I don't think the interesting question for a DIFC investment business is whether to use AI anymore. That decision has effectively been made — it's already in the workflow, whether or not it's been formally sanctioned. The question I actually sit with is narrower: is our operating model ready to govern what we've adopted?

That's a COO question before it's a technology question, and I think a lot of firms are still treating it as the reverse.

Rarely in the model itself. In my experience it sits in the things around the model — accountability that was never clearly assigned, controls that were designed for a pre-AI process and never revisited, data that's more fragmented than anyone likes to admit, and decision rights that are genuinely ambiguous once a machine is producing part of the output.

The technology is usually fine. The operating environment it's been dropped into often isn't ready for it.

Where is AI being used across the business — including the places nobody formally approved. Who owns the decision that comes out the other end of it. What sits around that output before it reaches a client, a trade, or a regulator.

How is it validated, and by whom. And, honestly, could our operating model absorb this without quietly creating a new category of operational or regulatory risk we haven't named yet.

The DFSA's 2026 AI survey confirmed something I'd already suspected from inside the room: adoption is running well ahead of governance across the DIFC, not because firms are being reckless, but because governance is harder to build quickly than the technology is to switch on.

I want AI to make the business genuinely better — faster decisions, better-informed ones, less manual drag. But not at the cost of letting the technology outrun our ability to govern it.

That's not caution for its own sake. In a regulated environment, ungoverned capability isn't an efficiency gain — it's a liability sitting quietly on the balance sheet until someone asks about it.

I've come to think growth is the easy part. Any capable team can raise the next ticket, sign the next mandate, open the next product line. What's hard — and what most people underestimate — is building the substance underneath that growth so it can actually withstand the scrutiny that comes with it.

That's not a regulatory box-ticking exercise. It's the real question I sit with: does this business have the people, governance, decision-making and infrastructure to demonstrate it's genuinely being run here — not just registered here.

Prudential expectations in the DIFC are evolving, and institutional capital has become far more selective than it was even a few years ago. A presence is no longer enough. Allocators and regulators are both asking a version of the same question now: is the substance real, or is it a letterhead.

I don't think that's an unreasonable bar. But it does mean the operating model has to do more work than it used to.

On the operating model, every time. Capital requirements, risk management, governance, reporting, investment operations, accountability — all of it gets heavier as the business grows. And none of it is allowed to slow the business down while it's happening. That tension is the job.

I've seen firms solve this by adding control at the expense of commercial responsiveness, and I've seen the reverse — commercial speed with control quietly left behind. Neither holds up for long.

My job is to connect the pieces — regulation, governance, people, process, technology, execution — into something coherent enough that the operating structure supports the investment business, rather than becoming the thing it has to work around.

When I get that right, nobody notices the operating model at all. They only notice when it's missing.