The Gulf's Two AI Rulebooks: How The UAE And Saudi Arabia Diverge

The Gulf's two AI ambitions are well understood. Less understood is that the UAE and Saudi Arabia are pursuing them under noticeably different rulebooks. Neither has passed a single comprehensive AI act in the style of the European framework, but the absence of one headline law hides two coherent and divergent approaches. The UAE is layering binding obligations through free zones and sector regulators. Saudi Arabia is governing through a national strategy and a mandatory adoption framework, with formal legislation expected to follow. For any company building or selling AI in the region, the difference is not academic. It decides which documents you file, which regulator you answer to, and which data you can legally use.

The UAE: binding rules, assembled in pieces

There is no UAE AI Act, and officials have been candid that they prefer a layered model to a monolithic one. What exists is a stack of data protection statutes, free zone regulations, sector specific rules and guidelines that together govern how AI is built and deployed across the Emirates, as legal analysts describe it at Latham and Watkins. The most concrete recent addition is the Dubai International Financial Centre's Regulation 10, in force since January 2026, which applies to AI systems operating in the financial free zone.

Regulation 10 is binding and specific. It requires operators to run AI impact assessments, to be transparent about AI driven decisions, and to document high risk use cases, with financial penalties for violations. That makes the DIFC one of the first jurisdictions in the region to attach enforceable obligations, rather than guidance, to AI deployment. Running underneath it is the federal Personal Data Protection Law, which governs personal data on the mainland and reaches outside the country where the data of UAE residents is processed abroad. Unlike the European regime, the law does not treat legitimate interest as a standalone basis for processing, so consent does much of the work, and full compliance is required by the start of 2027.

Governing the machinery of government

The UAE has also moved earlier than most on the use of AI inside the state itself. Over late 2025 and early 2026 the government adopted measures regulating AI in public governance, including a policy governing the use of AI in national election campaigns and the integration of a national AI system into federal executive decision making, as documented by the Library of Congress. The same instinct appears in the announced plan to deploy agentic AI across half of government services within two years. The pattern is consistent: the UAE writes AI into the operating rules of the institutions that use it, sector by sector, rather than waiting for one law to cover the field.

Saudi Arabia: strategy first, law to follow

Saudi Arabia has taken the opposite route into the same destination. There is, as yet, no proposed comprehensive AI statute. Instead the Kingdom governs through the National Strategy for Data and Artificial Intelligence and through the policy authority of SDAIA, the Saudi Data and Artificial Intelligence Authority. In 2026, designated the Year of Artificial Intelligence by the Cabinet, that approach has hardened into something closer to a baseline obligation, with SDAIA issuing national guidelines to unify public sector efforts, reported by the Saudi Press Agency.

The operational core is SDAIA's AI Adoption Framework, released in November 2025, which sets a mandatory baseline for how public sector entities procure, deploy and govern AI. It codifies five pillars: data governance, model accountability, transparency, human oversight and risk management. For now the framework binds government bodies rather than the wider private market, but in a state where public spending drives much of the AI economy, a public sector procurement standard functions as a de facto market rule. Vendors that cannot meet the five pillars do not sell to the largest buyer in the country.

The copyright divergence

The sharpest contrast between the two jurisdictions sits in an unlikely place: copyright. Saudi Arabia published a new copyright law in February 2026, replacing legislation that dated to 2003, and it comes into force in August 2026. Its most consequential clause for AI builders is an article permitting the reproduction of protected works, without the author's permission and without compensation, for the purpose of developing AI products and algorithms, as tracked by Bird and Bird. The provision is qualified by a proportionality test, limiting reproduction to what serves the purpose, which will need clarification through implementing regulations. Even so, the direction is clear. Saudi Arabia is positioning its copyright regime to favour domestic AI development, a stance that sits some distance from the consent led, rights protective posture that data protection law encourages in the UAE.

Converging on outcomes, not method

It would be wrong to overstate the gap. Both states want the same things: trusted AI, local capability, and a regulatory reputation strong enough to attract serious capital and serious vendors. Both lean on transparency, human oversight and risk management as organising ideas. The IAPP's survey of the UAE landscape and parallel guides to the Saudi framework read, at the level of principle, remarkably alike. The divergence is in method and sequence. The UAE is building enforceable obligations bottom up, free zone by free zone and sector by sector, and will likely knit them into something more unified later. Saudi Arabia is setting a top down national framework now and will likely add binding law underneath it as the Year of AI matures.

For the companies caught in between, the practical effect is two compliance maps rather than one. A health AI vendor selling into Abu Dhabi answers to data protection regulators and the relevant health authority. The same vendor selling into Riyadh answers to SDAIA's framework and, soon, to a copyright regime that treats training data differently. Neither path is harder than the other in the abstract. They are simply different, and the cost of assuming the Gulf is a single regulatory territory is now measured in failed procurements rather than thought experiments.

The instinct to talk about Gulf AI policy as one project is understandable and wrong. The UAE and Saudi Arabia have chosen genuinely different instruments to reach a shared goal, and the choices reveal their theories of regulation. The UAE trusts sector regulators and free zones to move fast and bind hard in narrow domains, accepting fragmentation as the price of speed. Saudi Arabia trusts a central authority to set the terms and a national strategy to align everyone behind them, accepting slower legislative detail as the price of coherence. The copyright divergence is the tell: when forced to choose between protecting rights holders and accelerating domestic model development, Riyadh chose development. Watch whether the UAE follows, holds, or formalises the opposite position. That single decision will tell you more about where Gulf AI governance is heading than any strategy document, because it is the first place the two rulebooks point in clearly different directions.