As we enter 2024, artificial intelligence (“AI”) continues to dominate global headlines and sits firmly on the boardroom agenda for businesses across sectors and jurisdictions. “AI” was the Collins dictionary word of the year for 2023 and the trend of the biggest companies in the world prioritising AI related research, development, procurement and deployment shows no signs of slowing down. 

As a consequence of the pervasive interest in AI at all levels of society, and the significant impact, both in terms of opportunities and potential risks, that AI technologies bring,  it comes as little surprise that AI is widely acknowledged as the next key frontier for legislators around the world. 

As with developments in overarching personal data protection legislation in the late 2010s, the EU is leading the charge in seeking to effectively regulate AI, with the publication in December 2023 of its comprehensive AI Act – the first comprehensive law on AI globally.

However, at present, there is less international consensus on how AI should be regulated (and in some jurisdictions, if it should be regulated!) when compared with personal data protection law - where we have seen, to a large extent, a degree of convergence (at least at a core principles level), across personal data protection laws worldwide. 

From a Middle East perspective, whilst we have yet to see the publication of an overarching dedicated AI law in the GCC (or any individual territory therein), governments across the GCC are clearly keen to position their countries as hubs for this emerging technology as part of broader, long term strategies to transition their national economies away from a historic dependence on natural resources (a journey which is well underway for many). By way of example, the United Arab Emirates issued a comprehensive national strategy on AI in November 2023 which sets out eight key, and ambitious, strategic AI objectives for the period up to 2031. Each of the other GCC territories has also issued one or more similar strategy documents. 

In addition to these overarching national strategies, there are a number of instances of GCC governmental departments or Ministries expressing an interest in the deployment of AI technologies to enhance their functions (see, for example, these statements reportedly made by the Qatar Ministry of Justice and the various examples in the UAE set out at pages 17 to 19 of the UAE’s National Program for AI Guide). 

Below we have set out the key steps taken by each GCC territory in the development of AI specific regulatory frameworks to date. It is also important to note that, in addition to AI specific strategy documentation and regulations, the development and deployment of AI related technology will already be subject to existing legislation (or elements thereof) in each jurisdiction, in particular personal data protection laws and intellectual property laws. 

• Bahrain. The Bahrain Government has issued a set of principles and values to guide the ethical use of AI. The Bahrain Government has also reportedly been trialing the World Economic Forum (“WEF”) AI Government Procurement Guidelines (“WEF Guidelines”) (although, somewhat confusingly, the document published on the Bahraini government’s website under the title “Bahrain AI Government Guidelines” is in fact another document issued by the WEF, summarising the key findings from workshops conducted in Bahrain, UAE and the United Kingdom (UK), which focused on moving the WEF Guidelines from theory to practice). 
• Kingdom of Saudi Arabia (“KSA”). In September 2023 the Saudi Data and AI Authority (“SDAIA”) issued a set of seven AI Ethics Principles, followed in January 2024 by two sets of Generative AI Guidelines, one directed towards the KSA public sector and one directed towards the private sector and the public more broadly.
• Kuwait. No dedicated AI regulation or guidance documentation issued to date. 
• Oman. In 2021 the Ministry of Transport, Communications and Information Technology issued a Policy on Government Use of AI technology. The Policy sets out six high level principles for the use of AI by Omani government entities, as well as certain hard requirements, including a requirement to disclose to those who may be impacted by the AI system that the AI system is being used and may affect them. 
• Qatar. No dedicated AI regulation or guidance documentation issued to date. However, Qatar has issued a National AI Strategy which is structured around six key pillars: (a) the race for talent; (b) access to data; (c) the changing landscape for employment; (d) new business and economic opportunities; (e) AI focus areas for Qatar (i.e. Use cases / instances particularly relevant to Qatar); and (f) ethics and public policy.
• UAE. A number of documents have been issued in the UAE, notably:

1. The National Program for AI Guide, a high level document showcasing the UAE government’s commitment to becoming an AI technology hub.   
2. The Smart Dubai AI Ethics Principles& Guidelines. Published in March 2019, this is an Emirate level document issued under the Smart Dubai government initiative setting out a set of AI ethical principles and associated guidelines. A self-assessment tool was launched in conjunction with the guidelines, to enable “AI developer organisations or AI operator organisations to evaluate the ethics level of an AI system” against the guidelines.
3. Generative AI Guide. Issued in May 2023, the Generative AI Guide operates as an explainer of AI and generative AI technologies and some of the key challenges associated with them, before providing case study analyses of certain key instances in which the technologies have been employed to date.
4. DIFC Data Protection Regulations. The updated Dubai International Financial Centre Data Protection Regulations (September 2023) introduced detailed and specific requirements for those who develop, deploy or operate AI systems.

It is likely that significant developments will be forthcoming in the UAE, following the establishment of the UAE AI & Advanced Technology Council on 22 January 2024. 

Whilst the adoption of a GCC-wide regional AI framework would certainly minimise friction for businesses operating cross border within the GCC (and thus, increasing the attractiveness of the region for companies operating in the space), based on recent legislative developments in related areas it seems relatively unlikely. Specifically, each GCC territory has issued an independent personal data protection law (with no top-down harmonisation across the GCC) and has established an independent national personal data protection regulator.

It remains to be seen how aggressive national GCC legislators will be in their approach to  AI. The argument that a relatively light touch approach is the most appropriate if the goal is to attract businesses operating in, or procuring services from, the sector is obvious. Businesses typically prefer freedom to operate with minimal intervention, albeit with certain clearly defined parameters which provide for a level playing field, particularly given the speed at which AI technology is developing.  However, the speed of this development brings with it a note of caution, demonstrated by the fact that senior figures at certain key AI players have already issued public statements warning of the potential power and risk of AI technologies, in some cases calling on governments to slow progress whilst the most appropriate regulatory response is considered. Cynics may regard these statements as attempts by those lagging behind the front runners to stall those ahead in the race whilst they play catchup but, regardless of whether industry stakeholders do truly wish for increased regulation, it is highly likely, given the spotlight on the sector in the GCC, that there will be significant developments in the coming months and years.

In the meantime, while AI technology itself and the regulatory framework within which it operates continues to develop, with the possibilities and potential risks still being debated and explored, it is imperative that those considering the use of AI technologies in the course of their business develop, regularly re-assess and update their own internal policies governing the use of AI to ensure that those keep pace with both the regulatory landscape and the ever expanding list of use cases business stakeholders will wish to take advantage of.