AI Rules In The UAE And Saudi Arabia: What Is Law And What Is Guidance

Organisations in the Gulf often ask a simple question: which AI rules must we follow, and which are we encouraged to follow? The answer matters, because the region has published a great deal on AI, but only part of it carries legal force.

As of October 2026, we found no general AI statute comparable to the EU AI Act in either country in the official sources checked for this article. Instead, AI is governed through a mix of binding data protection law, rules that bind only within a financial free zone’s jurisdiction, and national charters and principles that set expectations without penalties. This article sorts them into those three groups. A shorter overview of each region sits in Regulations Across Regions, and Qatar, Bahrain, Oman And Kuwait covers AI policies in the other Gulf states.

The UAE: Binding Law That Touches AI

The UAE’s most important binding rule for AI is its federal data protection law, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022. Article 29 gives controllers and processors six months from the issue of the law’s Executive Regulations to bring their processing into line.¹ The law does not mention AI by name, but it governs the personal data that most AI systems learn from and act on. Three provisions matter most. People may object to decisions made through automated processing, including profiling, especially decisions with legal effects or that harm them, subject to exceptions such as consent or contract. Controllers must involve a human in reviewing automated decisions when a person asks. And a data protection impact assessment is required before processing that systematically evaluates people through automated means with serious effects.¹

The federal law also has notable gaps. It does not cover government data or government entities, health and banking data that have their own legislation, or companies in free zones that have their own data protection rules.¹ The Dubai International Financial Centre (DIFC) is one such free zone, and it has gone further on AI than the federal law. Regulation 10 of the DIFC Data Protection Regulations, enacted in September 2023, sets requirements for processing personal data through autonomous and semi-autonomous systems, including keeping a register of AI processing activities, and the DIFC has since published an accreditation and certification framework for systems used in high-risk processing.² It is binding within the scope of the DIFC Data Protection Law, which covers controllers and processors incorporated in the DIFC wherever they process data, and others processing data in the DIFC as part of stable arrangements.³

The UAE: Strategy, Charter And A New Authority

Most of the UAE’s AI policy is guidance rather than law. The government launched the UAE Strategy for Artificial Intelligence, which aims to make the country a world leader in AI by 2031, in October 2017.⁴ It sets national goals, not obligations on companies.

The UAE Charter for the Development and Use of Artificial Intelligence sets out 12 principles, including safety, algorithmic bias, data privacy, transparency, human oversight, and governance and accountability. The UAE Legislation portal lists it as a public policy issued on 10 June 2024.⁵ The English PDF published by the UAE AI Office is dated July 2024, which explains why both dates appear in commentary.⁶ The document calls itself a guiding framework, and it contains no penalties.

In Dubai, the Dubai Centre for Artificial Intelligence developed the Dubai AI Seal. It is not an ethics or safety certificate: companies apply free of charge, are checked to confirm they genuinely provide AI services, and are placed in one of six tiers according to their economic contribution.⁷ Applying is a business choice, but it has practical weight. In October 2025 Dubai Finance told Dubai government entities to award AI service and consultancy contracts only to companies holding the seal.⁸ In Abu Dhabi, the Artificial Intelligence and Advanced Technology Council (AIATC) focuses on AI investment, partnerships, research priorities and digital infrastructure for the emirate.⁹

On 14 June 2026, Sheikh Mohammed bin Rashid Al Maktoum approved the establishment of a national Artificial Intelligence and Data Authority, reporting directly to the Cabinet and chaired by the Minister of State for Artificial Intelligence. It takes over functions from three bodies: the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, the Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office. The functions announced include leading the national AI strategy, proposing national policies, legislation and strategies, managing federal government data, and setting standards and guidelines for data and AI.¹⁰ As of October 2026 we have not found a published founding law or start date, so treat its powers as announced rather than legally defined.

Saudi Arabia: Principles With Expectations

The Saudi Data and Artificial Intelligence Authority (SDAIA) publishes AI Ethics Principles built on seven principles: fairness; privacy and security; humanity; social and environmental benefits; reliability and safety; transparency and explainability; and accountability and responsibility.¹² The edition on SDAIA’s website when this article was written is dated May 2025 and applies to anyone designing, developing, deploying or using AI in the Kingdom, across public, private and non-profit sectors.

The document is more structured than a typical ethics statement. It sorts AI into four risk levels, says systems posing unacceptable risk are not allowed, and expects conformity assessments for high-risk systems. It also describes compliance follow-up by SDAIA. However, registration is described as optional, compliance is encouraged with badges, and the document sets out no penalties of its own.¹² SDAIA files it under “Regulatory Documents”, but given those features we treat it as guidance with regulatory expectations, not as a statute. Saudi data protection law, which this article does not cover, applies separately where AI uses personal data.

Sorting The Instruments

What This Means In Practice

For most organisations in the region, the binding obligations today come from data protection law, so AI governance starts with the personal data your AI systems use. If you are a DIFC company, Regulation 10 adds AI-specific duties. If you sell AI services to Dubai government entities, the AI Seal is effectively a condition of the contract. If you sell into Europe, the EU AI Act may apply to you directly. The voluntary charters and principles are still worth following: they signal what regulators expect, and aligning with them now is cheaper than retrofitting when binding rules arrive.