Start with an inventory, not a policy
Nearly every organisation we work with underestimates how much AI is already in use. Alongside deliberate projects sit models embedded in HR platforms, CRM tools, contact centre software, security products and browser extensions, plus staff using public assistants on work material.
An AI policy issued before an inventory exists tends to be unenforceable, because nobody can say what it applies to. The inventory comes first, and it needs to cover procured tools as well as things built in house.
- System name, owner, vendor and whether it was built or bought.
- Purpose, and the decisions it informs or automates.
- Data used for training, fine tuning, prompting and inference.
- Whether personal data or special category data is involved.
- Human oversight in place, and what happens when the system is wrong.
Risk classification under the EU AI Act
The EU AI Act regulates by risk tier rather than by technology. Obligations attach mainly to providers, who develop and place systems on the market, and deployers, who use them under their own authority. Organisations in the Gulf can be either, and can be in scope where output is used in the EU.
- Prohibited practices, including certain manipulative techniques, untargeted facial image scraping, social scoring and specified biometric categorisation.
- High risk systems, such as those used in employment, education, essential services, credit and defined regulated products, carrying the heaviest obligations.
- Limited risk systems with transparency duties, so people know they are interacting with AI or seeing generated content.
- Minimal risk systems, where general good practice applies rather than specific duties.
- General purpose AI models, with their own documentation, copyright and transparency obligations, and additional duties at systemic risk scale.
What high risk actually requires
For high risk systems the Act asks for engineering discipline rather than paperwork. Providers must operate a risk management system across the lifecycle, apply data governance to training and testing data, produce technical documentation, enable logging, ensure appropriate human oversight, and meet accuracy, robustness and cybersecurity expectations, with conformity assessment before market placement.
Deployers carry a lighter but real set of duties: use the system in line with instructions, assign competent human oversight, monitor operation, keep logs, and inform affected individuals in defined circumstances.
AI governance in the GCC
The Gulf has moved through strategy and guidance rather than a single binding AI statute. The UAE has a national AI strategy and published ethics guidance, and Dubai has issued its own AI principles and guidelines. Saudi Arabia's SDAIA has published AI ethics principles and generative AI guidelines. Sector regulators, particularly in financial services and health, increasingly ask about model governance directly.
In parallel, existing privacy law already governs a great deal of AI use. If a model processes personal data, the lawful basis, transparency, minimisation, retention and rights obligations under local privacy law apply now, whatever an AI specific statute may later add.
The controls that make a programme defensible
The organisations we see handling this well have a small number of controls that are genuinely operating, rather than a large framework that exists only as a document.
- A maintained AI inventory with a named owner for every system.
- A triage step at intake that classifies risk before deployment, not after.
- An assessment for higher risk use, covering purpose, data, bias, oversight and failure modes.
- Human oversight that is defined by role, with authority to override or stop the system.
- Vendor diligence covering training data, model changes, logging and audit rights.
- Evaluation and monitoring after deployment, including drift and incident handling.
- Role appropriate training, so the people using these tools understand the limits.
Common questions
Does the EU AI Act apply to companies in the Gulf?
It can. The Act reaches providers placing AI systems on the EU market and deployers established in the EU, and it extends to situations where the output of a system is used in the EU, so a Gulf organisation serving EU customers may be in scope.
Is there an AI law in the UAE or Saudi Arabia?
Not a single comprehensive AI statute in the way the EU has one. Both operate through national strategies, ethics principles and sector guidance, while existing privacy law and regulator expectations already govern much AI use in practice.
Where should AI governance start if we have no programme?
With an inventory and a triage step. Knowing what AI is in use, who owns each system and which uses are higher risk gives you something to govern, and it usually surfaces two or three issues worth fixing immediately.
Do we need a separate AI governance function?
Rarely. Most organisations extend existing privacy, risk and procurement processes rather than creating a new function, with clear accountability at senior level and specialist input where classification or assessment gets difficult.