Many groups now run operations in both Europe and the Gulf, and want one AI roadmap rather than two. The regulatory landscapes look very different on paper. In practice, a small set of design decisions, taken early, keeps a single programme compliant on both sides.
This article sums up the approach we use during our AI diagnostics. It is general information, not legal advice: every programme should be reviewed by counsel in each jurisdiction.
1. Know which rulebook applies
In the European Union, two texts matter most. The GDPR governs personal data. The EU AI Act entered into force on 1 August 2024 and applies in stages: banned practices since February 2025, obligations for general-purpose AI models since August 2025, then requirements for high-risk systems, phased in from 2026, with part of the timetable under revision at EU level.
In the Gulf, there is no single AI law of the same kind. The constraints come mostly from personal data protection laws, which Saudi Arabia, the United Arab Emirates, Qatar, Oman and Bahrain have all adopted, from sector regulators (banking, health, government) and from national AI ethics principles. Financial free zones such as the DIFC and ADGM in the UAE run their own data protection regimes.
2. Classify every use case before you build it
Compliance work is proportional to risk, so the first step is a simple classification of each use case: what it does, whose data it touches, which countries its users are in, and whether it influences decisions about people.
| Use case | Personal data | EU AI Act | What to watch in the Gulf |
|---|---|---|---|
| Supplier invoice agent | Limited (contact names) | Usually minimal risk | Retention rules, data location |
| Customer service assistant | Yes | Transparency: users must know it is an AI | Consent and cross-border transfers |
| CV screening assistant | Yes, sensitive | High risk (employment) | Sector rules, human decision required |
This table is not the end of the analysis, but it tells you where to spend legal and engineering effort.
3. Design for the strictest, configure for the local
The controls that satisfy the AI Act and the GDPR are good engineering everywhere. Build them once, into the platform, and every country benefits:
- Human oversight: an approval step wherever an action commits the organisation or affects a person.
- Logging: what the system read, what it did, who approved it, kept for an agreed period.
- Data minimisation: the agent sees only the fields it needs, through least-privilege connectors.
- Documentation: purpose, data sources, model, tests and known limits, updated at each release.
What changes from one country to the next is configuration: retention periods, consent wording, the language of notices and where data is stored.
4. Decide early where data lives
Data location is the question most likely to reshape an architecture late in a project. Some Gulf regulators and public-sector clients expect certain data to stay in the country; European clients often require hosting in the EU.
The good news: major cloud providers now operate regions in several GCC countries as well as across Europe, and many language models can be consumed from a chosen region or hosted privately. Making the choice during the diagnostic, rather than after the prototype, avoids rebuilding the integration twice.
5. Treat Arabic quality as a requirement
A model that performs well in English is not automatically reliable on an Arabic invoice. Test on your real documents, including scanned ones, mixed Arabic–English documents and regional dialects in free text. Check the details that break automations: Hijri and Gregorian dates, Arabic-Indic digits, right-to-left rendering in every screen and export.
Agree a quality threshold per language before roll-out, and keep sampling after go-live.
A one-page checklist
- List use cases, data, users and countries.
- Classify each use case and flag high-risk ones.
- Agree hosting and data location per country.
- Build oversight, logging and minimisation into the platform.
- Test quality in every language on real documents.
- Document, review with counsel, then roll out by waves.
If you are planning AI across both regions, our complimentary diagnostic covers exactly these steps for your first use cases.
General information, not legal or professional advice. Check current rules with counsel in each jurisdiction.
