AI regulations in the Middle East: what binds you in 2026

If your organisation uses AI in more than one Gulf or Levant market, you face a choice: wait for dedicated AI laws, or build controls now on the rules that already apply. We recommend building now. In the official sources we checked on 19 October 2026, none of the five countries here has a cross-sector AI act in force. AI regulations in the Middle East therefore reach you mainly through data protection laws, sector regulators and free-zone rules, with national AI charters and frameworks as guidance.

The trade-off is real. Controls built today may need rework when an AI law arrives; the UAE, for one, announced a federal AI and data authority in June 2026 that, according to Morgan Lewis, can propose legislation. But data protection duties already bind and reach AI tools that process personal data within each law's scope.

This is general information, not legal advice. Obligations depend on your sector, your data and where you are licensed, so confirm your position with counsel.

Which AI regulations in the Middle East are binding today?

Binding means a law or a regulator's rule with enforcement behind it. Guidance sets expectations without creating legal duties of its own. Status is as checked on 19 October 2026.

Sector regulators, such as central banks, add their own rules.

Saudi Arabia: the data law binds, the AI frameworks guide

The Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H, holds most binding duties for AI. Article 22 asks controllers to assess the impact of processing for their products and services. Article 20 requires notice to the competent authority after a leak or unauthorised access.

The Implementing Regulations of the PDPL make that assessment written and documented in listed cases (Article 25). These include large-scale or repeated processing that relies on newly adopted technologies or makes decisions based on automated processing, which can cover AI uses.

That list may change. On 6 October 2026 SDAIA opened a public consultation, closing 5 November 2026, on draft amendments to the Implementing Regulations. The draft would make the use of any emerging technology enough on its own to require an impact assessment, without today's large-scale or repeated condition. It would do the same for automated decisions that affect people's rights or interests. It also proposes a duty to store personal data inside the Kingdom, while still allowing transfers that meet the law, and registration in SDAIA's National Register of Controllers for controllers that transfer or disclose personal data abroad. It is a draft and the final text may differ, so plan for it and check the adopted version with counsel.

SDAIA has also issued guidance. Gowling WLG (July 2026) reports that SDAIA published a National AI Risk Management Framework in April 2026. It sets five phases: scope the system, identify risks, assess likelihood and impact, treat them, then monitor. It is a framework, not a statute, but as the national reference we recommend building your Saudi AI risk register on it.

Draft to watch: Digital Policy Alert reports a consultation on a draft Global AI Hub Law from 14 April to 14 May 2025. We found no final text.

UAE: a federal data law, a new AI authority and free-zone rules

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data has applied since 2 January 2022, according to the UAE government portal. Article 2 excludes government data, health and banking or credit data that have their own legislation, and free-zone companies with their own data protection law. The DIFC and ADGM, for example, each have their own data protection rules.

The DIFC goes further on AI. Regulation 10 of the DIFC Data Protection Regulations (consolidated version in force on 1 September 2023) covers personal data processed by autonomous and semi-autonomous systems. Where an app or website uses such a system, users must get clear notice at first use. If an affected person asks, the deployer or operator must provide a risk and impact assessment of unjust bias or high-risk processing.

At federal level, the UAE Charter for the Development and Use of Artificial Intelligence lists 12 priorities, including safety, algorithmic bias and human oversight. On 14 June 2026 the UAE announced a Federal Authority for Artificial Intelligence and Data reporting to the Cabinet. Morgan Lewis reports that it merges the AI Office, TDRA's information and digital government sector and the Emirates Data Office. The market expects it to finalise the PDPL executive regulations, still not issued in June 2026.

Jordan, Qatar and Egypt: data laws first, AI guidance alongside

Jordan

The Personal Data Protection Law No. (24) of 2023 took effect on 17 March 2024, with full compliance due from 17 March 2025, according to the Ministry of Digital Economy and Entrepreneurship. If a breach is likely to cause severe harm, the controller must tell the people affected within 24 hours of discovering it. It must report to the ministry's data protection unit within 72 hours (Article 20).

For AI, the ministry's AI Strategy and Implementation Plan 2023-2027 sets a supportive legislative and regulatory environment as its fourth objective and encourages organisations to follow the National AI Code of Ethics. The code guides; the data law binds.

Qatar

Law No. 13 of 2016 on personal data privacy is overseen by the National Cyber Security Agency, Qatar News Agency reported in January 2023. Baker McKenzie (April 2025) reports binding decisions by its data privacy office, including one against an ICT provider in December 2024. For QCB-licensed entities, Digital Policy Alert reports a QCB Artificial Intelligence Guideline of 4 September 2024, listed as in force, with authorisation requirements. We could not open it on the QCB website, so get the official text from QCB and check it with counsel.

Egypt

Personal Data Protection Law No. 151 of 2020 gained its executive regulations through Decree No. 816 of 2025 of the Minister of Communications and Information Technology. We found no official Egyptian copy online and read an unofficial English translation, so check the Arabic text with counsel. The regulations require a licence from the Personal Data Protection Centre and breach notice to it within 72 hours.

Article 6 of the law allows one year from the regulations' issuance to comply. CMS (January 2026) dates the decree 1 November 2025, so on a strict reading the period ends on 1 November 2026, the day this article was published. CMS adds that the text was only made public on 25 December 2025, so it is uncertain whether the regulator will allow until the end of 2026. Treat the grace period as over. On AI, the National Council for AI's Egyptian Charter for Responsible AI (2023, v1.0) presents itself as a first step on ethics, not a law.

How do you track changes without reading every headline?

We recommend one tracker, one named person responsible and a monthly review. Keep these fields for each rule:

• Country and issuing body.
• Type: law, regulation, regulator rule, guidance or draft.
• Official citation and date, as written in the official text.
• Status: draft, consultation, issued, in force, or grace period ending.
• Who it covers: sectors, free zones, government exclusions.
• What it asks of AI use, in one plain sentence.
• Your action, person responsible and due date.
• Source link and date last checked.

Each month:

1. Check the official sources first: gazettes, regulator websites and government portals.
2. Log anything new and update the status of existing rows.
3. Match each change to the systems in your AI register that it touches.
4. Decide for each change: act now, plan for a date, or keep watching.
5. Brief legal and risk, and record the decision with its reason.

Review any rule that moves from draft to issued within two weeks. Treat law-firm alerts and news as prompts to find the official text. Where none is online, record that and confirm with counsel.

Two illustrative cases

An illustrative payments company in Amman uses an AI assistant for customer replies and has customers in Saudi Arabia. Its tracker puts the Jordanian breach clock first. If the assistant feeds automated decisions, it adds a written impact assessment under Article 25 of the Saudi Implementing Regulations. A third row covers its central bank's rules.

An illustrative retail group in Dubai has a holding company in the DIFC and stores in Qatar and Egypt. Its customer chatbot falls under at least four regimes: the DIFC law and Regulation 10 for the DIFC entity, the federal decree-law for mainland operations, and the data laws of Qatar and Egypt. From October 2026 the tracker shows Egypt as the urgent item: on a strict reading the grace period ends on 1 November 2026, and licences must be in place.

How to start

Our R&D Lab keeps a MENA AI regulation tracker and dated briefings under Published Research & Arabic AI Benchmarks in the R&D Lab. To turn tracked rules into policy, registers and PDPL alignment, see AI Governance & Compliance Foundation and our page on PDPL and regulators. Our AI governance framework guide shows where each rule lands. Unsure where to begin? The AI Exposure Scan is a free 45-minute conversation that ends in a written next step.

Related lab: R&D Lab ↗