A Closer Look at the Current State of Artificial Intelligence Regulation in the Gulf

The development and regulation of artificial intelligence (AI) has been gaining momentum in recent years. Gulf countries, including the United Arab Emirates (UAE), the Kingdom of Saudi Arabia (KSA), Qatar, and others, have not only been investing heavily in AI technologies but are also becoming more involved in it its regulation as part of a broader vision to become global leaders in the domain. 

Given the detail and breadth of the AI regulations which have recently been proposed in several countries in the West and in the European Union (EU), there has been commentary predicting that these anticipated laws will set the tone for global AI policy standards. It is in this context that we discuss the current AI regulatory landscape in Saudi Arabia and the UAE. 

The Rise of AI in the Gulf 

Throughout the Gulf, AI has been integrated into various sectors, including healthcare, finance, transportation, and government services. However, there is no unified Gulf strategy or regulatory framework on AI, although many countries in the region have released their own national strategies and initiatives. Likewise, many countries have laws and regulations that would apply to AI technologies such as those on data protection, intellectual property and cyber security but do not have legislation that expressly addresses AI regulation. Rather, countries in the region have developed policy initiatives from which AI-specific laws are expected to result in the near future. 

UAE

As OpenAI chief executive Sam Altman said, ‘the UAE has been talking about AI since before it was cool'. Like other countries, the UAE is keen to build a reputation as an AI destination through the development of its ecosystems, research capabilities and robust governance and regulatory frameworks. In 2017, the UAE appointed a Minister of State for Artificial Intelligence, H.E. Omar Bin Sultan Al Olama, the world’s first position of its kind. In 2019, the UAE Cabinet approved the National Strategy for Artificial Intelligence 2031 (the UAE National Strategy), with the goal of making the UAE one of the world’s leaders in AI. To implement the UAE National Strategy, the country then established the Office of Artificial Intelligence.

While there is no specific legislation governing AI, recent sector-specific regulations, such as the Federal Data Protection Law and the various other laws seek to address privacy implications of decisions made through machine learning tools.  

The Dubai International Financial Centre (DIFC), a global financial centre in the Emirate of Dubai, enacted amendments to the DIFC Data Protection Regulations (the DIFC Regulations), which supplement DIFC Data Protection Law No. 5 of 2020 (the DIFC DPL). The amendments include new requirements on deployers and operators of autonomous and semi-autonomous systems, such as AI or generative machine learning technology. The DIFC Regulations, which came into force in September 2023, are one of the first pieces of legislative provisions to reference AI in the UAE. 

The UAE is also leading several other AI regulatory initiatives such the introduction of an Ethical AI Toolkit in Dubai and a government partnership with Oxford University with the aim of educating public officials on how to govern AI, audit AI systems and to further explore opportunities for its use. 

KSA

KSA has made significant advances with regard to the regulation of AI. Saudi Arabia’s Vision 2030 has a particular focus on AI which is augmented by a dedicated National Strategy for Data and AI (the KSA National Strategy). The KSA National Strategy aims to position the country as a global leader in AI by 2030 by fostering innovation and promoting the ethical use of AI.  

The KSA National Strategy was developed by the Saudi Data and Artificial Intelligence Authority (SDAIA). SDAIA is a government agency with three sub-entities: the National Information Centre, National Data Management Office, and National Centre for AI. It is through these three entities that the AI legislation envisioned in the KSA National Strategy will operate. 

In 2023, SDAIA issued the final version of its AI Ethics Principles (the Principles) which represent KSA’s first regulatory framework in relation to AI and were developed by analysing global best practices and standards. Ultimately, the Principles are designed to help entities adopt standards and ethics when building and developing AI-based solutions to ensure their responsible use. These Principles form the key regulatory framework for AI in KSA, but they are not legally binding. 

Instead, the Principles employ a number of self-assessment tools for determining levels of AI risk which range from little or no risk to an unacceptable level of risk. Currently, adopting entities are responsible for ensuring their own compliance with the Principles. 

Entities are encouraged to register with SDAIA under an additional scheme which includes the further option of adopting a ‘badge’ system, which is intended to allow entities to visually demonstrate their commitment to the ethical use of AI by displaying these badges on their websites and in communications with customers. 

It is anticipated that SDAIA and other regulatory bodies in KSA will issue legally binding regulations in relation to the development, use and operation of AI in the Kingdom in the next few years.

Future Collaboration 

The status of regulatory efforts and AI governance in Gulf countries are largely in their initial stages and adoption of regulatory frameworks vary across the region. While policy differs in its levels of development, there are many commonalities that would make a regional common governance framework a workable option. Given the clear commitment of the UAE and KSA to the adoption of AI, it is only a matter of time until a regulatory baseline emerges. 

In the same way that the General Data Protection Regulation (GDPR) is viewed as the gold standard in personal data regulation globally, questions are often raised relating to whether or not Gulf countries will follow the UK and EU approaches to AI regulation. Bearing in mind the advanced thinking, including at a regulatory level, in the Gulf, we may find that the region very much goes its own way in terms of AI regulation.