Middle East AI Compliance 2026: New Enforcement Wave in UAE, Saudi Arabia, and Qatar

For international professional services businesses operating across the Middle East, 2024 to 2026 has not been a period of regulatory preparation — it has been one of regulatory arrival. Frameworks that were once advisory or nascent are now enforceable. Penalties are being issued. New supervisory bodies are taking shape. Businesses that have treated Middle East AI compliance as a future concern need to treat it as a present one.

This briefing sets out what has changed across the UAE, Saudi Arabia, and Qatar, and what those changes mean for internationally operating organisations.

The UAE: A Layered System With Real Teeth

The UAE has not pursued a single, unified AI statute. Instead, it has built a layered governance structure that combines federal data law, emirate-specific frameworks, and sector-specific obligations. For businesses, this means compliance cannot be addressed in one pass — it requires mapping exposure across multiple regulatory layers.

The most significant near-term obligation for firms operating within the Dubai International Financial Centre is DIFC Regulation 10, which comes into full enforcement in January 2026. This is the first AI-specific regulation in the MEASA region and imposes concrete obligations on entities deploying autonomous or semi-autonomous systems that process personal data within the DIFC. If your organisation uses AI-driven decision-making tools, client-facing automation, or data processing systems within the DIFC, Regulation 10 is not optional reading — it is a compliance obligation with a firm deadline.

At the federal level, the Personal Data Protection Law (Federal Decree-Law No. 45/2021) remains the primary instrument governing personal data processing, including data used in AI systems. Some Executive Regulations are still pending, which creates residual uncertainty in a small number of operational areas. However, the underlying obligations of the law are in force and businesses should not treat pending regulations as permission to delay.

The institutional landscape also shifted materially in June 2026 with the announcement of the Federal Authority for Artificial Intelligence and Data, consolidating several previously separate offices under a single federal body. This consolidation signals a more coordinated and assertive approach to oversight. Businesses should expect clearer — and more consistent — enforcement expectations to emerge from this unified structure over the coming period.

The Central Bank of the UAE's Guidance Note on AI/ML, issued in February 2026, adds a further layer of obligation for licensed financial institutions. It mandates robust governance frameworks, bias testing, transparency in AI-driven decisions, and meaningful human oversight. Financial services firms operating in the UAE that have not yet conducted a gap assessment against this guidance are operating with measurable compliance risk.

Saudi Arabia: Enforcement Is Already Happening

Saudi Arabia's position deserves particular attention because compliance is no longer theoretical — it is actively enforced. The Personal Data Protection Law (PDPL) became fully enforceable on 14 September 2024, and the Saudi Data and Artificial Intelligence Authority (SDAIA) had already issued 48 violation decisions by January 2026 across multiple sectors.

The PDPL carries significant penalties. Fines reach up to SAR 5 million and can be doubled for repeat violations. Certain sensitive data disclosures carry the additional risk of criminal liability, including potential imprisonment. These are not nominal figures — they represent material financial and reputational exposure for organisations that process the personal data of Saudi citizens or residents.

The extraterritorial scope of the PDPL is particularly consequential for international businesses. The law applies to any entity, wherever it is based, that processes the personal data of individuals in Saudi Arabia. A professional services firm headquartered in London, Singapore, or New York is within scope if it holds or processes data relating to Saudi clients, employees, or counterparties.

SDAIA has provided guidance on DPO appointments, cross-border data transfers, and privacy notice requirements, and businesses are expected to demonstrate procedural compliance quickly when challenged. The response windows for indictment notifications are short. International organisations that have not yet established clear accountability structures and documented compliance processes for their Saudi data operations are exposed.

Saudi Arabia has also designated 2026 as its "Year of AI," with a dedicated AI-specific law anticipated to follow. Businesses should monitor this development closely. Once enacted, it is likely to build on the PDPL's enforcement posture and introduce additional obligations specific to AI deployment.

Qatar: Binding Rules in Financial Services, Broader Strategy Developing

Qatar has taken a sector-first approach to AI compliance, with the most developed framework applying to financial services. The Qatar Central Bank AI Guidelines became legally binding for all licensed financial institutions in September 2024 — a significant step that distinguishes Qatar from many jurisdictions where comparable guidance remains advisory.

These guidelines require firms to establish documented AI strategies, governance structures, and risk assessments. Critically, they mandate that institutions obtain pre-approval from the QCB before deploying high-risk AI systems. This is a substantive procedural requirement, not a box-ticking exercise. Financial institutions operating under QCB supervision that have introduced or are planning to introduce high-risk AI capabilities need to understand whether those systems fall within the pre-approval scope.

The Ministry of Communications and Information Technology has published non-binding ethical AI principles, and Qatar's National AI Strategy provides broader directional context. However, for the purposes of immediate compliance planning, the QCB guidelines are the operative framework that demands attention.

What This Means for International Businesses

Taken together, these developments represent a regional shift from aspiration to enforcement. Three implications deserve particular attention for internationally operating businesses.

First, extraterritorial exposure is real. Saudi Arabia's PDPL applies regardless of where a business is incorporated. Any organisation processing the personal data of Saudi nationals or residents — whether through client engagements, employee data, or operational systems — is in scope and can be subject to enforcement action.

Second, sectoral obligations vary by jurisdiction. Financial institutions face the most developed and specific obligations across all three countries. However, professional services businesses across legal, consulting, and advisory sectors also handle significant volumes of personal data and operate AI-assisted tools that will increasingly fall within these frameworks. Treating this as a financial sector issue alone would be a strategic error.

Third, the regulatory trajectory is towards greater specificity and stricter enforcement. Saudi Arabia's expected AI law, the UAE's new federal AI authority, and Qatar's evolving national strategy all point in the same direction. Businesses that establish robust compliance foundations now will be better positioned to adapt as the frameworks develop, rather than scrambling to catch up with each successive enforcement wave.

Act Now, Not When It Is Urgent

The Middle East AI compliance landscape has moved faster than many international businesses anticipated. The frameworks are not theoretical — they are operational, enforced, and expanding.

Ops Intel works with international professional services businesses and global enterprises to navigate complex, multi-jurisdictional AI compliance obligations. Whether you need a comprehensive gap assessment across UAE, Saudi Arabian, and Qatari requirements, support building governance frameworks, or ongoing regulatory monitoring as these frameworks evolve, our team can help you establish a defensible and proportionate compliance position.

Contact Ops Intel today to discuss your Middle East AI compliance exposure and find out how we can support your organisation.