GCC enterprises increasingly operate across jurisdictions, sectors, and supply chains. As a result, AI governance cannot be built around a single national framework or standard. For many years, AI governance in the GCC was viewed primarily through a domestic lens. Organizations focused on complying with the regulations of the country in which they operated, assuming that local requirements were sufficient to manage risk. That assumption is becoming increasingly difficult to sustain.
As AI systems are deployed across borders, organizations are finding themselves subject to multiple governance expectations simultaneously. Domestic sectoral regulations, international legislation, contractual obligations with global partners, and internationally recognized governance standards [7] are all influencing how AI should be designed, deployed, monitored, and audited. AI governance is therefore evolving from a local compliance exercise into a cross-jurisdiction business challenge.
The EU AI Act Extends Beyond Europe
The EU AI Act is one of the clearest examples of why AI governance can no longer be treated as a purely domestic issue. Certain provisions of the Act can apply to organizations outside the EU, particularly when AI systems or their outputs are placed on the EU market or used within the EU. [1]
For example, a bank operating in the UAE may need to consider central bank expectations for AI use, data protection requirements, and internal model risk policies. It may also need to account for contractual requirements from international partners and potentially EU requirements for certain cross-border activities.
For GCC-based organizations serving European customers, this means local compliance may not be enough. Financial institutions, insurers, healthcare providers, technology companies, and digital platforms may need to assess whether their AI systems fall within the Act’s scope.
AI Governance Across the GCC Is Maturing
At the same time, the GCC regulatory environment is evolving through a combination of national strategies, sector-specific regulatory guidance, supervisory expectations, and broader governance frameworks. Rather than relying solely on high-level AI strategies, some jurisdictions are also developing practical guidance covering areas such as accountability, risk management, transparency, documentation, and human oversight.
The Central Bank of the UAE has issued guidance [2] on the responsible adoption of AI and machine learning for licensed financial institutions. Qatar Central Bank has published AI guidance [3] for regulated firms, while Saudi Arabia continues to expand its governance ecosystem through SDAIA. [4] Kuwait’s CITRA has also released guidance supporting responsible AI adoption. [5] Collectively, these developments indicate that AI governance is becoming an operational expectation rather than a future aspiration.
The Operational Challenge for Enterprises
The greatest challenge is not understanding individual regulations in isolation. It is designing governance processes capable of satisfying several regulatory expectations at the same time. This becomes more difficult for organizations operating across multiple countries, where requirements may vary from one jurisdiction to another.
Organizations increasingly need AI inventories, documented risk assessments, clear ownership, human oversight, audit trails, lifecycle management, and defined governance structures. The challenge is making these requirements part of day-to-day operations rather than treating them as separate compliance exercises.
ISO/IEC 42001 as a Common Governance Foundation
As organizations navigate multiple regulatory environments, ISO/IEC 42001 is emerging as a practical governance framework. As the first international standard for an Artificial Intelligence Management System, it provides a structured approach to governance, continuous improvement, documentation, accountability, and risk management. [6]
Although ISO/IEC 42001 does not replace legal or regulatory obligations, it provides a common governance baseline that can help organizations manage different requirements across jurisdictions. Rather than creating separate governance processes for every market, organizations can use the standard as a foundation and map specific regulatory and sector requirements against it.
What Should GCC Enterprises Do Now?
For GCC enterprises, the first step is not to create a separate governance framework for every regulation or market. It is to understand where AI is being used, which requirements apply, and where those requirements overlap.
Organizations should:
- Map AI use cases across the organization and identify where AI is being used or planned.
- Identify the relevant jurisdictions and sector regulators for each use case.
- Assess AI-related risks and establish clear ownership and accountability.
- Map regulatory requirements to common governance controls, including documentation, oversight, monitoring, and risk management.
- Use a structured framework such as ISO/IEC 42001 to provide a consistent foundation for managing these requirements.
The goal is not to create a different governance process for every market. It is to build a governance approach that can adapt as regulatory requirements continue to progress.
What This Means for Business Leaders
AI governance should no longer be viewed purely as a compliance exercise. It is increasingly a business capability that enables responsible innovation, strengthens customer trust, and supports long-term resilience.
Organizations that establish governance early are likely to respond more effectively as regulations continue to develop. Those that delay may find themselves adapting governance frameworks under regulatory pressure rather than designing them strategically.
GDI’s Perspective
Many organizations are discovering that they are operating under multiple overlapping regulatory regimes while planning for just one. They face a regulatory ecosystem that has changed faster than any single compliance team can track.
GDI has been working in enterprise technology across the GCC for over 40 years. That experience gives GDI a practical understanding of how regulatory requirements translate into enterprise technology decisions across the region.
Helping enterprises build governance models that meet regional requirements and align with international standards is becoming an important part of successful AI adoption. As regulations evolve, organizations with clear governance will be better placed to scale AI and respond to new requirements.
That is a conversation GDI is equipped to have. For four decades, GDI has helped regional enterprises build technology infrastructure that can adapt to regulatory change and remain resilient as requirements develop. If your AI program was built around a single framework while multiple regulatory expectations are now emerging, now is the right time to review whether your governance approach is ready for what’s ahead.
References
[1] European Commission. Regulation (EU) 2024/1689 (Artificial Intelligence Act): https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
[2] Central Bank of the UAE. Guidance Note on the Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions.
[3] Qatar Central Bank. AI Guidelines for Financial Institutions.
[4] Saudi Data & AI Authority (SDAIA): https://sdaia.gov.sa
[5] Communication and Information Technology Regulatory Authority (CITRA Kuwait): https://www.citra.gov.kw
[6] ISO/IEC 42001 Artificial Intelligence Management System Standard: https://www.iso.org/standard/81230.html
[7] OECD AI Policy Observatory: https://oecd.ai
