Gulf governments take ‘business friendly’ approach to AI regulation

We have seen major developments of AI enhancement in the region such as Microsoft’s investment of $1.5 billion in Abu Dhabi’s G42, an AI technology holding company. While there have been recent regulatory developments in the form of amendments to the Dubai International Financial Centre’s (DIFC) data protection regulations and the issuance of the Dubai universal blueprint for AI, we are yet to observe the implementation of any wider AI law by a GCC country.

Some GCC governments have released national strategies or guidelines around AI and similar technologies. Even so, most governments across the GCC have so far adopted a business-friendly approach by encouraging businesses to set up, invest and implement AI and other emerging technologies in their countries, with a broader aim to grow and diversify their economies. 

AI regulation in United Arab Emirates (UAE)

The UAE has generally adopted a business-friendly approach to the regulation of AI, with the UAE Cabinet approving a new digital economy strategy aimed at the digital economy contributing 20% of the UAE’s gross non-oil national economy.

With the UAE National Strategy for Artificial Intelligence 2031, supported by the UAE Council for Artificial Intelligence and Blockchain – which is tasked, among other things, with developing policies to create an AI-friendly ecosystem and promoting collaboration between public and private sectors to accelerate the adoption of AI – the UAE is looking to be an internationally recognised leader in AI by investing in people and industries.

The strategy has eight objectives, including attracting and training talent for future jobs enabled by AI. In line with this, the Mohamed bin Zayed University of Artificial Intelligence has been positioned as the first university in the world to focus solely on AI.

The minister of state for AI, digital economy and remote work applications (Ministry of AI) has published several non-binding guidelines for the consideration of both the public and private sectors, including the AI ethics principles and guidelines which is a useful toolkit for both governments and private institutions that wish to keep ethical and security considerations for AI design and use. The AI guide also provides an overview of AI and machine learning, and sets out how the UAE government has adopted AI in various sectors. One example of this is the partnership between Abu Dhabi Media Company and Chinese internet and AI company Sogou, to bring AI news anchor technology to the Middle East in a more efficient and engaging way.

More recently issued is the Responsible Metaverse Self-Governance Framework, which aims to establish self-regulation principles within the metaverse to ensure digital safety and security.  Other guidance issued by the Ministry of AI include a deepfake guide and 100 practical applications and use cases of generative AI.

From an emirate perspective, the emirate of Abu Dhabi recently announced the establishment of the Artificial Intelligence and Advanced Technology Council, which aims to develop and implement policies and strategies in relation to researching, developing and investing in AI and advanced technology.

While the council will develop plans and research programmes to enhance Abu Dhabi's status in the fields of AI and advanced technology, it is uncertain whether regulation will follow, though this does look unlikely. This is because of the emirate’s efforts to become an international hub for the emerging technology. An example of this is the Abu Dhabi's Advanced Technology Research Council launching AI71, an AI company which leverages Falcon AI models from the council's Technology Innovation Institute, targets medical, education and legal sectors and seeks to decentralise data ownership.

The Digital Dubai Authority has published the Smart Dubai AI ethics, principles and guidelines which sets out ethical standards and principles that AI organisations may wish to take into consideration. These guidelines were issued alongside a self-assessment tool which businesses can use to evaluate their AI systems’ ethical models against the guidelines and demonstrates moreover Dubai’s – and the UAE’s – approach to educate and guide.

More recently, the issuance of the Dubai universal blueprint for AI, which was introduced to advance the adoption of AI applications, aims to fulfil the targets of the Dubai Economic Agenda D33 by contributing AED 100 billion annually to Dubai's economy from digital transformation projects - another example of Dubai’s approach of enhancing AI. The plan includes integrating AI across all strategic sectors, delivering government services through technologies, and transforming Dubai into a global hub for AI governance and legislation.

The first phase of Dubai’s annual plan to advance the adoption of AI through the Dubai universal blueprint for AI includes appointing a chief executive officer for AI in each Dubai government entity, establishing AI and Web3 incubators and introducing Dubai’s AI commercial licence. Whether the next phase of the plan imposes AI restrictions on companies in Dubai through regulation and legislation is unclear, although given the push for inviting AI in the emirate and across the UAE more broadly, this is unlikely. The UAE was also one of the first countries to pilot the World Economic Forum’s AI procurement guidelines in the emirati public sector. The Dubai Electricity and Water Authority was the first utility in the region to pilot the AI framework.

There are also policies and guidance around AI from a sector perspective. The Abu Dhabi Department of Health has issued a policy to encourage the safe and secure use of AI which sets out guiding principles, including transparency, privacy and ethics, as well as responsibilities.

Financial regulators in the UAE – the UAE Central Bank, the Securities and Commodities Authority, the Dubai Financial Services Authority, and the Financial Services Regulatory Authority – have jointly issued the guidelines for financial institutions adopting enabling technologies, which also covers AI.

Although the UAE to-date has mostly taken a regulation-free approach to AI, the DIFC – a financial freezone of the UAE – has taken a different approach by introducing AI regulations within its data protection regime. 

Existing federal UAE laws such as the Federal Decree-Law on the Protection of Personal Data and the Federal Decree-Law Concerning the Fight Against Rumours and Cybercrime should be followed when deploying AI systems.

AI regulation in Saudi Arabia

According to the Saudi Data and Artificial Intelligence Authority (SDAIA), data and AI are integral to achieving Saudi Arabia's Vision 2030 – a programme which aims to position Saudi Arabia as the global hub of data and AI and diversify its economy by supporting non-oil sectors and industries.

The SDAIA has developed the national strategy for data and AI, of which one of its objectives is to create an attractive environment for data and AI businesses. The SDAIA has also issued the AI ethics principles applicable to anyone involved in the design, development, deployment and implementation of AI systems within Saudi Arabia, including public and private entities, as well as consumers of AI.

