An overview to the regulations that shape how AI is deployed across the UAE and Saudi Arabia. For each: what it is, who it applies to, and what it means for putting AI into production, with a link to the primary source.
Identify the requirements relevant to your organisation and consider them in system design.
- Jurisdictions
- UAE · KSA
- Entries
- 8 regimes
- Updated
- July 2026
Orientation, not legal advice. This map is a starting point for understanding the landscape, not a substitute for qualified counsel on your specific situation. Regulations change; each entry links to the primary source so you can confirm the current position.
Content last reviewed July 2026
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
u.ae, UAE data protection laws- What it is
- The UAE's federal, cross-sector personal data protection law, in force since January 2022.
- Who it applies to
- Controllers and processors established in the UAE (onshore), and those outside it processing the data of people in the UAE. DIFC and ADGM have their own regimes.
- What it means for deploying AI
- Processing generally needs consent, with limited exceptions, and grants rights that touch automated processing and profiling. Cross-border transfers are conditional, a first-order constraint on where models run and where data flows.
Note, Federal Executive Regulations were pending at last check, confirm current issuance before relying on operational detail.
DIFC Data Protection Law No. 5 of 2020, Regulation 10 (Autonomous & Semi-autonomous Systems)
DIFC, Commissioner of Data Protection, Regulation 10- What it is
- A GDPR-aligned data protection law for the DIFC free zone. Regulation 10 (from September 2023) is among the first UAE provisions to directly regulate AI.
- Who it applies to
- Controllers and processors in the DIFC. Regulation 10 additionally binds deployers and operators of autonomous, generative, and machine-learning systems.
- What it means for deploying AI
- Requires fairness, transparency and accountability principles, clear notices, an AI/systems register, certification, and an Autonomous Systems Officer. High-risk processing is restricted pending audit and must serve human-approved purposes.
Note, The widely cited 'full enforcement from January 2026' date is law-firm commentary, not stated on the DIFC page, treat as commentary.
- What it is
- A GDPR-benchmarked data protection regime for the ADGM free zone, in force since February 2021 and enforced by an independent Office of Data Protection.
- Who it applies to
- Controllers and processors established in ADGM, or processing in the context of ADGM activities.
- What it means for deploying AI
- GDPR-style obligations apply: a lawful basis, data-protection-by-design, records of processing, DPIAs for high-risk processing, and rights around automated decision-making and profiling.
- What it is
- Prudential and conduct rules for CBUAE-licensed financial institutions covering outsourcing, cloud use, and consumer data protection.
- Who it applies to
- CBUAE-licensed financial institutions, banks and other licensees using third parties, cloud, or AI in customer-facing decisions.
- What it means for deploying AI
- Material cloud and outsourcing arrangements need a documented governance framework and prior engagement with the supervisor. Consumer Protection Standards mandate controls over personal data and fair treatment in automated decisions.
Personal Data Protection Law (Royal Decree M/19), with Implementing Regulations
SDAIA, Regulations and policies- What it is
- Saudi Arabia's first comprehensive national data protection law, in force since September 2023 and administered by SDAIA.
- Who it applies to
- Any entity processing the personal data of individuals residing in the Kingdom, including processing from abroad, broadly extraterritorial.
- What it means for deploying AI
- Requires a legal basis (consent-centric with exceptions), controller records, breach notification, and controlled cross-border transfers. Sensitive and government data carry data-residency expectations that shape hosting.
- What it is
- The national data-and-AI authority (and the PDPL regulator). Its AI Ethics Principles and Generative AI Guidelines are principle-based governance instruments.
- Who it applies to
- Entities developing or using AI in the Kingdom; the Generative AI Guidelines target government entities, with a companion set for the private sector and individuals.
- What it means for deploying AI
- Seven principles, fairness, privacy and security, humanity, reliability and safety, transparency, and accountability, with a risk-based classification and self-assessment across the AI lifecycle.
Note, The specific Generative AI Guidelines document could only be confirmed via secondary sources, locate the canonical sdaia.gov.sa link before citing it as primary.
- What it is
- Mandatory cybersecurity and outsourcing/third-party governance frameworks for SAMA-regulated financial entities, the main vehicles governing AI, cloud, and third-party risk in KSA financial services.
- Who it applies to
- SAMA member organisations, banks, insurers, finance companies, credit bureaus, and financial market infrastructure.
- What it means for deploying AI
- Third-party, cloud, and outsourcing providers (including AI-as-a-service) must be governed by defined cyber controls before, during, and at exit of the contract, with a risk assessment initiated whenever outsourcing is considered.
NCA, Essential Cybersecurity Controls (ECC) & Cloud Cybersecurity Controls (CCC)
NCA, Essential Cybersecurity Controls- What it is
- The National Cybersecurity Authority's minimum national baseline (ECC-2:2024) and a dedicated cloud framework (CCC) for providers and tenants.
- Who it applies to
- Government entities and their companies, plus private-sector operators of Critical National Infrastructure; the CCC extends the ECC for anyone using or providing cloud in scope.
- What it means for deploying AI
- In-scope AI and cloud workloads must meet the ECC baseline plus cloud controls, including hosting-in-Kingdom expectations, right-to-audit, exit strategy, encryption, and access control.
Discuss how governance considerations relate to your operating model and implementation priorities.
Senior executive and consulting judgement, supported by tailored agentic intelligences. From AI ambition and strategy to implementation and measurable business impact.