The Gulf Cooperation Council states regulate AI through strategy and soft law rather than binding statutes. Saudi Arabia and the United Arab Emirates lead the region, pairing ambitious national strategies and dedicated authorities with ethics charters and enforceable data-protection laws.
A strategy-first, soft-law region
Neither leading Gulf state has a single binding AI act. Instead, governance is built from four instruments that work together:
National strategies
Long-horizon plans that position AI as an engine of economic diversification beyond oil.
Dedicated authorities
Government bodies — SDAIA in Saudi Arabia, the AI Office in the UAE — that own the national agenda.
Ethics charters
Non-binding principles for trustworthy, human-centric and transparent AI.
Data-protection law
Enforceable privacy statutes that already bind any AI system processing personal data.
Saudi Arabia
Saudi Arabia has built its AI agenda around the Saudi Data & AI Authority (SDAIA), established in 2019, and the National Strategy for Data & AI. SDAIA has issued AI ethics principles and guidance on generative AI, while the Personal Data Protection Law (PDPL) provides the binding baseline for any system handling personal data. The approach is closely tied to the Vision 2030 diversification agenda.
United Arab Emirates
The UAE was an early mover, appointing the world's first Minister of State for AI in 2017 and adopting a National AI Strategy running to 2031. Governance combines the UAE Charter for the Development and Use of AI with the federal Personal Data Protection Law, alongside heavy investment in home-grown models and applied AI across Dubai and Abu Dhabi.
Saudi Arabia
- Authority: SDAIA (est. 2019)
- Strategy: National Strategy for Data & AI
- Soft law: AI ethics principles; generative-AI guidance
- Data law: Personal Data Protection Law (PDPL)
- Anchor: Vision 2030
United Arab Emirates
- Authority: Minister of State for AI; AI Office
- Strategy: National AI Strategy 2031
- Soft law: UAE Charter for AI (2024)
- Data law: Federal Personal Data Protection Law
- Anchor: applied AI & home-grown models
Key milestones
What it means for companies
In the Gulf, the binding constraint today is data-protection law, not a dedicated AI act — but ethics charters and procurement expectations increasingly shape what "acceptable" AI looks like. Firms entering the region should map data flows against the Saudi and UAE data-protection laws, align with the published ethics principles, and watch for the strategies hardening into enforceable rules.
Original documents
Read the primary sources referenced in this article:
↓ UAE Charter for the Development and Use of AI — official ↓ Saudi Personal Data Protection Law (PDPL) — SDAIA
