GCC: Navigating AI Regulations - the Current Landscape

Artificial Intelligence (AI) is no longer a futuristic concept confined to science fiction; it has firmly established itself as a cornerstone of innovation, shaping industries and redefining the way we live and work. With this rapid adoption of AI technologies arguably comes a need for regulatory frameworks that ensure ethical, secure, and responsible development and deployment. The Gulf Cooperation Council (GCC) region is no exception, with member states making significant changes to address the opportunities and challenges posed by AI.

A Patchwork of Progress

Currently, the regulatory landscape for AI across the GCC is a patchwork of policies, initiatives and guidelines, reflecting each country's priorities and ambitions. While some nations are advancing comprehensive strategies, others are taking a more incremental approach. Here’s a closer look at the current state of play.

United Arab Emirates: Pioneering

The UAE has positioned itself as a pioneer in AI governance. In 2017, it became the first nation to appoint a Minister of State for Artificial Intelligence. The UAE's National AI Strategy 2031 outlines a bold vision to become a global leader in AI by embedding it across key sectors like healthcare, education, and transportation. Other key government publications include the AI Ethics Principles and Guidelines and the UAE’s International Stance on Artificial Intelligence Policy.

We have also seen the publication of specific regulations such as the Federal Law on the Project of the Future Nature and the Law Establishing the Artificial Intelligence and Advanced Technology Council in Abu Dhabi. Both laws provide broad, undefined powers that allow the relevant authorities to regulate new projects and initiatives that encompass the use of AI. 

Beyond this, AI technologies are generally regulated under the UAE’s Protection of Personal Data Law. An honorary mention should also be made to the DIFC Data Protection Law, which, in 2023, introduced Regulation 10, specifically addressing the processing of personal data through autonomous and semi-autonomous systems, such as AI.

Saudi Arabia: A Vision for the Future

The Saudi Data & Artificial Intelligence Authority (SDAIA) covers the AI and privacy space in Saudi Arabia. SDAIA has issued some general guidance relating to the adoption of AI, but this should not be understood as regulation, as such. Specifically, SDAIA has issued an AI Adoption Framework aimed at providing a roadmap for integrating AI across various sectors and fostering a knowledge-based society driven by innovation and continuous development. It provides guidance, outlines key steps and procedures, and seeks to align with best practices to ensure responsible and effective AI implementation. SDAIA has also issued a Generative AI Guideline for Government and a Generative AI Guideline for the Public (i.e. private sector).

Saudi Arabia is, however, on the front foot when it comes to data protection, with its Personal Data Protection Law now in full force. Additionally, the Kingdom has issued several guidance notes addressing complex aspects of the law. While not explicitly targeting AI, the PDPL indirectly governs its use, particularly when personal data is processed automatically.

Qatar: Balancing Innovation and Oversight

In Qatar, the Ministry of Communications & Information Technology leads AI governance. Qatar published its National Artificial Intelligence Strategy for Qatar in 2019. Interestingly, Qatar stands out as the only nation in the region with legally binding guidelines governing the use of AI (the Artificial Intelligence Guidelines). These guidelines apply exclusively to Qatar Central Bank-licensed financial firms and impose several obligations to ensure proper governance and oversight of AI systems.

Laying the Groundwork

Like other GCC nations, Bahrain, Kuwait and Oman have published strategies, programs, or guidelines outlining their approaches to AI. Bahrain and Oman stand out for having legally binding instruments in development that will regulate AI more comprehensively.

In Bahrain, a standalone Artificial Intelligence Regulation Law was put forward in April 2024. This groundbreaking legislation is designed to regulate AI development and deployment in the country. It encompasses areas such as the establishment of an AI unit, licensing requirements, civil liability, and administrative penalties. Notably, it would be the first AI-specific law in the region to impose administrative fines for non-compliance, setting a significant precedent. The status of this draft law is currently unclear. 

In Oman, the National Artificial Intelligence Policy has undergone public consultation, and the finalised version is awaited. This policy is expected to introduce key principles to guide the development and deployment of AI systems, emphasising compliance with privacy, transparency, and accountability standards.

What’s Next?

The GCC’s AI regulatory landscape is evolving rapidly, driven by a shared recognition of AI’s transformative potential. As regulations take shape, businesses operating in the region must stay informed and adaptable. Legal frameworks will play a crucial role in fostering innovation while mitigating risks, making it essential for stakeholders to engage proactively with policymakers.

We are closely monitoring these developments to help our clients navigate the complexities of AI regulation. Whether you’re developing AI solutions, implementing them in your business, or simply preparing for the future, understanding the regulatory environment is key to staying ahead of the curve.

The GCC’s journey toward comprehensive AI governance is just beginning, and the coming years will undoubtedly bring both challenges and opportunities. By staying informed, we can ensure that AI’s potential is harnessed responsibly and sustainably, driving progress for businesses and society alike.

For any further information on developments in AI regulation in the Middle East please contact Nick O’Connell or Charlie Christie.