The Gulf Is Where AI Governance Gets Tested at Scale

No Gulf state has a general AI law in force. The rules that bind AI systems in the Gulf are data protection laws and sector regulations, and in 2025 and 2026 they started to be enforced.

My claim, and plenty of Gulf executives will dispute it: a board that is waiting for a Gulf AI act before it governs its AI is watching the wrong door. The duties are already written, in data law and in what bank and financial-centre regulators require. I wrote this for directors and general counsel of companies that operate in more than one GCC state.

The money explains the title. According to Global SWF, the seven largest Gulf sovereign wealth funds invested $119 billion in 2025, 43 percent of all capital deployed by state-owned investors worldwide. Sovereign investors worldwide put $66 billion into AI and digitalisation, led by Abu Dhabi’s Mubadala at $12.9 billion. Most of that money is invested abroad. At home the same states are putting AI into government and finance. Abu Dhabi is spending AED 13 billion on a 2025 to 2027 digital strategy that aims to automate every government process, PIF launched HUMAIN as a national AI company in May 2025, and Saudi Arabia named 2026 its Year of Artificial Intelligence. Those systems are being tested now, at national scale, under rules written for data.

Does Any Gulf State Have an AI Law?

No general AI statute is in force in any of the six. Each has an AI strategy or ethics principles, and none of those carries a penalty. In October 2025 the GCC Secretary-General said a unified Gulf AI strategy was being prepared and named "the absence of unified legislative standards" among the gaps. Two hard laws have been proposed: a 38-article AI regulation approved by Bahrain’s Shura Council in April 2024, and Saudi Arabia’s draft Global AI Hub Law, put to consultation in April 2025. Neither is law yet. Bahrain’s government told the Shura that existing laws were enough, which makes the absence of an AI act a policy choice as much as a gap.

What does bind is set out below, one row per state. The Regulation Tracker keeps the dated detail and the links to each text.

Why Is Saudi Arabia’s PDPL the Rule That Bites?

Because its regulator has put a number on enforcement. The Personal Data Protection Law came into force on 14 September 2023, and SDAIA’s guide gave controllers a year’s grace, to 14 September 2024. Under Article 36 a violation can draw a warning or a fine of up to SAR 5 million, and the fine can be doubled for a repeat. Disclosing sensitive data to cause harm or for gain is a crime under Article 35, with up to two years in prison.

In January 2026 the Saudi Press Agency reported that SDAIA’s committees had issued 48 decisions over the past year "confirming violations and enforcing the legally prescribed penalties on data controllers". The violations named were unlawful collection and processing, disclosure without a legal basis, weak security measures and marketing messages sent without consent. The release gave no amounts and no company names. Saudi press reported another round of fines and warnings on 29 June 2026, including for breaches reported to SDAIA after the 72-hour deadline.

None of the 48 named an AI system. They still matter for AI, because the Implementing Regulation reaches what AI systems do. Article 11 requires explicit consent when a decision is made solely by automated processing. Article 4 makes controllers tell people whether such decisions are made, and before any processing that uses new technologies or automated decision-making, Article 25 asks for an impact assessment. Under the transfer regulation, data leaving the Kingdom must go to a country on SDAIA’s adequacy list or travel under standard contractual clauses, binding common rules or a certificate of accreditation. For a company that trains or hosts models abroad, that shapes the architecture. One limit runs through all of this: the Article 36 fines apply to private persons and companies, not to public bodies, and government AI across the Gulf is governed by policy rather than penalty. A vendor selling AI to a Gulf ministry carries its own duties whatever its client’s.

What Does DIFC Regulation 10 Change?

It is the most developed binding rule in the Gulf written for AI systems, and the route to meet it is now in place. Regulation 10 of the DIFC Data Protection Regulations has been in force since 1 September 2023. It covers personal data processed through autonomous and semi-autonomous systems in the Dubai International Financial Centre. Regulation 10.3.3 bars the use of a system for high-risk processing unless four conditions all hold: the Commissioner has set audit and certification requirements, the system meets them, its purposes are set or approved by people, and the company has appointed an Autonomous Systems Officer with the standing of a data protection officer.

