geopolitical and supply chain risk, given the region's trade corridors and energy transition exposure.
• Climate and transition risk, particularly for boards in energy, real estate, and infrastructure.
• Succession and key-person risk, often the largest unpriced risk on a family conglomerate's register.

The governance move is to require a single, integrated risk report to the board at least quarterly, with clear ownership at executive level and a defined escalation route to the chair.

Compliance and Regulatory Requirements for Gulf Boards

Direct answer. Gulf boards now operate under layered frameworks: Securities and Commodities Authority and Dubai Financial Services Authority rules in the UAE; Capital Market Authority and Saudi Central Bank requirements in Saudi Arabia; Qatar Financial Markets Authority rules in Qatar; plus sector-specific regulation and, for listed entities, exchange-level codes.

The direction of travel is consistent across the region: mandatory ESG disclosure for listed entities, stricter independence requirements for directors, board evaluation obligations, and clearer separation of chair and CEO roles. Boards should assume that what is guidance today becomes requirement within the next reporting cycle.

How Gulf Board Governance Differs From Other Regions

Direct answer. Gulf frameworks draw heavily on OECD principles and UK-style codes, but they operate inside a distinctive context: concentrated ownership, sovereign and family shareholders, national workforce mandates, and regulation evolving in step with national visions.

Dimension	Gulf context	Typical OECD context
Ownership	Concentrated, family or sovereign	Dispersed, institutional
Board composition	Independence growing, still catching up	Majority independent standard
Succession	Often intergenerational, family-linked	Executive-search led
National talent	Regulated quotas (Emiratisation, Saudisation)	Diversity guidance
ESG	Rapidly formalising	Mature disclosure regimes

Neither model is superior. The Gulf context requires governance architecture that respects owner intent while meeting institutional standards.

Board Composition and Diversity Priorities in the Gulf

Direct answer. The composition priorities for 2027 are independent directors with sector depth, women directors in meaningful numbers, and next-generation family or national representation where appropriate. Composition is the leading indicator of everything else the board decides.

A working target most Gulf boards are moving towards:

• At least one third independent non-executive directors, rising where regulation requires.
• Named board expertise in digital, risk, and sector-specific domains.
• Gender diversity aligned with regulatory expectations. The UAE requires listed companies to have at least one female board member, and Saudi Arabia has moved in a similar direction.
• Structured onboarding and continuing education for every director.

How Often Should Gulf Boards Review Governance?

Direct answer. Governance policies should be reviewed annually at a minimum, with a full board effectiveness review every two to three years, and immediately after any major transaction, leadership change, or regulatory shift.

The annual review should cover the charter, committee terms of reference, delegation of authority, the risk appetite statement, and the code of conduct. A deeper board effectiveness review examines composition, dynamics, information flow, and decision quality. The GCC Board Directors Institute publishes regional benchmarks that are a useful external reference point.

Common Governance Mistakes Gulf Boards Make

Direct answer. The most common failure is not the absence of policy. It is unclear decision rights between chair, board, family council, and executive, which produces slow decisions and diluted accountability.

Recurring patterns across the region:

• Committees that duplicate work rather than divide it.
• Board packs that describe activity rather than surface decisions.
• Family councils and boards operating without a written interface.
• Succession discussed informally, never documented.
• Risk reported in silos, never integrated.
• ESG treated as reporting, not governance.
• Independent directors appointed for relationship rather than capability.

How to Implement These Priorities in a Gulf Board

Direct answer. Implementation begins with a grounded diagnostic of current governance architecture, followed by a sequenced programme that resolves decision rights before adding process. Structure before ceremony.

1. Diagnose the current state: charter, composition, information, decisions, culture.
2. Define the target architecture: who decides what, at what level, with what evidence.
3. Rebuild the board pack around decisions, not updates.
4. Establish the standing agenda: AI, succession, risk, national talent.
5. Test the architecture through a live decision cycle, then review.

What Separates Boards That Decide From Boards That Drift

The distinction is rarely intelligence or intent. It is architecture. Boards that decide have clear decision rights, integrated risk, disciplined succession, and a chair who protects the agenda. Boards that drift have all the same policies on paper and none of the same authority in the room.

The three decisions, AI mandate, succession and national talent, and one view of risk, are the ones that hold. Resolve them before 2027, and the next cycle becomes navigable. Defer them, and the cycle will resolve them anyway, on less favourable terms.

Velarys is embedded in structure, present at decisions, accountable to outcome. The engagement closes when the board holds its own course. To discuss a specific board, book an advisory conversation.