Nine Days to 16 September: What UAE and Saudi AI Governance Deadlines Actually Require

Week of 7 September 2026 | Compiled by Team Paringa

AI governance in the Gulf stopped being a policy conversation this year. In the UAE it is now a dated supervisory obligation with a number attached, and Saudi Arabia is enforcing its data law while stacking AI obligations on top.

What Happened This Week

🔴 The CBUAE clock runs out on 16 September, and most firms are not ready

The Central Bank of the UAE published its Guidance Note on Consumer Protection and Responsible Adoption of Artificial Intelligence and Machine Learning on 11 February 2026. Seven months later, the transitional window closes. Article 184 of the new CBUAE Law granted in-scope entities a one-year regularisation period expiring 16 September 2026, subject to Central Bank discretion to extend. Administrative fines under the consolidated banking, insurance and technology-enabler regime run up to AED 1 billion.

Scope is broad and deliberately so. Banks, insurance companies, exchange houses, finance companies and payment service providers all fall in. The Guidance Note requires each licensed financial institution to maintain a documented AI governance framework proportionate to its size, a comprehensive inventory of every AI model capturing purpose, risk classification and key metadata, board and senior management accountability for AI outcomes, security-by-design safeguards, and annual bias testing. The model inventory requirement aligns to the 2022 Model Management Standards, so firms that already run model risk management have a starting point. Most do not have that inventory extended to third-party and embedded AI.

That last point is where the gap sits. The Guidance requires board accountability for all AI systems deployed with no carve-out for third-party models. A UAE bank running a vendor fraud engine, a vendor KYC screening tool and an embedded LLM inside a CRM owns the governance for all three. The Guidance Note is framed as non-binding, which several institutions have read as optional. It is not optional in practice. It will form part of supervisory dialogue and regulatory assessment, and supervisors will ask for the inventory first because it is the cheapest thing to test.

The adoption numbers make the exposure concrete. Roughly 71 percent of UAE financial institutions have deployed or enhanced AI capability in the past year, placing the country among the world's top adopters. Emirates NBD alone has embedded AI across compliance, credit decisioning, and legal and regulatory support. High adoption plus a fixed deadline plus an untested inventory requirement is the definition of a supervisory finding.

Sources: Central Bank of the UAE, Khaleej Times, Pinsent Masons, Hadef & Partners

The AI model inventory is the entry point, not the endpoint. Firms that cannot produce a list of every model in production, with an owner and a risk class against each line, will fail the first supervisory question regardless of how good their policy document reads. Build the inventory from discovery, not from a survey of business units, because the shadow AI sitting inside SaaS products will not self-report. Anyone still treating 16 September as advisory should note that the regularisation deadline and the fine ceiling both sit in statute, and the Guidance Note is what supervisors will measure against. There are nine days. The realistic play now is a defensible inventory plus a dated remediation plan, not a finished framework.

🟡 Saudi Arabia stacks the AI Adoption Framework on top of an already enforcing PDPL

SDAIA's enforcement committees have now issued 48 decisions confirming PDPL violations across 2025 and 2026. The pattern is unglamorous and predictable: processing personal data without a valid legal basis, unauthorised disclosure, failure to implement technical and organisational safeguards, and marketing communications sent without consent. PDPL fines reach SAR 5 million. This is not a regime waiting to switch on.

The AI layer is now stacked on top. SDAIA's AI Adoption Framework, issued November 2025, creates governance obligations across data governance, model accountability, transparency, human oversight and risk management, and sits alongside the AI Ethics Principles and the 2024 Generative AI Guidelines. Any AI system processing personal data of Saudi residents must satisfy the PDPL and the AI Adoption Framework simultaneously. The Kingdom has designated 2026 the Year of Artificial Intelligence, which raises adoption velocity faster than governance maturity.

For multinationals running both markets, the practical problem is that the UAE and Saudi frameworks are structurally similar but not identical, and neither maps cleanly onto a single global AI policy written for the EU AI Act. Firms trying to run one framework across GCC and Europe are creating a documentation gap they will have to close under pressure.

