Most coverage of AI regulation in the Middle East stops at a true but useless observation: no Gulf state has passed an AI act. Correct, and it tells a deployment team nothing. Obligations arrive through whichever instrument was already on the books, and in this region that instrument is almost always a data protection law.
Gulf AI regulation inverts the expected ranking once you follow those hooks. The two states spending most heavily on AI, Saudi Arabia and the United Arab Emirates at federal level, impose the lightest binding requirements on an AI deployment. Bahrain, the smallest of the four, requires prior regulatory authorisation for some automated processing and attaches criminal liability. A free zone inside Dubai has the only instrument in the region written specifically for autonomous systems.
Middle East AI regulation rewards a different question from whether a country has an AI law. The question is which instrument carries the enforceable hook, and what that hook actually demands. Four countries, taken in order of how much they ask. Teams working the wider picture first should start with which countries have binding AI law at all.
Bahrain attaches prior authorisation and criminal liability to automated processing
Bahrain is the surprise, and the provisions are specific rather than aspirational.
The PDPL, Law No. 30 of 2018, gives individuals the right to challenge a decision based solely on automated processing under Articles 22 and 23. Article 15 goes considerably further than its regional neighbours: automatic processing of sensitive personal data requires prior authorisation from the Personal Data Protection Authority. Prior authorisation is a gate, not a notification, and it sits upstream of deployment rather than alongside it.
Order No. 43 of 2022 adds a data protection impact assessment before large-scale or systematic automated processing, profiling included. Read Article 15 and Order 43 together and a profiling system touching sensitive categories in Bahrain needs both an assessment and a permission before it runs.
Enforcement carries teeth that no other instrument here matches. Administrative penalties run to daily charges up to BD 2,000, fines up to BD 20,000, suspension orders, withdrawal of authorisations and publication of violators. Article 58 adds criminal exposure of up to one year’s imprisonment and fines from BD 1,000 to BD 20,000, doubled for legal persons under Article 59. A regime with a custodial provision attached to data handling is a different compliance proposition from a voluntary ethics charter.
AI regulation in Bahrain has no dedicated statute. Legislation is at policy stage and may eventually amend the data protection framework on automated decision-making, profiling and data governance. Until then the PDPL is the operative instrument, and it is already more demanding than most teams assume.
DIFC Regulation 10 names deployers and operators and gates high-risk use
Middle East AI regulation has exactly one instrument written for autonomous systems, and it sits inside a financial free zone rather than in any national parliament.
Regulation 10 of the DIFC Data Protection Regulations took effect on 1 September 2023, supplementing DIFC Data Protection Law No. 5 of 2020. Scope is personal data processed by any machine-based system operating in an autonomous or semi-autonomous manner, a definition drawn from OECD work and the EU AI Act and wide enough to cover predictive, prescriptive, generative and machine learning systems. Regulation 10 does not legislate algorithm content. The instrument sets boundaries around organisations that process personal data through such a system.
Two roles carry the duties, and the split will be familiar. A deployer authorises or benefits from the system and sits where a controller sits. An operator builds it on the deployer’s instructions and sits where a processor sits.
Three obligations follow. Users get a clear notice on first use or access, describing the processing, the system’s purposes, the principles and safeguards applied, relevant codes and certifications, and the effect on individual rights, with evidence of compliance and a register produced on request. Systems must reflect five design concepts: ethical, fair, transparent, secure and accountable. Commercial use for high-risk processing is barred outright unless the Commissioner has set audit and certification requirements and the system meets them, and the deployer or operator must appoint an autonomous systems officer in a role modelled on the data protection officer.
The certification gate deserves emphasis because it is structurally unusual. Most regimes permit high-risk deployment subject to conditions the operator self-assesses. Regulation 10 prohibits it until a regulator has specified the certification route. Breaches draw administrative fines under Schedule 2 of the DIFC law, and data subjects can complain about outcomes produced through a system rather than only about the data handling behind it.
The UAE federal layer reaches AI through cybercrime, media and sector law
Outside the free zones the UAE has no standalone AI statute, and the Chambers practice guidance for 2026 is explicit on the point. Regulation arrives through policy instruments, cross-cutting laws and sector rules instead.
Four federal instruments do most of the work. Federal Decree-Law No. 45 of 2021 governs personal data, with cross-border transfers handled under Articles 22 and 23. Federal Decree-Law No. 34 of 2021 on rumours and cybercrimes is the principal route for deepfake and impersonation harms. Federal Decree-Law No. 55 of 2023 on media regulation, whose executive regulations took effect on 31 October 2024, reaches AI-generated media through licensing and content standards. Federal Decree-Law No. 14 of 2023 covers trading through modern technological means, which captures AI-enabled platforms.
One gap in that list matters more than its obscurity suggests. The federal data protection law envisages executive regulations for full enforcement and those regulations remain outstanding. A data protection statute awaiting its implementing instrument is a weaker hook than Bahrain’s, which has both an order and an authorisation regime behind it.
