I spend most of my week being asked a version of the same question: "Who should we get to help us with AI?" It comes from founders in Beirut, from family businesses across the Gulf, from operators who have read enough headlines to feel late and enough vendor pitches to feel cynical. The honest answer is that the choice of consultant matters far less than most people think — and the question they should be asking first matters far more.
I wrote Applied AI for Future Ready Organizations (ISBN 9798279366965) for exactly this reader: the leader who is ready to act but unsure what "ready" even means. This guide is the short version of how I'd tell a company in Lebanon or the wider MENA region to choose — starting with themselves.
First, assess yourself — not the consultant
A good AI strategy consultant does not start by selling you a model, a platform, or a "transformation roadmap." They start with a readiness assessment: a blunt look at whether your business can actually convert AI into a result. You can run the first pass yourself, today, in about twenty minutes. These are the five questions I open every engagement with.
- Can you name one measurable outcome? Pick a single number AI should move — a cost, a cycle time, a conversion rate, a response time. If you cannot name one, you do not need a tool yet; you need a strategist to help you find it.
- Do you own the data the decision runs on? AI sharpens judgement where data already exists. It cannot manufacture a signal you never captured. Find the decisions in that process that already run on data you control.
- Is there a human owner for the output? Every AI-assisted output needs a named person accountable for it. Adoption fails — every single time — wherever no human owns the result.
- Will leadership change a workflow, not just buy a licence? AI strategy is operational change. A consultant can design it, but they cannot install the willingness to actually do it. Be honest about your appetite before you spend.
- Have you set a review date? Commit to a date when you will measure the outcome from question one. A readiness engagement without a review date quietly becomes a pilot that never ends.
A business that can answer all five is ready to hire well. A business that stumbles on three of them does not need a bigger vendor — it needs to do this thinking first, which is itself the most valuable consulting any adviser can give.
Then, separate the strategists from the tool sellers
Once you are ready, the market splits into two groups that look identical in a pitch deck and behave nothing alike in practice. Tool sellers lead with a product and work backwards to a problem. Strategy advisers lead with your outcome and stay product-agnostic until the last responsible moment. The difference shows up in three questions you should ask any consultant before signing:
- "What would make you tell us not to use AI here?" Anyone who can't answer this is selling, not advising. AI is the wrong tool for plenty of problems, and a real strategist will name them.
- "Who on our side owns the result, and how will we measure it?" A good adviser will insist on a human owner and a metric before talking architecture. A vendor will want to talk architecture first.
- "Show me where this turned into capability, not a pilot." Ask for the case where strategy became a durable operating change — staffed, owned, and still running — not a demo that impressed a board and then died.
The right question is never "which AI should we buy." It is "which decision are we trying to make better, and who will own it." Get that right and the tooling is the easy part.
Three documents a MENA-competent consultant should already know
Most of the questions above test judgment, which is hard to fake but also hard to score. Here is one that is neither. Ask a candidate about these three documents. They are public, they are short enough to have read, and each one governs something a MENA deployment routinely gets wrong. A consultant who has never opened them is not necessarily bad — but they are selling you tooling, not strategy.
1. Where your data is allowed to go. Saudi Arabia’s Personal Data Protection Law (SDAIA, English text) permits a controller to “Transfer Personal Data outside the Kingdom or disclose it to a party outside the Kingdom” only to achieve one of an enumerated set of purposes, subject to the conditions in Article 29. Nearly every proposal that routes prompts to a foreign model API is a cross-border transfer. The question is not whether the consultant likes the architecture; it is which paragraph they think authorises it. If they have not thought about it in those terms, you will be the one answering for it.
2. Why an EU regulation binds a Beirut company. The EU AI Act (Regulation (EU) 2024/1689) states in Article 2 that it applies to providers placing AI systems on the Union market “irrespective of whether those providers are established or located within the Union or in a third country,” and to third-country providers and deployers “where the output produced by the AI system is used in the Union.” If you sell into Europe, or your client’s client does, third-country establishment is not a shield. A consultant who treats European rules as somebody else’s problem has told you how much diligence they do.
3. A shared vocabulary for risk. The NIST AI Risk Management Framework (AI 100-1) organises the work into four functions — to “govern, map, measure, and manage AI risks” — with governance designed as a cross-cutting function infused throughout the other three. It is voluntary, and it is American, and neither of those matters much: it is a common language your board, your auditor and your vendor can all use. Ask a candidate to place your intended project inside those four functions. A strategist will do it in a couple of minutes. A tool seller will describe features instead.
Two honest caveats. None of this is legal advice, and a consultant who can quote all three is not thereby qualified — citation is a floor, not a ceiling. And these instruments move: the AI Act phases obligations in over several years, and the Saudi law has implementing regulations that carry much of the operative detail. What you are testing is not memorised text. It is whether the person across the table knows that the compliance surface exists before they design on top of it.
Why region matters here
Generic AI advice assumes abundant talent, deep data, and time to experiment. Most organizations I work with across Lebanon and MENA have none of those in surplus — talent is scarce, margins are thin, and there is little patience for a project that doesn't pay back. That constraint is not a disadvantage; it is a discipline. It forces the readiness-first approach above, because there is no budget for AI theatre. The consultants worth hiring in this region are the ones who treat that scarcity as the design brief, not an excuse.
This is the work my team at Webspot does with companies across the region: readiness assessment first, then building the operating discipline that turns AI strategy into something that actually ships and keeps running. It is also the throughline of my book and of the framework I've since built around what I call the e-mployee — an AI worker given a real role, a real owner, and a real standard to meet. And it is how I run my own operation: my AI partner Brian holds defined outputs under my accountability, which is the same model I'd ask any client to adopt.
If you want the long form, it is all in Applied AI for Future Ready Organizations. But you can start before you read a word of it: run the five questions, be honest about the answers, and only then go looking for help. The readiness is the strategy. Everything after it is execution.
