The obligations are already here, just not in one law
Enterprises operating in the Gulf often ask when Saudi Arabia or the UAE will pass "their AI Act". It is the wrong question. Both countries have chosen a layered model: national AI principles and frameworks issued by the AI authority, binding obligations that reach AI through personal data protection law and data classification, sector and free-zone regulators with their own rules, and, in the UAE, an explicit government mandate to put agentic AI into public services.
Our argument is simple. An enterprise that waits for a horizontal AI statute is already behind on the parts that bind today. A Saudi bank scoring applicants with a model, a UAE retailer using an AI assistant on customer data, or a DIFC firm running an autonomous agent over client records each has specific legal duties now, under laws that do not mention "AI" in their titles.
The second reason to act is commercial. Both governments are among the most aggressive public-sector adopters of AI in the world. When the UAE Cabinet decides to run half of federal services on agentic AI within two years, every supplier to those services will be asked to show how its AI is governed. Governance evidence is becoming a condition of selling to the state.
Figure 1
AI obligations arrive through data law, not an AI act
Main instruments affecting enterprise AI in Saudi Arabia and the UAE, by how binding they are
Binding law today
Saudi Arabia
- Personal Data Protection Law and Implementing Regulation (automated decisions, impact assessment, 72-hour breach notice)
UAE
- Federal Decree-Law No. 45 of 2021 (Art. 18 automated decisions, Art. 21 impact assessment)
- DIFC Data Protection Regulations, Regulation 10
- ADGM Data Protection Regulations
Applies to government and its partners
Saudi Arabia
- NDMO data management standards and data classification
- Generative AI rule: public data only in GenAI tools (government)
UAE
- Cabinet agentic AI framework, 23 April 2026 (50% of government in two years)
- Government data sharing and digital records policies
National frameworks and guidance
Saudi Arabia
- AI Ethics Principles (2023; May 2025 edition)
- National AI Risk Management Framework (July 2026)
- Draft Responsible AI Policy (consulted April–May 2026)
UAE
- UAE Strategy for AI 2031 (2017)
- Charter for the Development and Use of AI (July 2024)
- Agentic AI service design guide (2026)
Saudi Arabia: SDAIA sets the frame, the PDPL sets the floor
The AI Ethics Principles
The Saudi Data and Artificial Intelligence Authority (SDAIA) first issued its AI Ethics Principles in September 2023. The edition currently on SDAIA's site is dated May 2025 (document SDAIA-P114E). It applies to all AI stakeholders designing, developing, deploying, using or affected by AI systems in the Kingdom, including public, private and non-profit entities.
It sets seven principles: fairness; privacy and security; humanity; social and environmental benefits; reliability and safety; transparency and explainability; and accountability and responsibility. More useful for planning is its four-level risk scale:
- Little or no risk, such as spam filters: no restrictions, ethical compliance recommended.
- Limited risk: subject to the AI ethics principles.
- High risk to basic rights: pre- and post-deployment conformity assessments, plus applicable statutory requirements.
- Unacceptable risk, such as social profiling, exploitation of children or likely behavioural distortion: not allowed.
The principles also name roles. The head of the entity or Chief Data Officer owns the AI ethics practice, a compliance officer leads it strategically, a Responsible AI Officer runs it operationally, and an AI system assessor audits it. SDAIA offers optional registration and badges for entities that adopt the principles. The structure deliberately sits on top of the data management roles that NDMO standards already require, which is why entities with a working data office implement it fastest. For that foundation, see DAMA-DMBOK and Saudi Arabia's NDMO Standards.
Generative AI guidelines
In January 2024 SDAIA published two sets of Generative AI Guidelines, one for government entities and one for the public. The current government edition (SDAIA-P116E, May 2025) contains the most operational rule in the Saudi framework: government employees must not enter data classified above public into generative AI tools, and tool use should be limited to data classified as public. It also asks entities to tell beneficiaries when content is AI-generated, to use watermarks, and to offer non-automated channels for people who prefer human service.
For an enterprise this translates directly into a control: generative AI access must be gated by data classification, which means your data must actually be classified.