AI regulation in the UAE has a substantial non-binding layer: the National AI Strategy 2031, the UAE Charter for the Development and Use of AI, an AI Ethics Guide and AI Adoption Guideline from the AI Office, a Deepfake Guide from 2021, and Digital Dubai’s Ethical AI Toolkit. Abu Dhabi’s Artificial Intelligence and Advanced Technology Council exists and has issued no regulations. A Regulatory Intelligence Office was established within the Cabinet in April 2025.
Emirate-level rules bite where federal ones do not. Dubai Law No. 9 of 2023 on autonomous vehicles, with a 2025 by-law, requires licensing, allocates operator liability, mandates insurance and requires incident reporting. Teams mapping these overlapping layers usually need a control crosswalk rather than a country list, because the same system can sit under a federal media rule, an emirate transport law and a free zone data regulation simultaneously.
Saudi Arabia routes every binding AI duty through the data protection law
Saudi Arabia has the region’s most developed AI institutional apparatus and nothing binding behind it.
The Saudi Data and Artificial Intelligence Authority has issued a Generative AI Guideline for the public, a Generative AI Guideline for government, Deepfakes Guidelines, National AI Ethics Principles, an AI Adoption Framework and workforce and academic qualification frameworks. The CMS regulation scanner for the Kingdom, updated in February 2026, describes these as non-binding unless linked to another enforceable law. A draft AI Hub Law went to public consultation in April 2025, but it addresses data embassies and sovereign hosting rather than AI regulation, and has not been enacted.
Enforcement therefore runs through the PDPL. Royal Decree M/19 established it, published on 24 September 2021 and amended by Royal Decree M/148 after the Council of Ministers approved 27 amendments in March 2023. The law took effect on 14 September 2023 and the compliance grace period closed on 14 September 2024. Implementing Regulations and separate Data Transfer Regulations have been issued.
Several regulators share the surface. SDAIA leads strategy and guidance, the National Data Management Office covers government data, the National Cybersecurity Authority maintains the Essential Cybersecurity Controls, and the Communications, Space and Technology Commission handles cloud and data centres. Sector authorities add their own layers, with the central bank covering finance and the food and drug authority covering healthcare.
What that structure means operationally is narrower than it looks. A deployment in Saudi Arabia is bound by data protection obligations, cybersecurity controls and whatever the sector regulator requires. The AI-labelled documents shape expectations and procurement, and they are not the thing that creates liability.
Qatar has the law and has not settled who enforces it
Qatar enacted Law No. 13 of 2016 on protecting personal data privacy, in force since 2017 and the first such law in the region. Guidelines followed in 2021.
The enforcement position is unusually unsettled. Chambers guidance updated in March 2026 describes the Compliance and Data Protection Department at the Ministry of Communications and Information Technology as the key regulator, while the National Cyber Security Agency is described as the competent department for administration and enforcement. The agency has since clarified that the competent department has not yet been designated. No widely publicised enforcement action has occurred in the past 24 months.
AI regulation in Qatar has no standalone law and nothing resembling an AI act. AI processing of personal data meets general standards under the law, and Article 16 requires prior approval from the competent authority for sensitive data, which is the closest Qatar comes to Bahrain’s authorisation gate. Guidance exists from the cyber security agency on secure adoption and use of AI, from the ministry for developers, and from the central bank on ethical AI in finance, with binding status unstated in each case.
The Qatar Financial Centre runs a separate regime under its Data Protection Regulations 2021, administered by an independent Data Protection Office that can direct a controller to stop processing specified data under Article 22. Sensitive data in the centre includes biometric, genetic and criminal conviction data, and processing it requires a permit. The free zone is again stricter than the national regime, which is the same pattern the UAE shows.
| Jurisdiction | Binding AI-specific instrument | The hook that actually binds | Hardest requirement |
| Bahrain | None | PDPL No. 30 of 2018 and Order No. 43 of 2022 | Prior authorisation for automatic processing of sensitive data, plus criminal liability |
| Dubai International Financial Centre | Regulation 10, in force 1 September 2023 | DIFC Data Protection Law No. 5 of 2020 | High-risk commercial use barred until certified, autonomous systems officer required |
| Qatar Financial Centre | None | QFC Data Protection Regulations 2021 | Permit required for biometric and genetic data |
| United Arab Emirates, federal | None | Federal Decree-Law No. 45 of 2021 and sector law | Executive regulations still outstanding |
| Saudi Arabia | None | PDPL, Royal Decree M/19 as amended | Full compliance since 14 September 2024 |
| Qatar, national | None | Law No. 13 of 2016 | Prior approval for sensitive data under Article 16 |
What a regional deployment actually has to produce
Middle East AI regulation shows four countries and one pattern. Every binding obligation in the table above attaches to personal data processing rather than to the model, which has three consequences worth planning around.