In addition, the SDAIA recently released two guidelines on generative AI. One of these is aimed at government employees, and the other at the general public.

The SDAIA also has a dedicated National Center for Artificial Intelligence, established by a Royal Order, which aims to drive AI innovation by facilitating research and development efforts, advancing education, and raising awareness on AI, in collaboration with the public and private sectors.

Saudi Arabian laws applicable to AI systems include the Personal Data Protection Law and the Implementing Regulation of the Personal Data Protection Law. In addition, the Saudi Authority for Intellectual Property issued a draft piece of legislation last year, containing provisions on intellectual property generated through AI.

AI regulation in Bahrain

The Bahrain digital government journey guide recognises that emerging technologies such as AI are an opportunity to progress society and economic growth in Bahrain. In line with its economic vision 2030 and the government plan 2019-2022, the digital government strategy 2022 encourages government entities to explore and adopt emerging technologies which benefit community engagement and public administration. It also encourages collaboration with public and private entities to achieve this.

The Bahrain government’s efforts in relation to AI include progressing research and development, developing rules and guidelines for the procurement of AI solutions, and strengthening AI capabilities in various areas such as crisis response, healthcare, education, logistics, transport and finance. For example:

• Bahrain was one of the first countries to pilot the World Economic Forum’s AI procurement guidelines in Bahrain’s public sector;
• the University of Bahrain and the Benefit Bahrain Company created a lab for AI and advanced computing to expand AI research and innovation;
• AI will also be incorporated into courtrooms and the judiciary system to improve efficiency; and
• in cooperation with various stakeholders, the Artificial Intelligence Academy at Bahrain Polytechnic aims to train the workforce in the field of AI.

The Bahrain government has also issued a set of principles covering the ethical use of AI. The principles include preserving data privacy and protection rights, sustainability, non-discrimination, inclusion and diversity, moral and legal responsibility and accountability, and transparency.

In addition, Bahrain laws such as Law No. 30 of 2018 with respect to personal data protection, and its subsequent ministerial resolutions, should also be considered for AI systems.

AI regulation in Qatar

While Qatar does not yet have a legal instrument dedicated to the regulation of AI, Qatar’s minister of justice announced last September that the government was seeking recommendations to help draft such a law, and that AI would be used as a tool within Qatar’s judicial and legal systems.

Qatar’s Ministry of Communications and Information Technology’s national AI strategy focuses on six core pillars - education, data access, employment, business, research and ethics - and aims to use AI to secure Qatar’s economic and strategic future, in line with Qatar National Vision 2030, and implement AI technology in line with local needs and traditions. 

Qatar also has a dedicated Artificial Intelligence Committee, which was established by the MCIT under Cabinet Decision No. 10 of 2021, and includes representatives from various ministry branches and entities, ranging from education to finance.

The National Cyber Governance and Assurance Affairs (NCGAA) of the National Cyber Security Agency has issued cyber security policies, standards and guidelines. These include guidelines for secure adopting and usage of AI, a national data classification policy, and a national information assurance standard. The guidelines for secure adopting and usage of AI applies to all private and public companies in Qatar using or intending to deploy AI systems, services or products. The guidelines set out, among other things, AI risks, including unauthorised disclosure of information and data aggregation; AI principles, including human oversight and monitoring and transparency and explainability; and recommendations, including on generative AI.

In addition to the laws and guidelines considered above, Qatar laws such as Law No. 13 of 2016 Concerning Personal Data Protection, and its supplementary regulatory guidelines issued by the NCGAA, should also be considered for AI systems.

AI regulation in Kuwait

Kuwait is also earlier in its AI regulatory journey as it is yet to issue any dedicated AI regulations, guidelines or documentation.

Even so, investment in AI startups in Kuwait has significantly increased since 2000 and Kuwaiti multinationals see AI as a competitive advantage. These developments, among others, are in line with Kuwait Vision 2035.

A bill was submitted on the establishment of the Public Authority for Artificial Intelligence which would, among other things, draft required legislation and regulations, protect official data, transform Kuwait into a leading country in the field of AI and attract researchers to contribute to AI development in Kuwait.

Additionally, Kuwait has established the Kuwait Institute for Scientific Research which engages in AI research and development.

Kuwait’s data protection-related laws, such as the Kuwait Administrative Decision Concerning the Issuance of the Data Privacy Protection Regulation, which is applicable to service providers licensed by the Communication and Information Technology Regulatory Authority, should also be considered for AI systems.

AI regulation in Oman

Oman’s Ministry of Transport, Communications and Information Technology (MTCIT) has previously released the national program for AI and advanced technologies. This sets out four pillars focused on increased sector productivity targeted for economic diversification, the development of human capabilities in AI, the acceleration of AI adoption, and governance of AI applications and advanced technologies.

Aimed at growing a digital economy which caters to Oman’s economy, the national program for digital economy sets out pillars, executive programs and action plans aligned to the Oman 2040 Vision.

In 2021, the MTCIT also issued the AI systems policy, which applies to all government administrative units and introduces six high-level principles that Omani government entities must comply with while using AI systems. The principles are inclusiveness, transparency, safety, accountability, fairness and the need for AI to remain human-centered.

Additionally, Oman laws such as Decree 2022 Promulgating the Personal Data Protection Law and its implementing regulations, Ministerial Decision 2024 Issuing the Implementing Regulation of the Personal Data Protection Law, are also applicable to AI systems.

While governments in the GCC are inviting and encouraging the development, use, adoption and implementation of AI systems, companies involved should be mindful of the risks –including confidentiality, data protection and IP issues – that come with it. Compliance with existing laws regulating these areas will be essential.

Co-written by Alexandra Bertz of Pinsent Masons.