The GCC AI Regulatory Tracker
Six states, four regimes, one map. Click a country for its data protection, transfer, AI governance and free-zone position, every entry sourced to primary law. Below: who is ready, how binding each rulebook really is, and the decade that built them.
Government AI readiness, scored.
Scores from the Oxford Insights Government AI Readiness Index 2025 (corrected January 2026 dataset), 0 to 100 across 195 countries. Grey bars are non-GCC benchmarks. Saudi Arabia leads the region at 15th in the world; the gap to the frontier is real but closing.
Six pillars. Very different stories.
The same index, decomposed. The Gulf scores like the frontier on policy vision and government adoption, and like the emerging world on development depth and resilience. Hover any cell for the exact score; click a state to load it on the map. Benchmarks in the lower rows.
People ready. Compute scarce.
Two sub-dimensions from the same index tell the region’s whole story: Gulf human capital already sits near benchmark level, while measured compute capacity remains a fraction of the frontier’s. It is exactly the gap the $100bn-scale build-outs on this page are racing to close.
The pipeline is not where the press releases are.
Tracked data centre pipeline in megawatts (eninrac GCC outlook, July 2026; comparable across the four states it tracks). Saudi Arabia’s tracked pipeline alone exceeds the region’s entire live capacity today. Kuwait and Oman publish no pipeline figures, which is itself worth knowing. The announced mega-projects below sit largely on top of these tracked pipelines, not inside them.
Tracked pipeline, MW · Source: eninrac, 8 July 2026 · Live IT load where published: Saudi Arabia 410 MW, UAE 507.7 MW (Mordor Intelligence, 2025); Qatar 26 MW operator floor (Syntys, January 2026)
Law, regulation, or press release?
Institute assessment of each regime's legal force as of August 2026. Hover any cell for the basis; the full sourced matrix is below. The pattern worth noticing: every state now has enforceable data protection rules, and not one has a binding general AI law.
A law is only as real as its enforcement. The scoreboard so far: active in Riyadh and the DIFC, quiet almost everywhere else.
2016 to 2026: from first data law to AI-native government.
Where the Gulf sits in the global rulebook.
| State | Data protection | Transfer & localisation | AI strategy & guidance | Free zones & special jurisdictions |
|---|---|---|---|---|
| Saudi Arabia | PDPL in force (Sep 2023), enforced since Sep 2024 | Transfer Regulation in force (2023, amended Sep 2024) | No binding AI law; SDAIA soft law + draft Global AI Hub Law (2025) | No separate-law zones; 4 SEZs (2023) incl. Cloud Computing SEZ |
| United Arab Emirates | PDPL (Federal Decree-Law 45/2021) in force (2022), regulations pending | PDPL Arts 22-23 dormant; sectoral localisation in force | No AI law; Charter (2024) soft law; federal AI authority (2026) | DIFC DP Law 5/2020 + Reg 10 (2023); ADGM DPR 2021 |
| Qatar | PDPPL (Law No. 13 of 2016) in force | No general localisation; permissive PDPPL transfer rule | National AI Strategy 2019 + guidance; no AI law | QFC Data Protection Regulations 2021 in force (2022) |
| Kuwait | No standalone law; CITRA DPPR (Decision 26/2024) in force | Tiered localisation repealed (2024); disclosure duties remain | No AI law; draft National AI Strategy 2025-2028 | None with distinct data or AI rules |
| Bahrain | PDPL Law 30/2018, in force 2019 | Adequacy whitelist (Resolution 42/2022); no general localisation | National AI Policy 2025 (government sector); no AI law enacted | No separate-jurisdiction zones; Cloud Law 56/2018 data embassies |
| Oman | PDPL (RD 6/2022) in force since Feb 2023; fully enforced Feb 2026 | Consent-plus-adequacy transfer regime (MD 34/2024); no general localisation law | National AI policy (2025) and programme; no binding AI law | Unified zones law (RD 38/2025); AI Special Zone (RD 50/2026); no separate data regime |
Status as of August 2026 · Every cell sourced to primary law below · Tap a state for detail
Complex AI Institute, The GCC AI Regulatory Tracker, August 2026 edition. Available at complexai.org/gcc-ai-tracker. Statuses reflect law and guidance in force or in draft as of 1 September 2026; each entry links to the primary source it rests on. Corrections: engage@complexai.org.