Cisco’s Abdelilah Nejjari discusses how workload priorities, operational skills and agent security shape sovereign AI infrastructure across the UAE and wider region.
AI sovereignty is widening the enterprise conversation from where data resides to who can access it, operate the underlying infrastructure and govern its use. Organisations pursuing AI must balance control over sensitive workloads with access to global innovation, while developing the skills and processes needed to manage increasingly autonomous systems.
Abdelilah Nejjari, Managing Director for the Gulf, Levant, Türkiye, Caucasus & Central Asia at Cisco, examines how organisations can translate sovereignty ambitions into operational capability. Nejjari discusses deployment choices across on-premises, hybrid and cloud environments, the security requirements of AI agents, and Cisco’s approach to infrastructure that customers operate and control.
Interview excerpts
How should organisations define AI sovereignty beyond data residency, and which areas of control matter most?
For Cisco, sovereignty means giving customers more choice, more control and more autonomy over their data and digital infrastructure. Data residency answers where information is stored, but AI raises a broader question: who governs the data, systems and infrastructure that AI relies on? The UAE set out its AI ambitions early, with the UAE National Strategy for Artificial Intelligence 2031. AI workloads use an organisation’s most sensitive information, such as financial transactions or operational data from critical facilities. The value AI delivers is therefore tied to how securely that data is protected and controlled. Three areas of control matter most. The first is access: who can reach your systems and data. The second is operations: who runs the environment, and whether updates can be managed on your own schedule. The third is governance: whether your technology partners’ principles align with your own. With Cisco Sovereign Critical Infrastructure, control over access to systems and data sits entirely with the customer, and Cisco does not run, access or control the infrastructure. Our product development practices also prohibit any intentional features designed to allow unauthorised access or to bypass security controls.
Organisations that first identify which workloads are mission-critical can apply sovereignty where it has the greatest impact, rather than uniformly across every system.
How can organisations balance local control with access to global AI technologies across on-premises, hybrid and cloud environments?
Sovereignty does not mean isolation. Organisations across the region want to remain connected to global innovation while retaining control over their most critical systems. The right model depends on the workload. Systems that support national services or critical operations may require fully on-premises, air-gapped environments, operated and accessed solely by the organisation. Other workloads can run well in a hybrid model that combines sovereign infrastructure with private or public cloud services. These decisions should be driven by data sensitivity, regulatory requirements and business need. Customers can deploy on-premises, air-gapped Sovereign Critical Infrastructure alongside cloud-based services, and they decide which workloads run on sovereign infrastructure and which do not. Leaders should also be clear about the trade-offs. Air-gapped environments generally provide standard product functionality as available at installation. Updates are applied through offline means, and certain cloud-based features are not available once those services are disconnected. This is also why the portfolio is built on the principle that there is no one-size-fits-all approach, meeting organisations where they are on their sovereignty journey.
Which skills and governance processes are essential to turn AI sovereignty ambitions into operational capability?
An environment you control places greater responsibility on your own governance, processes and people. The question I encourage leaders to ask is whether they have the capability to operate it. On governance, four practices are essential: classifying workloads by criticality, defining clearly who can access what, holding technology partners to transparent principles, and managing updates and patching on your own schedule. In Sovereign Critical Infrastructure environments, customers can apply local or offline updates without a cloud connection, and they manage that process themselves. On skills, organisations need people who can design, operate and secure these environments, including running them without reliance on external connectivity. The UAE has strong momentum. Cisco’s 2025 AI Readiness Index found that 64% of UAE organisations have a well-defined strategy for deploying AI, yet only 17% have a mature, repeatable innovation process. Closing that gap requires investment in people and process as much as in technology. Cisco is already working to narrow this gap, with training and upskilling at the centre of its efforts.
The Cisco Networking Academy has trained more than 168,000 learners in the UAE since its inception, helping organisations address skills gaps in managing on-premises data centres.
What additional security and resilience measures are needed when AI agents move from recommending decisions to taking action?
As AI systems progress from recommending decisions to executing them, the infrastructure underneath must be secure, resilient and firmly controlled. The UAE is advancing quickly. This year, the government unveiled a framework to deploy agentic AI across 50% of government sectors and operations within two years, while Cisco’s 2025 AI Readiness Index found that 92% of UAE organisations plan to deploy AI agents. Cisco’s approach to securing agents rests on three pillars. The first is establishing trust before agents go to work: Cisco is extending Zero Trust Access to AI agents, so organisations can register them, map them to accountable human owners and enforce task-specific permissions. The second is protecting agents from external threats: agents should be tested before deployment, and Cisco AI Defense supports red-teaming and vulnerability testing. The third is detecting and responding at machine speed, which is why Cisco is adding AI-driven capabilities to Splunk Enterprise Security. Each of these measures depends on the integrity of the infrastructure beneath it, which is where agent security and sovereignty meet. Once agents act on behalf of public services, control over data, systems and access becomes a matter of public trust, not only a technical consideration.
How is Cisco helping organisations build sovereign AI infrastructure while maintaining interoperability and control?
Cisco gives organisations the option to build and operate infrastructure they fully control, on their own premises. Our Sovereign Critical Infrastructure portfolio, now available across EMEA including the UAE, spans networking, security, compute, collaboration, network management, AI and Splunk. It can be configured and operated in air-gapped, on-premises environments, giving organisations secure infrastructure to run AI workloads in data centres or AI factories that they trust and control. On control, Cisco does not run, access or control Sovereign Critical Infrastructure deployments. Licensing is air-gapped, so it does not depend on cloud validation, and customers can apply their own security requirements, such as customer-managed encryption. On interoperability, this is the Cisco technology organisations already know, not a separate stack. Customers decide which workloads run on sovereign infrastructure and which do not, including hybrid models alongside cloud services. The portfolio is currently available for new deployments. With this approach, we are helping UAE organisations build trusted infras tructure for today’s operational needs and tomorrow’s AI opportunities.
Source: Tahawul Tech
