Middle East and North Africa - AI Regulation Overview

Overview

As of September 2026, artificial intelligence regulation across the Middle East and North Africa (MENA) is defined by a distinct dual-track evolution. On one hand, the Gulf Cooperation Council (GCC) member states—notably the United Arab Emirates, Saudi Arabia, and Qatar—lead the region with highly capitalized, strategy-driven governance models. These jurisdictions emphasize state-directed innovation, centralized policy oversight, flexible soft-law frameworks, and regulatory sandboxes designed to foster rapid technological adoption while establishing basic guardrails around ethics, data protection, and cybersecurity.

On the other hand, North African economies and neighboring jurisdictions in the Levant and broader Middle East display a spectrum of regulatory maturity. Countries such as Egypt, Morocco, and Tunisia are actively bridging soft-law ethical guidelines and structural capacity-building initiatives with emerging binding legislation. Meanwhile, states like Iran and Iraq prioritize technological sovereignty, national data localization, and strict digital content regulation, enforcing governance primarily through centralized security organs, computer crimes legislation, and administrative licensing regimes.

Across the entire MENA region, explicit horizontal statutory bans on AI technologies remain rare. Instead, regional policy relies on soft-law guidelines, risk-tiered adoption models, sectoral rules issued by financial and cybersecurity watchdogs, and enforcement anchored in foundational data privacy, cloud, and cybercrime laws.

Key Trends and Focus Areas

Governance frameworks across the region reflect several common policy priorities, driven by national economic transformation agendas, sovereign infrastructure goals, and digital security mandates:

• Centralized Apex Governance Bodies: Jurisdictions across MENA are establishing centralized state bodies to unify policy development and oversight. Saudi Arabia leads through Royal Order No. (A/471) establishing the Saudi Data and Artificial Intelligence Authority, which coordinates data governance and responsible AI adoption nationwide. Emirate-level institutionalization is visible in the UAE through instruments such as Abu Dhabi Law No. 3 of 2024 on Establishing the Artificial Intelligence and Advanced Technology Council. In Qatar, centralized direction is driven under Cabinet Decision No. (10) of 2021 establishing the Artificial Intelligence Committee, while Iran manages AI infrastructure under the Statute of the National Artificial Intelligence Organization (2024).
• Principles-Based Soft Law and Operational Playbooks: Gulf regulators rely heavily on non-binding ethical principles and practical playbooks over statutory penal codes. The UAE outlines its national expectations in The UAE Charter for the Development and Use of Artificial Intelligence (2024). Saudi Arabia operationalizes ethics through the AI Adoption Framework (SDAIA) (2024) and the Generative AI Guidelines for Government (SDAIA) (2024). Qatar provides comprehensive soft-law principles via the Principles and Guidelines for Ethical Development and Deployment of Artificial Intelligence (MCIT) (2025).
• Regulatory Sandboxes and Innovation Mechanisms: To encourage commercial testing without immediate statutory burdens, countries leverage experimental licensing. The UAE employs Federal Decree‑Law No. (25) of 2018 on the Projects of Future Nature to grant provisional legislative exemptions, supported by financial initiatives like the Dubai DIFC AI Regulatory Sandbox (2024) and trust markers such as the Dubai AI Seal Verification System (2025).
• Data Sovereignty, Cloud Oversight, and Computing Infrastructure: Regional regulators increasingly tie AI development to cloud governance and sovereign computing. Saudi Arabia's draft legislative pipeline includes the Draft Global AI Hub Law (2025) to host sovereign and foreign-aligned compute facilities. Morocco supports infrastructure and developer ecosystems through regional initiatives like the Casablanca-Settat Data and AI Excellence Center (2025), supported by data security rules under Law No. 05-20 on Cybersecurity (2020). Iran mandates strict localization of compute and data assets under the National Artificial Intelligence Document of the Islamic Republic of Iran (2024).
• Enforcement via Cybercrime, Digital Content, and Tech Startup Laws: Where standalone AI legislation is absent, binding legal liabilities are enforced through broad digital statutes. Tunisia balances tech incentives under Law No. 2018-20 of April 17, 2018, relating to startups with strict system controls under Decree-Law No. 2022-54 of 13 September 2022 on Combating Offences Relating to Information and Communication Systems. Iraq manages digital platforms through the Regulation for Organizing Digital Content in Iraq (2023) alongside the Electronic Signature and Transactions Law No. 78 of 2012, while evaluating penal provisions under the proposed Draft Informatics Crimes Law (2023). In Iran, digital compliance and electronic contracting are enforced under the Computer Crimes Law (2009) and Electronic Commerce Law (2004).

