CBUAE Deadline Passes, SDAIA Enforcement Bites: UAE and KSA AI Governance Moves from Policy to Proof

Week of 5 October 2026 | Compiled by Team Paringa

The UAE and Saudi Arabia are both past the guidance stage on AI and data governance, and regulators are now looking for evidence. This week's brief covers where the deadlines and enforcement actually sit.

What Happened This Week

🔴 CBUAE regularisation deadline passes, with the AI guidance note underneath it

The one-year regularisation window under Federal Decree-Law No. 6 of 2025 (the new CBUAE Law, in force from 16 September 2025) closed on 16 September 2026. According to analysis from Kiteworks, it applies to licensed financial institutions and to technology providers, APIs and platforms that enable licensed financial activities under Article 62, with administrative fines of up to AED 1 billion for non-compliance. We have taken the penalty figure from that analysis and not from the law itself, so treat it as indicative until checked against the text.

Sitting beneath that deadline is the CBUAE's guidance note on AI and machine learning. Khaleej Times reported it on 23 February 2026 (Kiteworks dates the note to 11 February). It expects documented AI governance proportionate to scale, direct board and senior management accountability, a maintained inventory of AI models with regular performance reporting, bias testing, disclosure of AI interactions, a route to human review of automated outcomes such as lending decisions, privacy by design, and due diligence and contractual safeguards for third-party AI providers. Governor Khaled Mohamed Balama described it as establishing "a clear framework for the responsible use of artificial intelligence and machine learning".

The practical point is that the AI note does not carry its own separate implementation date in the coverage we reviewed. It is being read alongside the wider compliance stack Kiteworks describes: the UAE PDPL, the 2022 CBUAE Model Management Standards and DIFC Regulation 10 on AI. For a bank or insurer, "we are compliant" now has to be demonstrable across all of those at once. An AI inventory, model ownership at board level and a third-party register are the three artefacts a supervisor can ask for first.

Sources: Khaleej Times | Kiteworks

The deadline has gone, so the conversation with UAE financial clients has changed from "are we ready" to "show me". Most will have a policy; fewer will have a live AI inventory tied to named owners and data lineage. That gap is where Databorn's governance tooling earns its place, and it is the opening question we would put to any LFI CISO or CDO this month: can you produce your model inventory and third-party AI register within a day if the supervisor asks?

🟡 Saudi PDPL enforcement is live and reaches foreign firms

A 5 September 2026 analysis from ComplianceHub reports that SDAIA had issued 48 decisions confirming violations by data controllers by January 2026. The maximum administrative penalty is SAR 5 million per violation, doubled for repeat offences, and unlawful disclosure of sensitive data with intent to harm or for personal gain carries up to two years' imprisonment and/or a SAR 3 million fine. Full enforceability began on 14 September 2024 and grace periods have closed.

The scope is wide: the law applies to any entity processing data of individuals resident in the Kingdom, with no establishment test and no de minimis exception. Proceedings run through a platform that requires an authorised Saudi representative with proof of authority. The same source cites a five-day response window, drawn from law-firm commentary on SDAIA's procedural rules; we could not verify that against official English text.

Sources: ComplianceHub

A five-day window, if accurate, is not enough time to start discovering where personal data lives. Organisations serving Saudi residents from outside the Kingdom are the most exposed, because they often have no local representative and no data map. Lead with data discovery and a named representative, then layer governance on top.

🟡 UAE consolidates AI and data oversight; DIFC tightens AI rules

On 14 June 2026, Gulf News reported Sheikh Mohammed bin Rashid Al Maktoum's announcement of a Federal Authority for Artificial Intelligence and Data, led by Omar Sultan Al Olama and reporting to the Cabinet. It absorbs the UAE Artificial Intelligence Office, the Information and Digital Government Sector of the TDRA, and the Emirates Data Office, with a mandate covering national AI strategy, government data quality and sharing, and standards for data, AI and digital transformation.

Four days later Gulf News covered a 30-day DIFC consultation (Consultation Paper No. 3 of 2026, closing 18 July) on amendments to the Data Protection Regulations. It refines Regulation 10 around safe, ethical and privacy-by-design AI, adds a Regulation 11 allowing the Commissioner to recognise accreditation and certification frameworks, and defines an Autonomous Systems Officer role. These are not this week's news, but they set the direction for what comes next.

Sources: Gulf News | Gulf News

Recognition of certification frameworks is the signal to watch, as it points towards independent assurance of AI management systems rather than self-attestation. Firms that start building evidence now will be better placed when the final DIFC rules and any federal standards land.

What Data & AI Leaders Are Dealing With

The shift across both markets is from policy to evidence. In the UAE, the regulatory stack is layered (central bank law, AI guidance, PDPL, DIFC rules) and a new federal authority is consolidating the people who set standards. In Saudi Arabia, enforcement is already producing decisions. Data and AI leaders are being asked the same practical questions by different regulators: what AI do you run, on what data, who owns it, and which vendors touch it.

The constraint is rarely intent. It is that inventories, lineage and vendor registers were built for IT asset management, not for explaining an automated decision to a customer or a regulator. Closing that gap is mostly an operating-model problem and only secondarily a tooling one.

Three Things Worth Watching Next Week

1. Supervisory follow-up after 16 September — Watch for CBUAE statements or sector circulars on how the regularisation period is being assessed. We found nothing published yet and will report if it appears.

2. SDAIA enforcement notices — Any further published violation decisions, or guidance on foreign controllers and the authorised representative requirement.

3. DIFC and federal AI rules — Whether the amended DIFC Data Protection Regulations are finalised, and what the new Federal Authority issues first.

Could not verify: We found no UAE or KSA AI-governance story dated within the last seven days from the named outlets, so the lead items are from the preceding weeks and months and are labelled by date. The AED 1 billion fine and the five-day SDAIA response window come from secondary commentary, not official texts. The date of the CBUAE AI guidance note differs between sources (11 versus 23 February). We did not verify any ISO 42001-specific regulatory development, and coverage of CBUAE actions after 16 September was not found.

Questions? hello@paringa.ai

Paringa helps Gulf organisations turn AI and data regulation into evidence they can show a supervisor. Our partnership with Databorn brings practical governance tooling to that work. | 5 October 2026 | © Paringa Ltd