AI Governance in the Gulf

No Gulf state has a general AI statute in force. What binds AI systems today is data-protection law, and specifically its provisions on automated decisions, which exist in some jurisdictions and not in others. This guide sets out what each regime actually requires across the UAE, Saudi Arabia, Qatar, Bahrain, Kuwait and Oman, separates binding law from supervisory guidance and from national strategy, and shows which regime reaches which entity. Financial free zones are treated as what they are: separate legal orders with their own regulators, so one group can sit under several regimes at once.

It is written for the security or governance owner who has been handed AI alongside everything else. Alongside the legal map it covers the questions that decide whether any of it can be answered, including where models run and where evidence is retained, how agents differ from users, what an ISO/IEC 42001 certificate does and does not attest, and how much of the control work is shared with frameworks an organization may already hold. Every legal position is labeled binding, guidance or national ambition, and cited to the primary instrument.