The National AI Risk Management Framework
On 14 July 2026, according to the Saudi Press Agency, SDAIA launched a National AI Risk Management Framework for public and private entities. It sets a four-stage process (context and scope, risk identification and assessment, treatment, and continuous monitoring and review) and rates risk with a likelihood and impact matrix. SDAIA also ran a public consultation from 3 April to 3 May 2026 on a draft Responsible AI Policy covering government, private and non-profit sectors. As of 25 August 2026 we have not seen a final version published; watch for it.
Where the PDPL bites on AI
The Personal Data Protection Law has been enforceable since 14 September 2024 and applies to public and private entities processing personal data in the Kingdom. Its Implementing Regulation contains three provisions that apply directly to AI systems that use personal data:
- Explicit consent for solely automated decisions. Article 11(2)(c) requires explicit consent when decisions are made solely on the basis of automated processing of personal data.
- Notice when you adopt new technology or automate decisions. Under Article 4(5), a controller whose activities involve continuous monitoring, adoption of new technologies or automated decisions based on personal data must tell data subjects, among other things, whether decisions will be made solely by automated processing.
- An impact assessment. Article 25(1)(c) requires a written impact assessment where processing relies on newly adopted technologies or involves decisions based on automated processing, as well as for sensitive data and for linking datasets from different sources.
The 72-hour breach notification to SDAIA also applies when an AI system leaks personal data. The practical point is that most enterprise machine learning on customer data, and most generative AI over personal data, will trigger at least one of these.
Figure 2
Most enterprise AI on personal data triggers the Saudi PDPL
Implementing Regulation provisions that apply directly to AI systems
- Art. 11(2)(c)
When
A decision is made solely by automated processing of personal data
Then
Obtain explicit consent
- Art. 4(5)
When
Activities involve continuous monitoring, new technologies or automated decisions
Then
Extend the privacy notice, including whether decisions are solely automated
- Art. 25(1)
When
New technologies, automated decisions, sensitive data, or linking datasets from different sources
Then
Prepare a written, documented impact assessment
- Art. 24
When
A personal data breach, including one caused by an AI system
Then
Notify SDAIA within 72 hours where required
- Art. 32
When
Core activities involve regular, systematic monitoring or sensitive data, or a public entity processes at large scale
Then
Appoint a data protection officer
The UAE: a strategy, a charter and a mandate to go agentic
Strategy, charter and accountable roles
The UAE appointed the world's first Minister of State for Artificial Intelligence in 2017 and launched the UAE Strategy for Artificial Intelligence 2031 the same year. On 30 July 2024 the AI Office launched the Charter for the Development and Use of Artificial Intelligence, whose principles include safety, fairness, inclusive access, awareness and compliance with the laws governing AI. The charter is guidance rather than law, but it is the reference the federal government points to. The government has also created a Chief Executive Officer for Artificial Intelligence role in ministries and federal entities, responsible among other things for governance frameworks that support AI adoption.
The April 2026 agentic AI mandate
On 23 April 2026 the UAE Cabinet announced, under the directives of the President, a framework to transform 50% of government sectors, services and operations to agentic AI within two years. The Cabinet statement is unusually direct: ministers, directors general and entities will be assessed on their ability and speed in adopting the transformation. A dedicated taskforce chaired by the Minister of Cabinet Affairs drives execution, and implementation is phased with continuous performance and impact assessment. The same Cabinet meeting approved a government services data sharing policy and a digital records policy.
Since then, a National Committee for Agentic AI has issued a practical guide for designing government services with agentic AI, which stresses authorised actions, user approval where needed, privacy protection and human support. In August 2026, WAM reported that the strategic workstream operates on the principle "human leads, AI enables". In June 2026 the Cabinet also approved a federal Artificial Intelligence and Data Authority to lead the data, AI and digital government agenda, as reported by regional media citing the UAE Government Media Office.
For enterprises, the mandate matters in two ways. Suppliers to federal entities will be building, integrating or operating agents that take actions, so expect contract requirements on authorisation limits, logging, human escalation and data handling. And the speed target makes governance a delivery constraint, not a review step. Decision rights and proportional review for these systems are covered in The Enterprise AI Operating Model.