The Commissioner published an accreditation and certification framework in 2024, and the certification guide, updated on 10 August 2026, sets out how a firm applies. The DIFC lists approved certification bodies on its Regulation 10 page. No DIFC document I found sets an enforcement start date; the claims of "full enforcement from January 2026" trace to consultancies. In June 2026 the DIFC consulted on tightening Regulation 10 and adding a Regulation 11. The consultation closed on 18 July 2026. Nothing has been enacted since.

For a DIFC firm, a high-risk AI system that processes personal data now has a route to certification, so running one without it is harder to defend. The mainland UAE works differently, through Article 18 of the federal PDPL. I set that out in The AI Law the UAE Doesn’t Have (Yet), along with ADGM’s own rule on solely automated decisions in section 20 of its Data Protection Regulations. Firms licensed in Qatar’s financial centre, the QFC, have separate data protection regulations to check.

Where Else Does Data Law Reach Automated Decisions?

In more places than most boards expect. Bahrain’s PDPL has given people a right since 2019 to ask that decisions on their work, finances, creditworthiness, reliability or conduct not be made solely by automated processing (Article 22). Oman amended its PDPL by Royal Decree 68/2026, in force from 7 September 2026. Article 14 now says the data subject "has the right to object to the decisions resulting from automated processing", and the controller must bring in "the human element" to review them.

Sector regulators go further for banks. Qatar’s QCB AI Guideline, in force since 4 September 2024, is written as instructions to QCB-licensed firms: a firm "must receive official QCB approval prior to launching a new AI System as a Provider", and before any material change to one. The Central Bank of the UAE’s guidance note of 11 February 2026 covers high-impact decisions such as loan applications and insurance claims, but describes itself as flexible principles. Kuwait is the gap. It has no general data protection law, and its CITRA regulation covers only licensed telecom and ICT providers.

These rules start on different dates and run on different clocks, so they are easier to see on one line.

Does the EU AI Act Reach Gulf Companies?

Yes. Article 2(1) of the EU AI Act covers providers placing AI systems on the EU market wherever they are established, and providers and deployers outside the EU "where the output produced by the AI system is used in the Union". A Dubai lender scoring EU customers is in scope. The Digital Omnibus, Regulation (EU) 2026/1744, moved the high-risk rules to 2 December 2027 for Annex III uses such as credit and hiring, and to 2 August 2028 for AI in products under Annex I, such as medical devices. The EU AI Act After the Omnibus covers the detail.

What Should a Board Operating in the Gulf Do?

Five moves. None waits for an AI law.

1. List the AI systems that decide things about people, by country. Credit, hiring, pricing, fraud, eligibility. Mark where each one runs and where its data is held. That list is your scope under Saudi Article 11, Bahrain Article 22, Oman Article 14 and, once its compliance period starts, the UAE’s Article 18. Only Seven Percent Say Their Data Is Completely Ready for AI covers the data side.
2. Govern to Saudi Arabia’s rules where you operate there. They are enforced, and Article 25 asks for an impact assessment on exactly the systems your list holds. Where one system serves people in several states, each state’s rule applies to its own people. Build to the strictest requirement on each point, then check that the result meets every state’s mechanism.
3. Map every cross-border data flow. Saudi transfers need a recognised safeguard. Training, hosting and support for models often sit in a different country from the people the data describes.
4. In the DIFC, decide which systems count as high-risk processing. Then appoint the Autonomous Systems Officer and start certification for those systems.
5. Ask your AI vendors the same questions. When the AI is bought, the duties stay with the controller. The AI That Hurts You Is Not the AI You Own sets out the contract terms.

Where to start depends on where the company is licensed and what it sells.

I am not licensed to practise law in any GCC state. This is a board-level reading of public texts. Confirm specifics with counsel licensed in each jurisdiction before you act.