Gulf AI Regulation: What Binds and What Guides in UAE, Saudi Arabia, Qatar

Organisations deploying AI in the Gulf face a patchwork of charters, ethics principles, sector guidelines and a few binding instruments, and it is easy to mistake guidance for law or to miss the rules that do bite. None of Qatar, Saudi Arabia or the United Arab Emirates has a comprehensive horizontal AI act comparable to the EU AI Act. Binding obligations come instead from data protection law, financial-zone regulation such as DIFC Regulation 10, sector regulators such as the Qatar Central Bank, and licensing laws. This guide maps what exists in each country, separates binding from voluntary instruments, gives the status as far as official and authoritative sources show it, and turns that into compliance steps, including for AI agents and the non-human identities they run on. It is for security, privacy, risk and legal leads, and for executives approving AI programmes in the region. Countries are listed alphabetically.

Key takeaways

• No horizontal AI act yet. As at 8 November 2026, none of the three countries has enacted a general AI law. Saudi Arabia's draft Global AI Hub Law, despite its name, deals with sovereign data hosting and "data embassies", and was not enacted as at February 2026.
• Data protection is the main binding layer. Personal data used to train, prompt or run AI falls under each country's data protection law, and in Saudi Arabia the PDPL is the main enforceable instrument touching AI.
• Two binding AI-specific regimes stand out. DIFC Regulation 10 (in force from 1 September 2023) governs processing of personal data by autonomous and semi-autonomous systems in the Dubai International Financial Centre, and the Qatar Central Bank AI Guideline (September 2024) imposes approval, register and consent requirements on licensed entities.
• Ethics principles still shape audits. SDAIA's AI Ethics Principles (September 2023) and the UAE Charter for the Development and Use of AI (June 2024) are non-binding, but regulators and government buyers use them as the yardstick.
• Agents need registers, approvals and identities. Requirements such as an AI register, prior approval for material changes and human oversight translate directly into inventorying agents, their credentials and their tool access.

Scope: who and what is covered

The table lists the main instruments by country. "Binding" here means a law, regulation or regulator instruction written in mandatory terms for a defined population; "guidance" means principles or guidelines that sources describe as non-binding or whose binding status is not stated.

For the data protection laws themselves, see the Qatar Data Protection Law Guide, the Saudi Arabia PDPL Guide and the UAE PDPL Guide. This page does not repeat them.

Key obligations

Qatar

• QCB governance: licensed entities need an AI strategy that is reviewed periodically and an oversight body, with the board and senior management accountable for AI outcomes.
• QCB register and disclosure: keep an up-to-date register of AI arrangements and disclose high-risk criteria, risk assessments and impact assessments to QCB. High-risk AI means systems that could significantly harm the entity's operations or the financial system.
• QCB prior approval: obtain QCB approval before launching a new AI system, making material modifications, or entering high-risk AI purchase, licensing or outsourcing agreements; outsourcing also needs due diligence and QCB consent.
• QCB customer rights: tell customers when they are interacting with AI, explain its risks and limitations, and obtain explicit consent before service. Exemptions require a formal request to QCB.
• NCSA guidelines: an adaptive AI risk management framework, principles covering transparency and explainability, accountability, safety, privacy, robustness, fairness, societal and environmental well-being and auditability, and human oversight of high-impact AI systems.

Saudi Arabia

• AI Ethics Principles: embed the principles across the AI lifecycle with controls and checklists. SDAIA monitors compliance directly or with sector regulators and can audit. The principles cite ISO/IEC 23894 and the NIST AI RMF as examples entities may use without formally adopting them.
• Generative AI: government staff using government data with generative AI follow the government guidelines; the public guidelines set responsible-use expectations for designers, developers, deployers and users.
• Deepfakes: transparency, watermarking and consent practices, and attention to fraud, impersonation and disinformation risks.
• PDPL: lawful basis, transfer and data subject obligations apply to training, inference and deployment that involve personal data, and this is where enforcement runs.

United Arab Emirates

• Charter principles: the 12 principles include human well-being, safety (risky systems modified or removed), avoiding algorithmic bias, data privacy, transparency, human oversight, governance and accountability, and commitment to treaties and applicable laws.
• DIFC Regulation 10: applies to personal data processing through autonomous and semi-autonomous systems in the DIFC, with a certification framework run through Accredited Certification Bodies. Read the regulation text and the Commissioner's guidance for the detailed duties before deploying.
• Licensing: AI projects with no fitting legal framework can seek an interim licence under Federal Decree Law No. (25) of 2018; Abu Dhabi projects fall under the remit of the AI and Advanced Technology Council.

Timeline and current status

Status as at 8 November 2026: the landscape is principle-led, with binding duties in data protection law, DIFC Regulation 10 and the QCB guideline. Several official portals (notably SDAIA's) restrict automated access, and secondary trackers lag, so confirm the current text with the issuing body before relying on any item. Expect more sector rules and possible horizontal laws: treat this page as a status snapshot.