Figure 3
The UAE moved from strategy to an agentic AI mandate
Key UAE AI governance milestones, federal and DIFC
2017
First Minister of State for AI; UAE Strategy for AI 2031 launched
Jan 2022
Federal PDPL (Decree-Law No. 45 of 2021) takes effect
Sep 2023
DIFC enacts Regulation 10 on autonomous and semi-autonomous systems
Jul 2024
Charter for the Development and Use of AI launched
23 Apr 2026
Cabinet framework: 50% of government sectors, services and operations on agentic AI within two years
Jun 2026
Federal AI and Data Authority approved (reported)
Aug 2026
Agentic AI strategic workstream launched; DIFC Regulation 10 certification portal guide
By 2028
Agentic AI target date for federal government
The federal PDPL and its gaps
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in effect since 2 January 2022, gives data subjects the right to object to decisions resulting from automated processing, including profiling, particularly those with legal or adverse effects (Article 18). The exceptions are contract, other applicable legislation, and prior consent, and in every case the controller must provide human review of automated decisions on request. Article 21 requires an impact assessment before using modern technologies that pose a high privacy risk, including systematic evaluation of personal aspects by automated processing with legal or serious effects.
The scope exclusions are as important as the duties. Article 2 excludes government data and government entities, health and banking data that have their own legislation, and companies in free zones with their own data protection laws. A UAE enterprise therefore has to work out which regime applies to each AI system before it can design controls.
Free zones: where AI-specific rules already exist
DIFC Regulation 10
The most specific AI rule in the region sits in the Dubai International Financial Centre. Regulation 10 of the DIFC Data Protection Regulations, enacted in September 2023, governs personal data processed through autonomous and semi-autonomous systems. Its main features, from the Commissioner's guidance:
- New roles. A deployer (who authorises or benefits from the system) carries controller-like accountability; an operator (the technical service provider) carries processor-like duties; a provider develops or commercialises the system.
- Clear notice at first use, telling users which processing is not human-initiated or controlled and how the system affects their rights to rectification, erasure or objection.
- Human-defined purposes. Purposes the system can generate itself must stay within principles defined and fixed by humans.
- Evidence on request, in the form of policies, governance and principles frameworks.
- Certification for high-risk processing. Systems used commercially for high-risk processing activities must meet the Commissioner's audit and certification requirements. An accreditation and certification framework is published, and an August 2026 guide describes the portal-based application process through accredited certification bodies.
- An Autonomous Systems Officer, who initially performs a function similar to a data protection officer.
ADGM and Dubai
Abu Dhabi Global Market runs its own data protection regime through its Office of Data Protection, and ADGM-registered entities that process personal data must register as data controllers. Firms there should treat AI processing under that regime rather than the federal PDPL. In Dubai, beyond the DIFC, the government announced in May 2026 a program to move the emirate's private sector toward agentic AI within two years, with training tracks and incubators. That is an adoption program rather than a set of obligations, but it signals where scrutiny of governance will follow.
Which regime applies to you
The first compliance task is jurisdictional, not technical. The same model can be subject to three different regimes depending on who deploys it, where, and on what data.
Figure 4
Start with jurisdiction, not technology
Answer for each AI system. More than one answer can be yes; sector regulators may add further rules.
- 1
Is the deploying entity in the DIFC or ADGM?
If yes: Apply that free zone's data protection regime. In the DIFC, screen the system against Regulation 10, including certification for high-risk processing. - 2
Is it a UAE federal or local government entity, or a supplier operating its services?
If yes: The federal PDPL excludes government entities and data. Government policies, the agentic AI framework and contract terms govern instead. - 3
Is it another UAE entity using personal data, outside regulated health or banking data?
If yes: Apply the federal PDPL: Article 18 rights on automated decisions and Article 21 impact assessments. - 4
Does it process personal data in Saudi Arabia, or about people in the Kingdom?
If yes: Apply the PDPL and Implementing Regulation. Add SDAIA's AI Ethics Principles risk tiering. - 5
Is it a Saudi public entity, or a partner handling government data?
If yes: Add NDMO standards, data classification and the Generative AI Guidelines for Government.
Data location is a separate question with its own rules, including NDMO classification and cross-border transfer conditions under both PDPLs. We cover classification foundations in the NDMO implementation guide, and residency in a dedicated article; do not let residency debates stall the governance work, which is needed wherever the model runs.
A practical compliance checklist
The checklist below is the minimum we would expect an enterprise operating in both countries to have in place. It combines binding requirements with the national frameworks that regulators and government buyers use as their reference.
Figure 5
Ten checks every Gulf enterprise should be able to evidence
Red marks a duty that comes from binding law or regulation where it applies. The rest are national frameworks regulators and government buyers use.
