AI Rules in Oman and the GCC: What Is Law, What Is Guidance, and What Actually Binds Your Business
No GCC state had a general artificial intelligence law in force at the time of writing. That does not mean AI is unregulated in the Gulf. What binds a business using AI today comes mostly from laws that were not written about AI: data protection, electronic transactions, cybercrime and sector regulation.
In Oman, the most important binding rule arrived on 7 September 2026, inside the amended Personal Data Protection Law. People may now object to decisions made by automated processing, and a person must review the decision. Everything else — national AI policies, ethics principles, charters — is guidance that sets direction rather than imposing duties enforceable against a private company.
This article separates the two, country by country, so you know which rules to build to and which to watch.
The short answer
| Country | Binding rules that reach AI use today | Policy and guidance | Pending |
|---|---|---|---|
| Oman | PDPL Article 14 on automated processing (since 7 Sep 2026); Electronic Transactions Law on automated agents; Cybercrime Law 2026 covering AI systems | Public Policy for the Safe and Ethical Use of AI Systems (MTCIT, 2025) | Executive Regulation controls for human review |
| Saudi Arabia | PDPL and its regulations | SDAIA AI Ethics Principles; Generative AI guidelines | Draft PDPL amendments with impact assessments for automated decisions |
| UAE | Federal PDPL right to object to automated processing; DIFC Regulation 10 inside the DIFC | UAE Charter for the Development and Use of AI (2024) | New federal AI and data authority (announced June 2026); PDPL executive regulations |
| Qatar | Qatar Central Bank AI Guideline for licensed financial institutions; PDPPL | National Cyber Security Agency guidelines on secure AI adoption | — |
| Bahrain | PDPL; government AI policy binding on government entities | — | AI bill not enacted |
| Kuwait | CITRA data privacy regulation for licensed providers | National AI strategy | Draft guidelines for adopting AI (consulted 2026) |
Oman: the binding rule sits in the data protection law
Article 14 — automated processing
Royal Decree 68/2026 added a definition of automated processing. It means processing by an electronic programme or system that operates automatically, either fully without human involvement or with limited human supervision. It also replaced Article 14 of the Law with three obligations:
- Controllers and processors using automated processing must take appropriate measures to protect the privacy and confidentiality of personal data and avoid harming the data subject.
- Data subjects have the right to object to decisions resulting from automated processing, “in all cases”.
- On objection, the controller or processor must introduce the human element in reviewing the decision, under controls the Executive Regulation is to set.
A breach carries a fine of OMR 5,000 to 10,000. That makes Article 14 the first rule in Omani law that tells a business, in terms, how to operate an automated decision system. A loan pre-approval tool, an applicant-screening filter or a chatbot that cancels orders is now subject to it. What Royal Decree 68/2026 changed covers the rest of the amendment.
The Electronic Transactions Law and automated agents
Royal Decree 39/2025 replaced the 2008 Electronic Transactions Law in April 2025. It defines an “automated electronic agent” — a programme or system acting without a natural person’s intervention. Two articles matter for AI.
Article 12 treats an electronic document issued through an automated agent that its operator has set up to act automatically as issued by the operator. Article 19 permits contracts concluded between automated agents. It also permits contracts between an automated agent and a person who knows, or is presumed to know, that they are dealing with one.
Read together, these say something businesses often miss. What your chatbot tells a customer can be treated as coming from you. If it is set up to accept orders or bookings, it can form contracts on your behalf. When your chatbot gets it wrong looks at the liability that follows.
The 2026 Cybercrime Law names AI systems
The Law on Combating Information Technology Crimes, issued by Royal Decree 61/2026 in June 2026, defines artificial intelligence and AI systems. It counts AI systems within “information systems”. The offences of unauthorised access, exceeding authorised access and data tampering therefore apply to AI systems in the same way as to any other system. Article 36 also criminalises altering another person’s audio, video or image to defame or insult them — whatever tool is used to do it.
The Public Policy for the Safe and Ethical Use of AI Systems
MTCIT issued the Public Policy for the Safe and Ethical Use of Artificial Intelligence Systems in 2025. It was announced publicly in May 2025. As reported by Muscat Daily, it applies to all government entities and to private-sector institutions regulated by relevant authorities that develop or use AI. It covers system security, ethical compliance, transparency in AI decision-making, data privacy, fairness and protection against bias, and the legal responsibilities of those who develop and deploy AI.
Trowers & Hamlins describes it as guidance rather than binding AI legislation. Treat it as the clearest statement of what the Omani government expects. If you work in a regulated sector, or sell AI to government, expect your counterparty to ask how you meet it.
Two other instruments are sometimes cited as AI regulation and are not. Royal Decree 50/2026, of April 2026, created an AI special zone in Muscat with economic-zone incentives; it contains no AI rules. And the national AI programmes set investment and capability goals rather than duties.
Saudi Arabia: principles and guidelines, with the PDPL doing the binding
SDAIA has published AI Ethics Principles and guidelines on generative AI. Commentators treat them as non-binding: they carry no fines or sanctions. SDAIA has continued to add guidance during 2026, including a draft Responsible AI Policy put to consultation in April 2026.
The binding layer is the PDPL. Its draft amendments, under consultation until 5 November 2026, would require data protection impact assessments for processing involving emerging technologies and automated decisions that affect people’s rights or interests. If you process Saudi residents’ data with AI, that is the provision to watch. What the Saudi PDPL requires from a company outside the Kingdom covers the rest.
UAE: a charter, a new authority and the DIFC’s rule
The UAE published its Charter for the Development and Use of Artificial Intelligence in 2024. It sets out principles including safety, privacy, transparency, human oversight and accountability. It is a statement of principles, not a set of enforceable duties.