Middle East AI regulation sets scope by data rather than by capability. A system that never touches personal data sits outside almost every hook listed here, however powerful it is. A modest classifier processing sensitive categories in Bahrain needs an authorisation. Scoping by model sophistication produces exactly the wrong answer in this region, and the register that records what each system processes is what makes the right answer available.
Free zones are stricter than their host states. Both the Dubai and Qatar financial centres impose more than the national regimes around them. An organisation with entities inside and outside a free zone is running two compliance postures, and the free zone one will usually govern the design.
Documentation is the common currency. A DIFC register and notice, a Bahraini impact assessment, a Saudi record of processing and a Qatari sensitive data approval are four different outputs built from the same underlying facts about a system. Producing them separately is how regional programmes become expensive. Data protection law is the operative hook in Europe too, and teams who have built an evidence base for one regime can usually re-point it rather than rebuild it. Where the disclosure duties are hardening fastest is a reasonable guide to where the Gulf regimes will move next.
Two practical notes close the picture. Watch Bahrain, because a state that already legislated automated-processing authorisation is the most likely of the four to convert policy work into binding AI regulation. And treat the non-binding Saudi and Emirati frameworks as procurement requirements rather than legal ones, because they routinely appear in tenders and contracts even though no regulator enforces them directly. Running one evidence base across several regimes at once is the problem govern365.ai was built to solve, and the same records that answer a Gulf regulator will usually answer a European one.
Organisations extending beyond the Gulf will find that AI regulation elsewhere repeats the same hook-hunting exercise. The Indian position and the Canadian one both run through adjacent instruments rather than AI acts, and the United Kingdom’s sector-regulator approach is the purest example of the pattern. Mapping all of them against one control set is what the platform does.
Questions teams ask about AI regulation in the Gulf
Does any Gulf state have an AI law?
No Gulf state has enacted an AI act of general application. The closest binding instrument is Regulation 10 of the DIFC Data Protection Regulations, in force since 1 September 2023, which governs personal data processed by autonomous and semi-autonomous systems inside the Dubai International Financial Centre. Bahrain is developing AI legislation at policy stage. Saudi Arabia’s draft AI Hub Law addresses data embassies and sovereign hosting rather than AI regulation.
Which Gulf jurisdiction is strictest on automated decision-making?
Bahrain, on the current instruments. The Bahraini PDPL requires prior authorisation from the regulator for automatic processing of sensitive personal data, gives individuals a right to challenge decisions based solely on automated processing, and carries criminal penalties of up to one year’s imprisonment with fines doubled for legal persons. Within a free zone, DIFC Regulation 10 is stricter still for high-risk processing, which is barred until certification requirements are set and met.
Are the SDAIA AI guidelines legally binding in Saudi Arabia?
Not on their own. The generative AI guidelines, deepfakes guidelines, AI ethics principles and adoption framework are non-binding unless linked to another enforceable law. Binding obligations on a Saudi deployment come through the PDPL, the National Cybersecurity Authority’s controls and sector regulators. The guidelines still matter commercially, because they appear routinely in procurement.
Does the UAE federal data protection law apply to AI yet?
Federal Decree-Law No. 45 of 2021 is enacted, but it envisages executive regulations for full enforcement and those remain outstanding. In practice the harder UAE obligations for AI deployments currently come from the cybercrime law on deepfakes, the media regulation whose executive regulations took effect on 31 October 2024, emirate-level rules such as Dubai’s autonomous vehicle law, and free zone instruments.
Who enforces data protection in Qatar?
Unsettled. The Compliance and Data Protection Department at the Ministry of Communications and Information Technology is described as the key regulator, while the National Cyber Security Agency is described as the competent department for administration and enforcement. The agency has clarified that the competent department has not yet been designated, and no widely publicised enforcement action has been reported in the past 24 months.
What does an autonomous systems officer do under DIFC Regulation 10?
The role is modelled on the data protection officer and must be appointed by the deployer or operator where a system is used commercially for high-risk processing. Regulation 10 pairs that appointment with a certification gate, so the officer sits alongside audit and certification requirements set by the Commissioner rather than replacing them.
Do these rules apply to a company with no Gulf entity?
Generally the hook follows the personal data rather than the corporate presence. Each regime should be checked on its own extraterritorial terms, and the free zone regimes apply to entities established within them. A system processing Gulf residents’ personal data from outside the region is the fact pattern to take advice on, because the answer differs by state.
Where should a regional programme start?
Inventory which systems process personal data and which process sensitive categories, since that distinction sets scope across all four countries. Identify any entity inside a free zone, because the free zone regime will usually be the strictest obligation in the group and should drive the design. Then build one set of records capable of producing a DIFC notice and register, a Bahraini impact assessment, a Saudi processing record and a Qatari sensitive data approval.