Inventory
Register every AI system with deploying entity, data used and decisions supported
- Basis
- SDAIA AI Ethics Principles; DIFC Reg. 10 register expectation
- Evidence
- AI register with owner and regime per system
Risk tier
Classify each system: little or no, limited, high, unacceptable
- Basis
- SDAIA AI Ethics Principles; National AI Risk Management Framework
- Evidence
- Tier and rationale; conformity assessment for high risk
Impact assessment · binding
Assess automated decision and new-technology processing before go-live
- Basis
- Saudi PDPL IR Art. 25; UAE PDPL Art. 21
- Evidence
- Dated, signed assessment per system
Consent and notice · binding
Explicit consent for solely automated decisions (KSA); first-use notice (DIFC)
- Basis
- Saudi PDPL IR Art. 4(5), 11(2)(c); DIFC Reg. 10
- Evidence
- Consent records; notice text and screenshots
Human review · binding
Provide a working route to human review of automated decisions
- Basis
- UAE PDPL Art. 18(4)
- Evidence
- Procedure plus request and outcome log
Data classification
Gate generative AI inputs by classification; public data only for government data
- Basis
- SDAIA GenAI Guidelines for Government; NDMO standards
- Evidence
- Gateway policy configuration and blocked-request logs
Certification · binding
Screen DIFC systems for high-risk processing; certify before commercial use
- Basis
- DIFC Reg. 10.3.3
- Evidence
- Screening record; certificate or exemption rationale
Accountable roles
Name a Responsible AI Officer (KSA), an Autonomous Systems Officer (DIFC), a DPO where required
- Basis
- SDAIA AI Ethics Principles; DIFC Reg. 10; Saudi PDPL IR Art. 32
- Evidence
- Appointment letters and role descriptions
Incidents · binding
Include AI failures and data leaks in incident response; meet 72-hour breach notice
- Basis
- Saudi PDPL IR Art. 24
- Evidence
- Incident procedure and dated tabletop exercise
Agents for government
Define authorisation limits, approvals, logging and human escalation for agents
- Basis
- UAE agentic AI framework and service design guide
- Evidence
- Agent design record; action logs; escalation tests
| Area | Action | Basis | Evidence |
|---|---|---|---|
| Inventory | Register every AI system with deploying entity, data used and decisions supported | SDAIA AI Ethics Principles; DIFC Reg. 10 register expectation | AI register with owner and regime per system |
| Risk tier | Classify each system: little or no, limited, high, unacceptable | SDAIA AI Ethics Principles; National AI Risk Management Framework | Tier and rationale; conformity assessment for high risk |
| Impact assessment | Assess automated decision and new-technology processing before go-live | Saudi PDPL IR Art. 25; UAE PDPL Art. 21 | Dated, signed assessment per system |
| Consent and notice | Explicit consent for solely automated decisions (KSA); first-use notice (DIFC) | Saudi PDPL IR Art. 4(5), 11(2)(c); DIFC Reg. 10 | Consent records; notice text and screenshots |
| Human review | Provide a working route to human review of automated decisions | UAE PDPL Art. 18(4) | Procedure plus request and outcome log |
| Data classification | Gate generative AI inputs by classification; public data only for government data | SDAIA GenAI Guidelines for Government; NDMO standards | Gateway policy configuration and blocked-request logs |
| Certification | Screen DIFC systems for high-risk processing; certify before commercial use | DIFC Reg. 10.3.3 | Screening record; certificate or exemption rationale |
| Accountable roles | Name a Responsible AI Officer (KSA), an Autonomous Systems Officer (DIFC), a DPO where required | SDAIA AI Ethics Principles; DIFC Reg. 10; Saudi PDPL IR Art. 32 | Appointment letters and role descriptions |
| Incidents | Include AI failures and data leaks in incident response; meet 72-hour breach notice | Saudi PDPL IR Art. 24 | Incident procedure and dated tabletop exercise |
| Agents for government | Define authorisation limits, approvals, logging and human escalation for agents | UAE agentic AI framework and service design guide | Agent design record; action logs; escalation tests |
What to do in the next 90 days
- Inventory every AI system in Saudi Arabia and the UAE, with the legal entity that deploys it, the data it uses and whether it makes or supports decisions about individuals.