In June 2026 the UAE announced a federal authority for artificial intelligence and data. Secondary sources report that it brings together the federal AI office and the data office. We could not find its founding text, so treat its mandate as unconfirmed.
Two binding rules exist already. The federal Personal Data Protection Law gives people the right to object to decisions based on automated processing, including profiling. And inside the DIFC, Regulation 10 has governed personal data processed through autonomous and semi-autonomous systems since 2023, requiring notice and risk assessment. The UAE’s three data protection regimes covers both.
Qatar: binding for banks, guidance for the rest
Qatar’s clearest binding AI instrument is sectoral. The Qatar Central Bank issued an AI Guideline for licensed financial institutions in 2024. As summarised by law firms, it requires risk classification of AI systems and board-level governance. It also requires prior approval from the central bank before deploying high-risk AI. If you build software for a Qatari bank, insurer or payment company, these requirements reach you through the client.
Outside finance, the National Cyber Security Agency has issued guidelines on the secure adoption and use of AI, and the Personal Data Privacy Protection Law applies to any personal data involved.
Bahrain and Kuwait
Bahrain. The Information & eGovernment Authority’s General Policy for the Use of AI, issued in 2025, binds government entities. It requires human control over consequential decisions and ties AI use to data protection and information security law. An AI bill approved by the Shura Council in 2024 had not been enacted at the time of writing. For private companies, the Personal Data Protection Law remains the binding layer.
Kuwait. Kuwait has no AI law. Its telecommunications regulator, CITRA, consulted in 2026 on draft guidelines for adopting AI. Its data privacy regulation applies to licensed telecommunications and ICT providers.
What actually binds a private business using AI today
Strip away the policies and five obligations are left. They apply across the region in some form.
- Data protection. Using personal data to run or train an AI system needs a lawful basis. In Oman that is explicit consent or one of four exceptions. Decisions made automatically about people now carry rights to object and to human review in Oman and the UAE.
- Transfers. Most AI models are reached through APIs hosted outside the Gulf. Sending personal data to them is a cross-border transfer under Oman’s law, with conditions. What your chatbot does with customer data works through this.
- Liability for what your system says. Under Oman’s Electronic Transactions Law, documents issued through your automated agent are treated as yours. Contract and consumer law do the rest.
- Confidentiality. Putting trade secrets, client files or personal data into an external AI tool can breach contracts, data protection law and the duty to take reasonable steps to protect confidential information. A policy for staff using AI tools covers the internal side.
- Sector rules and foreign law. Banking, health and telecoms add their own requirements. The EU AI Act reaches you if your AI’s output is used in Europe — see the EU AI Act and Gulf chatbots.
A governance baseline that will survive the coming rules
You do not need to wait for an AI law to set up the controls every draft is converging on:
- An inventory of AI uses — what each system does, what data it uses, who owns it.
- A risk triage separating systems that decide things about people from those that assist with content.
- Human oversight on every decision a person can object to, with the reviewer’s authority written down.
- Disclosure to people when they are dealing with an AI.
- Logs that let you reconstruct what the system decided and why.
- Vendor terms checked for training on your data, retention and hosting location.
Each item maps to an existing obligation somewhere in the Gulf, which is why it is a safe investment before any AI law exists.
Frequently asked questions
Does Oman have an AI law? Not a general one. The binding rule that reaches AI most directly is Article 14 of the amended Personal Data Protection Law, in force since 7 September 2026. It gives people the right to object to automated decisions and requires human review. MTCIT’s Public Policy for the Safe and Ethical Use of AI Systems sets expectations, but it is described by practitioners as guidance.
Is Oman’s AI policy mandatory for private companies? The policy states that it applies to government entities and to private-sector institutions regulated by relevant authorities. It is generally described as guidance rather than legislation, and we found no penalty attached to it. The binding obligations for most private companies come from the data protection, electronic transactions and cybercrime laws.
Which GCC country regulates AI most strictly? For private businesses in general, none has an AI-specific statute. The strictest binding sectoral rule is the Qatar Central Bank’s AI Guideline for financial institutions. The strictest geographically limited rule is the DIFC’s Regulation 10 inside that free zone.
Do I need to tell customers they are talking to a chatbot? No Gulf law we reviewed states this in general terms, though the DIFC requires notice for autonomous systems processing personal data. The EU AI Act requires it if your users are in Europe. Doing it everywhere is cheap, avoids misleading customers, and supports the objection right in Oman’s amended law.
Can I use customer data to train an AI model? Only with a lawful basis for that purpose. In Oman, that means explicit consent covering the purpose, or one of four listed exceptions — training a model is unlikely to fit most of them. If the model is hosted abroad, transfer rules also apply. Take advice before building a training pipeline on customer data.
This article states the position under the laws, policies and published drafts in force or under consultation on 21 October 2026, the date of publication. It is not legal advice. AI rules across the GCC changed repeatedly during 2026; confirm your position with a qualified adviser in each country concerned.
Sources: Royal Decree 68/2026 amending Oman’s PDPL · Royal Decree 39/2025 — Electronic Transactions Law (Arabic) · Royal Decree 61/2026 — Cybercrime Law (Arabic) · Muscat Daily — Oman unveils policy for safe, ethical use of AI · Trowers & Hamlins — Personal data and AI in Oman, June 2026 · Bird & Bird — AI regulatory tracker: Saudi Arabia · Pinsent Masons — UAE AI charter · Pinsent Masons — Qatar Central Bank AI guidelines · Bahrain iGA — General Policy for the Use of AI
Putting AI into your operations? ZAWAT builds AI and automation with human review, disclosure and logging designed in, so the systems are ready for the rules as they arrive. Book a call.