Regulatory Crosswalk
Verification required. Regional claims on this page were compiled from secondary sources on 7 October 2026. On 10 October 2026 four rows (S2, S3, S4 and B1) were checked against the issuing body's own documents and are tagged [Verified]. Most other government sites refused automated retrieval, so every other claim is still tagged [Reported], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.
One row per instrument in the GCC AI Regulatory Hub, with the wiki controls that relate to it, the control themes from the Framework Adoption Guide and its verification status. The last column holds the primary URL and the date it was retrieved, for the rows that have been checked. A note in brackets says when only part of the row was checked.
The same data is available as a CSV file for GRC tooling: crosswalk.csv.
Legal force sorts each row under one of seven labels, so that law is not mistaken for guidance or for a voluntary framework. The label is this wiki's reading of the sources and carries the same verification caveat as the rest of the row.
| Label | Meaning |
|---|---|
| Binding law | Enacted law or regulation that applies generally in the jurisdiction, including provisions that start on a later date. |
| Binding in scope | Binding only on a sector, a free zone, a state or province, or public bodies. |
| Guidance | Published by a government or regulator, and not binding in itself. |
| Voluntary | A standard, code or framework that an organization chooses to adopt. |
| Proposed | A bill, draft or consultation, or a proposal that lapsed. It is not law. |
| Context | A policy, authority, programme or summary row that sets no rule. |
| Unclear | The sources used do not settle whether it binds. |
| ID | Jurisdiction | Instrument | Legal force | Type / status | Wiki controls | Control themes | Verification tag | To verify | Primary URL and retrieval date |
|---|---|---|---|---|---|---|---|---|---|
| U1 | UAE | Federal Decree-Law 45/2021 (PDPL) | Binding law | Binding | AI-CTRL-013; AI-CTRL-007; AI-CTRL-017; AI-CTRL-035 | PRV; XBT; RET; INC | Reported | Executive Regulation status; article numbers | |
| U2 | UAE | Federal Decree-Law 34/2021 (cybercrime) | Binding law | Binding | AI-CTRL-005; AI-CTRL-028; AI-CTRL-035 | INC | Unverified | AI relevance | |
| U3 | UAE | UAE Charter for Development and Use of AI | Guidance | Non-binding | AI-CTRL-012; AI-CTRL-023; AI-CTRL-039 | GOV; POL; OVS; TRN | Conflict | Publication month | |
| U4 | UAE | UAE AI Ethics Principles and Self-Assessment | Voluntary | Voluntary | AI-CTRL-012; AI-CTRL-039; AI-CTRL-041 | POL; OVS | Reported | Principle names | |
| U5 | UAE | Federal Authority for AI and Data | Context | Regulator (announced 14 Jun 2026) | AI-CTRL-013; AI-CTRL-038 | GOV; AUD | Reported | Official mandate | |
| U6 | UAE-DIFC | DIFC DP Law and Regulation 10 | Binding in scope | Binding in DIFC | AI-CTRL-013; AI-CTRL-011; AI-CTRL-023; AI-CTRL-041 | PRV; OVS; RSK; CHG | Conflict | Enforcement date; ASO; certification | DIFC Commissioner of Data Protection guidance page, retrieved 10 Oct 2026 (guidance listing only; it shows a Regulation 10 certification scheme) |
| U7 | UAE-ADGM | ADGM Data Protection Regulations | Binding in scope | Binding in ADGM | AI-CTRL-013; AI-CTRL-007 | PRV; XBT | Unverified | All | |
| U8 | UAE-Dubai | Dubai AI Security Policy (DESC) | Unclear | Policy Sept 2024 | All | AUD; BCP; POL | Reported | Obtain text | |
| U9 | UAE | CBUAE Guidance Note on AI/ML | Guidance | Supervisory guidance 23 Feb 2026 | AI-CTRL-011; AI-CTRL-014; AI-CTRL-023; AI-CTRL-025; AI-CTRL-041 | GOV; INV; OVS; VND | Reported | Rulebook entry | |
| U10 | UAE-AbuDhabi | AIATC Law 3/2024 | Context | Governance body | Reported | Scope | |||
| U11 | UAE | UAE information assurance (NESA/IA) | Unclear | Baseline | AI-CTRL-005; AI-CTRL-008; AI-CTRL-009; AI-CTRL-032 | AUD; BCP | Unverified | Custodian and version | |