- Assign each system to a regime: Saudi PDPL and NDMO, UAE federal PDPL, DIFC, ADGM, or a sector regulator. Flag systems that sit in more than one.
- Run the impact assessments the law already requires: Article 25 assessments in Saudi Arabia for automated decisions and new technology, Article 21 assessments in the UAE, and Regulation 10 high-risk screening in the DIFC.
- Fix consent and notice for automated decisions: explicit consent in Saudi Arabia where decisions are solely automated, a working human review route in the UAE, and first-use notices for DIFC systems.
- Gate generative AI by data classification. Enforce SDAIA's public-data-only rule for government data at the gateway, and set equivalent rules for your own confidential data.
- Appoint named owners: a Responsible AI Officer in Saudi entities, a CEO for AI or equivalent for UAE government work, and an Autonomous Systems Officer in the DIFC where Regulation 10 applies.
- Prepare a supplier evidence pack for government buyers: system cards, evaluation results, logging and escalation design for agents, and incident procedures.
Frequently asked questions
Does Saudi Arabia have an AI law?
Saudi Arabia governs AI mainly through SDAIA frameworks and existing law rather than a dedicated AI statute. The AI Ethics Principles, Generative AI Guidelines and the National AI Risk Management Framework (July 2026) set expectations, while the Personal Data Protection Law and its Implementing Regulation impose binding duties on AI that uses personal data, including explicit consent for solely automated decisions and impact assessments.
Does the UAE PDPL restrict automated decision-making?
Yes. Article 18 of Federal Decree-Law No. 45 of 2021 gives individuals the right to object to decisions resulting from automated processing, including profiling, subject to exceptions for contract, other legislation and prior consent. The controller must provide human review of automated decisions on request. The law does not apply to government entities or to free zones with their own data protection laws.
What is DIFC Regulation 10?
It is a provision of the DIFC Data Protection Regulations, enacted in September 2023, governing personal data processed through autonomous and semi-autonomous systems. It introduces deployer, operator and provider roles, requires clear notice to users, requires certification for systems used commercially in high-risk processing, and introduces an Autonomous Systems Officer role.
What does the UAE agentic AI mandate mean for private companies?
It directly binds federal government entities, which must move 50% of sectors, services and operations to agentic AI within two years of 23 April 2026. Private companies are affected as suppliers and partners, and should expect requirements on agent authorisation, logging, human escalation and data handling in government contracts.
Sources and further reading
- SDAIA laws, regulations and policies, Saudi Data and Artificial Intelligence Authority. Index of the AI Ethics Principles, Generative AI Guidelines, Deepfakes Guidelines and AI Adoption Framework.
- AI Ethics Principles, SDAIA, document SDAIA-P114E, May 2025 edition. Scope, principles, risk levels and roles.
- Generative AI Guidelines for Government, SDAIA, document SDAIA-P116E, May 2025 edition.
- SDAIA Introduces National Framework for Managing AI Risks, Saudi Press Agency, July 2026.
- Implementing Regulation of the Personal Data Protection Law, SDAIA. Articles 4, 11, 24, 25 and 32.
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, UAE Legislation portal. Articles 2, 18 and 21.
- UAE government framework to deploy agentic AI across 50% of government sectors, UAE Cabinet, 23 April 2026.
- Agentic AI for Government Services, UAE Government portal.
- UAE advances integration of agentic AI across Federal Government, WAM, 9 August 2026.
- UAE Charter for the Development and Use of Artificial Intelligence launch, WAM, 30 July 2024.
- Artificial intelligence in government policies, UAE Government portal. AI strategy, CEO for AI role and councils.
- DIFC data protection guidance, including Regulation 10, DIFC Commissioner of Data Protection. Regulation 10 guidance (rev. 03, August 2024), FAQs and certification portal guide (August 2026).
- Data protection laws of the world: Saudi Arabia, DLA Piper. PDPL enforcement date and breach notification.
- Dubai mandates private-sector agentic AI adoption within two years, The Next Web, May 2026.
- UAE creates federal authority to lead AI, data and digital government, Middle East AI News, June 2026.
This article is general guidance, not legal advice. Positions are stated as of 25 August 2026. Confirm specific obligations against current SDAIA, NDMO, UAE Data Office, DIFC and ADGM publications and with qualified counsel.