GCC AI Compliance

Resources for people who build, sell, audit or run AI systems in the Gulf Cooperation Council states. The pages map regional laws, policies and security baselines to the wiki's control library and test cases. They cover the UAE, Saudi Arabia, Qatar, Bahrain and Oman. Kuwait has not been researched.

Verification required. Everything in this section about laws, regulators, dates and expectations was compiled from secondary sources (vendor documentation, law-firm trackers and press) on 7 October 2026. On 10 October 2026 four rows of the crosswalk were checked against the issuing body's own documents; no other primary text was read, and sources disagree on several dates. Check the primary text before relying on any regional claim. This is not legal advice.

What is in this section

Part	Pages	What it holds
GCC AI Regulatory Hub	1	32 laws, policies, regulator notes and security baselines across five states, each mapped to wiki controls and tagged with its verification status.
Role guides	4	What to do and what to keep as evidence, for practitioners, product companies, auditors and implementors.
Templates T01 to T12	12	Fill-in documents: use-case intake, impact assessment, vendor addendum, residency attestation, incident workflow, bilingual notice, ethics worksheet, audit checklist, inventory, bias test record, regulator log and risk register.
GCC drivers for AI-CTRL-041	1	The GCC instruments behind the control on fairness, bias testing and explainability, with its template and test cases.
Regulatory Crosswalk and Evidence Register	2	The instrument-to-control map and a starter evidence list, each also downloadable as a CSV file.

How regional claims are tagged

Tag	Meaning
[Verified]	The point stated was checked against the issuing body's own document at the URL given, on the date given. The document was read with a retrieval tool and not line by line, so confirm the wording before you cite it.
[Reported]	Stated by secondary sources only. Verify before relying on it.
[Conflict]	Secondary sources disagree. Resolve from the primary text.
[Unverified]	Single source, or not researched.

Clause and article numbers are left blank wherever they were not seen in a source.

The templates are working documents, not regulator-approved forms. Where a template cites a regional instrument, treat that as a pointer to check.

Where to start

If you are	Read	Then use
A data scientist, ML or security engineer	Guide for AI Practitioners	T01, T02, T10
An AI vendor or SaaS builder selling into the GCC	Guide for AI Product Companies	T03 (as the buyer will send it), T04, T06
An internal or external auditor	Guide for Auditors	T08, Evidence Register
A programme lead, GRC lead or CISO	Guide for Implementors	GCC AI Regulatory Hub, T09, T12

Using the templates

Templates T01 to T12 are fill-in documents. To reuse one, open the page, follow the "Suggest an edit to this page" link in the footer to reach its Markdown source on GitHub, and copy it into your own repository or document tool.

Keeping this section current

When you confirm an instrument against its primary text, record the primary URL and the retrieval date beside it in the Regulatory Crosswalk. Several instruments listed here are described as new, in consultation or awaiting promulgation, so the whole hub should be re-checked every quarter.

Pages in This Section

GCC AI Regulatory HubUAE, Saudi, Qatar, Bahrain and Oman AI-relevant laws, policies and security baselines mapped to AI security controls, with verification status. Guide for AI Practitioners in the GCCWhat changes when you build AI in the GCC: lifecycle checklist, residency, human oversight, fairness, Arabic testing and the evidence to keep. Guide for AI Product Companies Selling into the GCCFor AI vendors selling into the GCC: what buyers ask for, a market-entry checklist, the evidence pack to prepare and contract clauses to expect. Guide for Auditors of AI Systems in the GCCFor auditors of AI systems in the GCC: setting criteria, scoping, test steps by control family, sampling, common findings and report wording. Guide for Implementors: Building an AI Governance Programme in the GCCFor programme leads, GRC teams and CISOs: a 90-day plan, RACI, early decisions, maturity steps and metrics for AI governance in the GCC. GCC Drivers for AI-CTRL-041: Fairness, Bias Testing and ExplainabilityThe GCC instruments behind AI-CTRL-041 on fairness, bias testing and explainability, with the template and test cases that support the control. Regulatory CrosswalkGCC instruments mapped one per row to AI security controls and control themes, with verification status. Also available as a CSV file. Evidence RegisterStarter list of 27 evidence items an auditor would request for an AI system in the GCC, by control family. Also available as a CSV file. T01 AI Use-Case Intake and Risk TieringFill-in form to register an AI use case and score it into a Low, Medium or High risk tier before build or purchase. T02 AI Impact AssessmentFill-in AI impact assessment in the style of a DPIA, extended to cover fairness, explainability, human oversight and safety. T03 Vendor Due-Diligence GCC AddendumQuestions to add to a third-party security questionnaire for AI suppliers: data location, model governance, security, incidents and exit. T04 Data Residency and Sovereignty AttestationFill-in attestation of where each AI data component is stored and processed, the transfers involved and who signs for them. T05 AI Incident and Breach Notification WorkflowAI incident types, severity levels, a ten-step response workflow and a notification matrix to complete before an incident happens. T06 Bilingual AI Use Notice (Arabic and English)Draft AI use notice in Arabic and English: short notice, full notice, publication checklist and a generative AI add-on. T07 AI Ethics Self-Assessment WorksheetWorksheet of 14 ethics themes common to UAE and SDAIA AI ethics instruments, each with a question, a rating and an evidence column. T08 AI Audit ChecklistAudit checklist of 34 tests across nine control families, from governance and inventory to incident response and evidence. T09 AI Model and System InventoryColumn definitions, a CSV header row and maintenance rules for an inventory of AI models and systems. T10 Bias Testing RecordRecord for a bias test: groups and attributes, data, metrics and thresholds, findings, an explainability check and the release decision. T11 Regulator and Ethics-Body Engagement LogRegister of GCC authorities and a log of contacts, pending filings and consultations with regulators and ethics bodies. T12 AI Risk Register (4x4)Likelihood and impact scales, rating bands and a register layout for AI risks, with two example rows.