Sources: Vision 2030 AI, SGC Consulting

Treat Saudi as an enforcement market, not a guidance market. Forty-eight decisions is a working committee, not a pilot. The commercially useful framing for a Saudi board is that the PDPL failures already being sanctioned are the same control failures that will surface under the AI Adoption Framework, so the remediation is shared. Build the data-level controls once, tokenisation and pseudonymisation at source, and both obligations get evidence from the same place.

🟡 DIFC Regulation 10 enforcement and the ISO 42001 national-adoption deadline both land this year

DIFC's revised Data Protection Regulations, issued September 2023, include Regulation 10 covering autonomous and semi-autonomous systems. DIFC has confirmed enforcement of Regulation 10 commenced early in 2026, and has told firms to be working towards certification of appropriate systems. ADGM maintains its own parallel framework. For a financial services firm operating in DIFC, that is three overlapping obligations: federal PDPL, the CBUAE Guidance Note, and DIFC Regulation 10.

ISO 42001 is becoming the default answer to all three. Published December 2023 and adopted across Europe as EN ISO/IEC 42001:2026, with 34 countries required to give it national-standard status by September 2026, it now provides the only widely recognised certifiable management system for AI. It maps well onto the CBUAE requirements for documented framework, inventory, accountability and testing, which is why UAE firms are reaching for it as evidence rather than building bespoke documentation.

DIFC is simultaneously pushing hard the other way. Its programme to become the world's first AI-native financial centre projects roughly 25,000 new jobs and AED 12.9 billion in economic benefit. The UAE has also announced a new federal AI and data authority under AI Minister Omar Sultan Al Olama to unify digital transformation, and a target of running 50 percent of government services through autonomous AI systems by 2028.

Sources: Waystone Compliance, Khaleej Times, Khaleej Times

ISO 42001 is the right lever, but only if it is scoped to the AI estate that actually exists. A certificate covering three sanctioned models while forty unsanctioned ones run in business units is worse than no certificate, because it documents the blind spot. Scope the management system to the discovered inventory. For DIFC-domiciled firms the sequencing is straightforward: inventory first, ISO 42001 scoping second, certification third, and Regulation 10 evidence falls out of the same work.

What UAE and Saudi Compliance Leaders Are Dealing With

The underlying shift is that AI governance in the Gulf has moved from ethics statements to inventories. Every framework now converging on the region, CBUAE, SDAIA's Adoption Framework, DIFC Regulation 10, ISO 42001, asks the same first question: what AI are you running, who owns it, and how risky is it. Firms that answered with a policy document are discovering that supervisors want a register.

The second pressure is speed mismatch. UAE government targets 50 percent autonomous services by 2028. DIFC is rebuilding itself as AI-native. Saudi has branded the year around AI. Adoption is being driven top-down at national-strategy pace while governance capacity is being built bottom-up at hiring pace. That gap is where the enforcement findings of 2027 are being created right now, and it is why discovery, not policy, is the binding constraint for most compliance teams in the region this month.

Three Things Worth Watching Next Week

1. 16 September CBUAE deadline and any extension signal - The Central Bank retains discretion to extend the Article 184 regularisation period. Watch for a formal statement in the days either side. Silence means the date holds.

2. First CBUAE supervisory requests post-deadline - Expect information requests targeting AI model inventories rather than framework documents. The shape of the first request tells the market what "compliant" actually means.

3. SDAIA enforcement decision count - The cumulative figure has been the clearest indicator of Saudi enforcement appetite. Any move past 48 in Q4, especially one citing AI-specific processing, signals the Adoption Framework has teeth.

Questions? hello@paringa.ai

Paringa builds AI governance evidence, not AI governance slideware, starting with discovery of the models and data flows that actually exist. Our Track A stack takes clients from AI inventory through data-level privacy controls to certifiable ISO 42001 scope. | 7 September 2026 | © Paringa Ltd