From paper to agents: a staged roadmap for Gulf businesses

The idea in one paragraph

You do not need to jump straight to AI agents. Most organisations get the best results by moving through a few steady stages, each building on the one before. Every stage has value on its own. A business that only completes stages 1 and 2 (digital records and connected data) is already more efficient and resilient. Before each move, there is a simple gate: a check that the foundations are ready. Moving at your own pace is a sign of good management, not of falling behind.

The stages are the platform's own framework, informed by public standards (NIST AI RMF, ISO/IEC 42001) and by Gulf regulation. They are general guidance, not legal advice.

The six stages at a glance

Text alternative: six stages in sequence, from 0 (foundations and purpose) to 5 (agentic operations), with a gate between each pair. Governance, security, backups in more than one region, and training apply throughout.

---

Stage 0 · Foundations and purpose

What it is: agreeing why you want to change and who is responsible.

• Do: write a one-sentence purpose ("Answer every customer within an hour, in Arabic or English"). Name an owner. Measure today's baseline (time, cost, errors).
• Data: list what records you have and where they are.
• Governance: decide who approves new tools, even free ones.
• Skills: a short, practical session for staff on safe AI use.
• Regulation: identify which data-protection law applies to you (see the table below).
• Gate to stage 1: purpose agreed, owner named, baseline measured.

Stage 1 · Digitise

What it is: moving key records and transactions from paper, email attachments and personal spreadsheets into proper digital systems.

• Do: cloud accounting, digital contracts, electronic invoicing, scanned archives.
• Data: customers, suppliers, products and invoices in structured digital form.
• Governance: access controls; multi-factor authentication.
• Skills: everyone comfortable with the core systems.
• Regulation: e-invoicing. In Saudi Arabia, generation has been required since December 2021 and integration is being rolled out in waves (ZATCA) [F]. In the UAE, businesses with revenue of AED 50m or more must comply from 1 January 2027, smaller businesses from 1 July 2027, and government entities from 1 October 2027; B2C is excluded and records must be stored in the UAE (KPMG summary of Ministerial Decisions 243/244 of 2025) [F]. Sources differ on the deadline for appointing an accredited service provider, so please check current dates with the UAE Ministry of Finance.
• Gate to stage 2: key records digital; backups in two locations tested.

Stage 2 · Connect data

What it is: making your systems talk to each other so there is one reliable version of the truth.

• Do: integrate sales, accounting and operations; remove duplicate spreadsheets; build simple dashboards.
• Data: a "master" for customers and products; data quality checks; a record of where each dataset is stored.
• Governance: a data owner for each main dataset; retention rules.
• Skills: basic data literacy for managers.
• Regulation: check residency rules, such as UAE health data (Federal Law No. 2 of 2019, Art. 13, per DLA Piper) [F], and cross-border transfer rules under your data-protection law.
• Gate to stage 3: clean, connected data for the process you want to automate; storage locations known.

Stage 3 · Automate

What it is: using rules-based automation for stable, repetitive steps, such as sending reminders, matching invoices and routing requests.

• Do: simplify the process first, then automate. Keep a person on exceptions.
• Data: logs of what the automation did.
• Governance: a named owner for each automation; a way to switch it off.
• Skills: process mapping; one or two people who can configure workflow tools.
• Regulation: consumer-protection and data-protection rules still apply to automated messages.
• Gate to stage 4: processes simplified and measured; automations reliable.

Stage 4 · Augment with AI

What it is: adding AI assistants that draft, summarise, classify or recommend, with a person approving the result.

• Do: drafting customer replies in Arabic and English; summarising documents; forecasting demand; triaging requests.
• Data: clear rules on what data may be sent to which AI service; test sets to check quality.
• Governance: an AI inventory (every AI system, its purpose, owner, data, provider and risk level); written "never" rules; regular testing for accuracy and fairness. This aligns with NIST's Govern–Map–Measure–Manage functions (NIST) [F].
• Skills: checking AI outputs well; prompt and instruction writing; knowing when not to use AI.
• Regulation: for regulated firms, sector guidance, for example the CBUAE's 2026 Guidance Note, which covers board accountability, an AI inventory, bias testing, bilingual disclosures and human oversight (CBUAE) [F]. Automated-decision rights under data-protection law (below) also apply.
• Gate to stage 5: AI inventory in place; never-rules written; testing routine; customers told when AI is used; a person always reachable.

Stage 5 · Agentic operations

What it is: AI agents that carry out multi-step tasks, such as checking, updating systems and sending, within clear limits, with people setting goals, reviewing and remaining accountable. See Anatomy of an agentic organisation.

• Do: start with one bounded workflow (for example, preparing routine renewals end-to-end for a person to approve in bulk). Expand only as evidence builds.
• Data: detailed logs of every agent action; permissions limited to what the task needs.
• Governance: always-on monitoring; a tested stop mechanism; incident process; regular review. In the DIFC, Regulation 10 sets specific duties for deployers of autonomous systems (Mayer Brown) [F]. ISO/IEC 42001 offers a management-system approach (ISO) [S].
• Skills: people "above the loop": setting goals, handling exceptions, improving the system.
• Regulation: all of the above, plus any sector-specific rules.
• Ongoing gate: keep an agent in service only while its performance, fairness and safety are demonstrated.

---

Two tracks: SMEs and larger organisations

GCC regulation at a glance

A summary for orientation, not legal advice. Laws change, so check the current position with an adviser.

Common questions

Do we have to reach stage 5? No. Many businesses will do very well at stages 3 or 4. Agents make sense only where tasks are well understood, data is good and governance is strong.

How long does it take? It depends on your size and starting point. We deliberately do not give timelines. Move when the gate is met.

Will this replace our staff? The aim is to remove repetitive work so people can focus on customers, judgment and growth. Plan training and new roles alongside each stage, and keep your national-workforce commitments.

What if the region is disrupted again? The same foundations that support AI (digital records, connected data, backups in more than one region, clear processes) are what help a business keep running during disruption.

Related

• AI readiness checklist · Sector maps · Business overview
• ExO 3.0 and a Gulf lens · Illustrative archetypes