How The Gulf Is Governing AI Without A Single AI Law

For all the talk of an AI race in the Gulf, there is no Gulf AI law. Neither the United Arab Emirates nor Saudi Arabia, the region's two AI heavyweights, has passed a single statute that defines what an AI system is, what is permitted and what is banned. Yet it would be wrong to call either country a regulatory vacuum. Both are building dense governance regimes for AI, just not in the shape that the phrase AI law implies. Understanding Gulf AI policy means looking past the missing act to the layers that are actually doing the governing.

No single AI act, by design

The absence of a dedicated AI law is not an oversight so much as a choice. Rather than wait years to draft one comprehensive statute that risks being outdated on arrival, both governments have spread the work across instruments they already control: data protection law, free zone regulation, sector specific guidance, public sector procurement rules and national strategy bodies. Legal trackers that follow the region describe a patchwork in which several existing laws and regulations apply to AI even though none of them is an AI law, as the CMS expert guide to Saudi Arabia sets out. The result is governance by accumulation rather than by single text.

The UAE's layered approach

The UAE governs AI through a stack of overlapping rules rather than one. At the base sits the federal Personal Data Protection Law, issued as Federal Decree-Law 45 of 2021, which sets the terms for how personal data, the fuel for most AI systems, can be collected and used. On top of that sit the rules of the financial free zones, where the Dubai International Financial Centre and Abu Dhabi Global Market run their own data protection regimes with provisions that increasingly speak directly to automated processing and AI, as legal trackers including Bird and Bird have documented. Layered over the law is a set of national institutions and guidance, including an early move to give AI a formal advisory role inside government decision making, a signal of how seriously the state treats the technology, as summarised in coverage of the UAE's governance landscape. The picture is less a single rulebook than a set of rings, each tightening around a different part of how AI is built and used.

Saudi Arabia's framework first model

Saudi Arabia has taken a complementary but distinct path, leading with frameworks and ethics rather than statute. The Saudi Data and Artificial Intelligence Authority, known as SDAIA, sits at the centre of the system. It has issued AI Ethics Principles, a non binding set of commitments covering fairness, accountability, transparency and safety, and Generative AI Guidelines aimed at government bodies that address questions such as content authenticity and human oversight. It has also published an AI Adoption Framework that public sector entities are expected to follow when they procure and deploy AI, and it obtained ISO 42001 certification for AI management, an international standard, making it one of the first government agencies in the world to do so. The Kingdom has gone further in signalling intent by designating 2026 a year of focus on artificial intelligence, with a coordinated push across multiple ministries. None of these instruments is a binding AI law, but together they create a strong expectation of how AI should be handled, especially in the public sector that drives so much Gulf technology spending.

Adjacent laws are doing AI work

Some of the most consequential AI rules in the Gulf are not labelled as AI rules at all. A clear example is intellectual property. Saudi Arabia has a new copyright law due to take effect on 1 August 2026, and among its provisions are terms relevant to whether and how protected works can be used to train AI systems, according to legal trackers covering the Kingdom. That is an AI policy decision in everything but name, made through copyright rather than a dedicated statute. Data protection law works the same way: by setting limits on how personal data can be processed, it constrains what AI systems can be trained on and how their outputs can be used, without ever mentioning machine learning. For anyone trying to map Gulf AI policy, the lesson is that the relevant rules are scattered across legal areas that predate the current wave of AI, and that reading only the documents with AI in the title will miss most of the regime.

The trust gap the rules are chasing

Behind the regulatory activity is a practical problem the frameworks are trying to address: organisations do not fully understand the AI they are already using. In regional survey coverage, 94 percent of data leaders in the UAE reported that they lacked complete visibility into how their AI systems reach decisions, a figure that captures the gap between deployment and oversight, as Computer Weekly reported. Frameworks and ethics principles are, in part, an attempt to close that gap by pushing institutions to document, test and monitor their systems. But guidance only changes behaviour if someone is checking, and most of the Gulf's AI instruments are still voluntary or limited to the public sector. The hard edge of enforcement, the part that makes a rule a rule, is where the regime is thinnest.

What is still missing

The framework first approach buys speed and flexibility, but it leaves real gaps. Voluntary principles do not give a citizen a clear right to contest an automated decision, and non binding guidelines do not settle who is liable when an AI system causes harm. The reliance on the public sector means private companies often operate with lighter obligations, even in sensitive areas such as lending and hiring. And a patchwork spread across data protection, copyright, free zone rules and national strategy is hard for a smaller company to navigate, which can favour the large incumbents with legal teams over the startups the region says it wants to grow. None of this means the Gulf is behind. It means the next phase of the work is consolidation: turning a set of frameworks into obligations clear enough that institutions, and the people affected by their AI, know exactly where they stand.

The Gulf is not waiting for a single AI law, and it is right not to. A rigid statute drafted today would struggle to survive the next eighteen months of the technology, and the framework first approach lets regulators learn before they lock in rules. The risk is that flexibility becomes an excuse for not deciding the hard questions: liability, the right to contest an automated decision, and binding obligations on the private sector, not just guidance for government. The most encouraging signal in the region is not the speed of adoption but the growing seriousness about oversight, from SDAIA's ethics work to the UAE's layered data rules. The test over the coming year is whether that seriousness hardens into enforceable rights and clear accountability, or stays a collection of principles that are easy to praise and easy to ignore. Governing AI through everything around it has worked to get started. Finishing the job will take rules with teeth.