Regulatory Status

The MENA region displays four distinct tiers of regulatory status:

1. Policy Strategies and Vision Blueprints: National AI blueprints anchor digital economic transitions across the region. Strategic posture is articulated in high-level policy documents such as the Qatar Digital Agenda 2030 (2024), Israel's Government Decision No. 212 – Program for the advancement of innovation, encouragement of high‑tech sector growth and strengthening Israel's technological and scientific leadership (2021), the UAE's International Stance on Artificial Intelligence Policy (2024), and Iran's National Artificial Intelligence Document of the Islamic Republic of Iran (2024).

2. Established Soft-Law Principles and Operational Frameworks: Active guidance is mature in the GCC and Israel. Financial sector rules are particularly advanced, as seen in Qatar's sector-specific rules, including the Central Bank AI Guidelines (2024) and the Qatar Central Bank Artificial Intelligence Guideline for QCB‑licensed Entities (2024), alongside cross-sector cybersecurity rules like the Guidelines for Secure Adoption and Use of Artificial Intelligence (National Cyber Security Agency) (2024).

3. Emerging Statutory Codification: Select jurisdictions are transitioning from soft guidelines to mandatory, binding statutory regimes. Egypt leads this transition through the pending Egypt Draft Artificial Intelligence Law (2024), which seeks to introduce formal risk classifications and statutory compliance duties. Similarly, Morocco is evaluating institutional codification through the Bill for the Establishment of the National Agency for AI Governance (2024) and the broad Digital X.0 Framework Law (2025).

4. Sectoral and Cybercrime Binding Controls: Binding enforcement across Tunisia, Iran, Iraq, and North Africa continues to rely on baseline data protection, digital transaction laws, and computer crime statutes rather than dedicated AI-specific penalties.

Notable Differences

While shared economic goals generate high-level alignment, substantial operational differences exist across sub-regions:

• GCC vs. North Africa: The resource-rich GCC economies emphasize state-funded compute clusters, regulatory sandboxes, and highly structured soft-law frameworks designed to attract international tech investment. Conversely, North African states like Tunisia, Egypt, and Morocco focus on workforce development, startup support mechanisms (e.g., Tunisia's Law No. 2018-20 of April 17, 2018, relating to startups), and formal legislative codification to regulate risk under state authorities.
• Israel's Decentralized Sector-Led Approach: Israel stands out by explicitly rejecting single, horizontal AI statutes or centralized horizontal AI regulators. Operating under Government Decision No. 212 – Program for the advancement of innovation, encouragement of high‑tech sector growth and strengthening Israel's technological and scientific leadership, Israel distributes supervisory authority across existing line ministries (such as financial regulators and privacy authorities) guided by OECD principles and targeted R&D funding.
• State Sovereignty and Content Control Models: Iran and Iraq prioritize security, public order, and state sovereignty. Iran's governance, anchored in the Statute of the National Artificial Intelligence Organization, mandates local compute hosting and enforces system compliance through the Computer Crimes Law and Electronic Commerce Law. Iraq enforces platform registration and content compliance through administrative rules like the Regulation for Organizing Digital Content in Iraq, backed by structural e-commerce legislation under the Electronic Signature and Transactions Law No. 78 of 2012 and severe proposed penalties under the Draft Informatics Crimes Law.

Regional Outlook

The MENA region is entering a critical transition period through late 2026 and beyond. Strategic focus is shifting rapidly from general AI vision statements toward granular operational compliance, model governance, and targeted legislative enactments.

Key legal developments to monitor include the potential enactment of Egypt's Egypt Draft Artificial Intelligence Law, which could establish North Africa's first binding, risk-based statutory framework. In the GCC, Saudi Arabia's progression of the Draft Global AI Hub Law will clarify jurisdictional and legal requirements for sovereign data hosting and cross-border compute facilities. Furthermore, Morocco's consideration of the Bill for the Establishment of the National Agency for AI Governance and the Digital X.0 Framework Law indicates a growing regional trend toward dedicated statutory oversight bodies.

The primary challenge facing MENA policymakers is balancing state security, data localization, and administrative oversight with the flexible, interoperable environments required for cross-border AI innovation. Organizations operating across the region must navigate a fragmented legal landscape characterized by agile soft-law sandboxes in the Gulf, sector-led oversight in Israel, and evolving statutory and cybercrime enforcement across North Africa and the Levant.