Enforcement and penalties

None of the sources consulted sets out penalties specific to the AI ethics principles, charters or guidelines. Exposure arises through the binding layers:

• Data protection enforcement: SDAIA enforces the PDPL in Saudi Arabia; UAE and Qatar data protection authorities enforce their own laws. AI processing that breaches lawful basis, transfer or security duties is handled as a data protection breach.
• Prudential supervision in Qatar: deploying AI without required QCB approval, register entries or customer consent is a supervisory matter for a licensed entity, handled through QCB's normal powers.
• DIFC supervision: Regulation 10 sits inside the DIFC Data Protection Regulations, so the Commissioner's data protection enforcement framework applies.
• Audit and procurement: SDAIA can monitor and audit against its principles with sector regulators, and government buyers in all three countries use the principles in procurement, so non-alignment costs contracts even where it carries no fine.

What it means for AI agents and non-human identities

None of these instruments names AI agents, but agents fall within "AI systems", "autonomous and semi-autonomous systems" and generative AI. Each obligation has an identity consequence.

For the identity model behind these controls, see the Agentic AI Identity Guide and the Agentic AI Compliance Guide.

Compliance steps

1. Map your footprint. List where you operate (mainland, DIFC, Abu Dhabi, Qatar, Saudi Arabia), which regulators license you, and which AI systems and agents touch each jurisdiction.
2. Classify instruments as binding or guidance. Start with the table above; confirm each against the issuer's current text.
3. Build one AI register. One register that satisfies the QCB requirement can also evidence SDAIA and UAE Charter alignment. Include agents, models, data sources, owners and non-human credentials.
4. Set a risk classification. Define high-risk criteria (QCB requires them to be disclosed) and apply human oversight and approval gates accordingly. NIST AI RMF or ISO/IEC 23894, cited by SDAIA, are reasonable bases.
5. Align data protection. Run DPIAs for AI processing under the relevant PDPL and check cross-border transfers of prompts, training data and logs.
6. Handle DIFC Regulation 10 specifically. If processing in the DIFC uses autonomous systems, read the Regulation and certification framework and decide whether certification is needed.
7. Control change. Route new AI systems and material agent changes through approval, with QCB pre-approval where you are licensed.
8. Disclose to users. Tell customers when they deal with AI, and obtain explicit consent where QCB rules apply.
9. Review twice a year. Re-check status with each issuer; the region is moving quickly.

Decision guidance

• Single-country, non-financial organisation: data protection law plus the national principles is usually the right baseline; adopt the principles as internal policy.
• Financial institution in Qatar: treat the QCB guideline as binding and build approvals into project gates; it is the strictest instrument in this page.
• Firm in the DIFC: Regulation 10 applies on top of UAE federal guidance; the DIFC data protection regime, not the federal PDPL, governs DIFC entities.
• Regional group: design to the strictest combined set (QCB register and approvals, Regulation 10, SDAIA audits) and apply it everywhere to avoid divergent processes.

Common mistakes

• Reading "non-binding" as "irrelevant", when SDAIA can audit against its principles and buyers ask for alignment.
• Assuming the Global AI Hub Law regulates AI use; it addresses data hosting.
• Leaving agents out of the AI register because they are "just automation".
• Letting agents share one service account, which defeats accountability and auditability expectations.
• Applying federal UAE rules inside the DIFC without checking Regulation 10.

Practitioner checklist

• Record each jurisdiction and free zone you operate in, with its binding AI-relevant instruments.
• Maintain an AI register covering systems, agents, owners, data sources and non-human credentials.
• Define and document high-risk AI criteria and the human oversight required.
• Put new AI systems and material agent changes through change approval, with QCB pre-approval where licensed.
• Run data protection impact assessments for AI processing under the applicable PDPL.
• Assess DIFC Regulation 10 applicability and certification for autonomous processing in the DIFC.
• Issue unique credentials to every agent and log its actions per identity.
• Disclose AI interactions to customers and record consent where required.
• Review the status of each instrument with the issuer every six months.

Standards and references

• DIFC Commissioner of Data Protection: Regulation 10
• UAE Government: The UAE Charter for the Development and Use of Artificial Intelligence
• UAE Artificial Intelligence Office: AI strategy and publications
• Qatar News Agency: Qatar Central Bank Issues Artificial Intelligence Guideline
• Library of Congress: AI Regulations in the GCC Member States, Part One
• Library of Congress: AI Regulations in the GCC Member States, Part Two
• CMS: AI laws and regulation in the Kingdom of Saudi Arabia

Related NHI Mgmt Group resources: UAE PDPL Guide · Saudi Arabia PDPL Guide · Qatar Data Protection Law Guide · AI Governance Guide · EU AI Act Compliance Guide. This guide summarises AI regulation and guidance in Qatar, Saudi Arabia and the UAE and is not legal advice.