| U12 | UAE-Dubai | Dubai AI Seal | Unclear | Certification (procurement) | AI-CTRL-012; AI-CTRL-038 | POL; AUD | Unverified | Single source | |
| S1 | Saudi | PDPL | Binding law | Binding | AI-CTRL-013; AI-CTRL-007; AI-CTRL-017 | PRV; XBT; RET; INC | Conflict | In-force vs enforcement dates | SDAIA regulations and policies page, retrieved 10 Oct 2026 (listing only; dates not checked) |
| S2 | Saudi | SDAIA AI Ethics Principles | Guidance | Non-binding; SDAIA publishes document SDAIA-P114E, version 1, May 2025 | AI-CTRL-012; AI-CTRL-039; AI-CTRL-041 | POL; OVS; TRN | Verified | Number of principles; how it relates to the v2.0 text reported for Sept 2023 | AI Ethics Principles, retrieved 10 Oct 2026 |
| S3 | Saudi | SDAIA Generative AI Guidelines | Guidance | Two guidelines, one for government and one for the public; the government edition's cover is dated 2025 | AI-CTRL-002; AI-CTRL-010; AI-CTRL-012 | POL; OVS | Verified | The Jan 2024 date; how far the government edition binds | Generative AI Guidelines for Government; SDAIA regulations and policies page, retrieved 10 Oct 2026 |
| S4 | Saudi | SDAIA AI Adoption Framework | Guidance | Guiding reference for government and private entities; cover dated 2025 | GOV | Verified | Maturity levels; the Sept 2024 date | AI Adoption Framework, retrieved 10 Oct 2026 | |
| S5 | Saudi | SDAIA National AI Risk Mgmt Framework (SDAIA-P145) | Unclear | Published 2026 | AI-CTRL-037 | RSK; INV; CHG | Conflict | Date April vs July 2026; not listed on the SDAIA regulations page on 10 Oct 2026 | |
| S6 | Saudi | NCA ECC and CCC | Binding in scope | Binding gov and CNI | AI-CTRL-005; AI-CTRL-008; AI-CTRL-032 | AUD; BCP; INC | Reported | Applicability | |
| S7 | Saudi | NCA NCNICC-1:2025 | Unclear | Reported private sector from Jan 2026 | AI-CTRL-005; AI-CTRL-008; AI-CTRL-032 | AUD | Unverified | Applicability | |
| S8 | Saudi | NCA AI Cybersecurity Guidelines | Proposed | Consultation closed 5 Aug 2026 | All | VND; AUD; BCP | Unverified | Final text | |
| S9 | Saudi | Copyright TDM exception | Binding law | Reported eff. 12 Aug 2026 | AI-CTRL-029 | POL | Reported | Text | |
| S10 | Saudi | NDMO/CST/SAMA localisation overlays | Unclear | Overlay | AI-CTRL-007 | XBT | Unverified | All | |
| Q1 | Qatar | Law 13/2016 PDPPL | Binding law | Binding | AI-CTRL-013; AI-CTRL-007; AI-CTRL-017 | PRV; XBT; RET; INC | Reported | Articles | |
| Q2 | Qatar | NCSA Guidelines for Secure Adoption and Usage of AI | Voluntary | Voluntary (reported) | All | VND; AUD; INC; BCP | Reported | Binding drift | |
| Q3 | Qatar | MCIT Ethical AI Principles | Guidance | Non-binding | AI-CTRL-012; AI-CTRL-039; AI-CTRL-041 | GOV; POL; OVS; TRN | Conflict | Year | |
| Q4 | Qatar | QCB AI Guideline (4 Sep 2024) | Binding in scope | Reported binding for licensees | AI-CTRL-011; AI-CTRL-023; AI-CTRL-033; AI-CTRL-041 | GOV; RSK; INV; OVS; CHG | Reported | Binding status | |
| B1 | Bahrain | Law 30/2018 PDPL | Binding law | Binding; Law No. (30) of 2018 with Respect to Personal Data Protection Law | AI-CTRL-013 | PRV; XBT; RET; INC | Verified | Articles | Personal Data Protection Authority: The Law, retrieved 10 Oct 2026 |
| B2 | Bahrain | General Policy for Use of AI (May 2025) | Binding in scope | Reported binding on government | AI-CTRL-012 | GOV; POL; OVS | Reported | Scope | |
| B3 | Bahrain | Draft AI law (38 articles) | Proposed | Not enacted per sources | Reported | Re-check | |||
| B4 | Bahrain | CBB digital financial advice directives | Unclear | Sector | AI-CTRL-023 | VND | Reported | Scope | |
| O1 | Oman | National AI Policy (9 Apr 2025) | Binding in scope | Reported mandatory within scope | AI-CTRL-011; AI-CTRL-037; AI-CTRL-038 | GOV; RSK; INV; AUD; TRN; CHG | Reported | Scope | |
| O2 | Oman | PDPL amendments | Proposed | Awaiting promulgation (reported) | AI-CTRL-013 | PRV; RET | Reported | Re-check | |
| K1 | Kuwait | None listed | Context | Unverified | Not researched |