As Kuwaiti financial institutions explore artificial intelligence, cybersecurity consultant Husain Alnakkas is focusing on the decisions behind its use: what information enters a system, who checks its answers and how customer trust is protected.
An employee asks an AI assistant to summarise a document. The task sounds routine. If that document contains customer information, however, a question about productivity becomes a question about who is allowed to receive, process and retain someone else’s data.
That tension was at the centre of a recent session delivered by Kuwaiti IT and cybersecurity consultant Husain Ali Alnakkas to Gulf Bank’s leadership. Describing the discussion in a public professional update, Alnakkas said it covered responsible AI adoption, verification before acting and the protection of customer information.
His contribution places a practical question inside Kuwait’s wider interest in artificial intelligence. Before an organisation can assess whether a tool makes work faster, it has to understand what happens to the information used to make that work possible.
Bringing AI decisions into the leadership room
Alnakkas participated in Gulf Bank’s cybersecurity awareness seminar, which brought together more than 100 executive leaders, including acting chief executive Sami Mahfouz. The event formed part of Cybersecurity Awareness Month and the bank’s support for the Central Bank of Kuwait’s Diraya awareness campaign.
The programme brought public-sector and private-sector specialists into the same discussion. Participants included a Ministry of Interior cybercrime officer, representatives from Kuwait Hackers and Axon Technologies, and Gulf Bank’s chief information security officer, Ross McNaughton.
According to the bank, discussions examined evolving fraud, emerging cyber risks and the implications for financial institutions. AI featured both as a technology that can support security and as one that can be misused by attackers.
The executive audience matters. Decisions about introducing a tool, assigning responsibility for its use and approving the information it can access extend beyond the technology department. They affect how an institution organises its everyday work.
Customer privacy starts before the answer appears
In his account of the session, titled “AI & Data Privacy: Protecting Trust,” Alnakkas framed the issue around how organisations can benefit from AI while protecting customer data. He emphasised informed leadership decisions and clear safeguards.
There are two separate questions here. One concerns the material entered into an AI system. The other concerns what people do with the response. A useful-looking answer does not establish that the information supplied to obtain it was handled appropriately, or that the answer itself is correct.
The distinction is reflected in the US National Institute of Standards and Technology’s generative AI risk profile. The framework treats data privacy and confidently presented false information, which it calls confabulation, as distinct risks. It also identifies problems arising from how people interact with and rely on AI systems.
For a financial institution, those categories raise different operational questions. Protecting information requires scrutiny of data access and handling. Checking an answer requires a process for testing its accuracy before someone relies on it. Addressing one does not automatically resolve the other.
NIST’s framework is voluntary guidance, rather than a Kuwaiti banking rule. Its relevance is in explaining why AI oversight cannot be reduced to a single security check when software is first introduced.
Kuwait is already creating space to test AI
The local context is more concrete than a general debate about future technology. The Central Bank of Kuwait’s Wolooj innovation hub explicitly includes AI in finance among the areas accepted for sandbox applications.
Its listed examples include risk assessment, customer-service chatbots, algorithmic trading and fraud detection. Cybersecurity and data privacy are also identified as a separate theme, covering technologies and practices intended to safeguard sensitive financial information.
These are areas eligible for exploration, rather than evidence that every application is operating across Kuwait’s banks. Nevertheless, their inclusion shows that AI adoption and information protection are being considered within the same institutional programme.
The hub’s published framework describes a supervised process involving assessment, guidance and piloting. It includes discussion of technical, safety and operational testing plans, alongside measurable targets and safeguards.
That structure provides useful context for Alnakkas’s emphasis on verification. An application being technically possible is the beginning of an assessment. Establishing how it behaves, what information it uses and what controls surround it is a separate task.
From staff awareness to decisions about data
Alnakkas’s recent banking session also sits alongside earlier work with employees outside the bank. Al Safat Investment’s account of its staff activities records a cybersecurity workshop he delivered for people working at Al Safat Tower, covering threats, digital security and awareness at individual and organisational levels.
The two engagements illustrate different audiences for the same underlying issue. Employees encounter information through daily tasks, while managers shape the processes and tools through which those tasks are completed. Training directed at one group cannot answer every question facing the other.
The Gulf Bank session adds AI to that relationship. Its emphasis on responsible adoption and checking before acting concerns the point at which a person turns a machine-generated response into an institutional decision.
For customers, the practical stakes are straightforward: whether their information remains protected and whether decisions involving them rest on checked information. Those expectations persist regardless of which software an employee uses.
Alnakkas’s discussion leaves a concrete question for organisations introducing AI into everyday work: before an answer is acted upon, can they account for both the data that went in and the checks applied to what came out?
