Saudi Data Localisation Draft Meets Post-Deadline UAE AI Scrutiny

Week of 26 October 2026 | Compiled by Team Paringa

AI governance in the UAE and KSA is moving from guidance to enforceable obligation, and this week's developments touch data residency, breach reporting and financial-sector AI oversight.

What Happened This Week

🔴 SDAIA proposes in-Kingdom data storage and tougher breach rules under the Saudi PDPL

Saudi Arabia's data regulator, SDAIA, has published draft amendments to the Implementing Regulations of the Personal Data Protection Law (PDPL). Public consultation runs from 6 October to 5 November 2026 via the Istitlaa platform. If approved, the amendments take effect 60 days after publication in the Official Gazette, so a final text could bite in early 2027.

The headline change is data localisation. Under the draft Article 23, controllers would have to store personal data inside Saudi Arabia, while transfers and disclosures abroad would remain possible under the PDPL's existing transfer rules. For any organisation running AI training data, analytics or SaaS platforms from regional or global clouds outside the Kingdom, this changes architecture and vendor choices, not just paperwork.

Breach notification tightens as well. Draft Article 24 would require notice to SDAIA of any breach, damage or unauthorised access with no harm threshold, while notice to data subjects would keep the existing harm test. Draft Article 25 widens impact assessment triggers to cover minors, large-scale or systematic monitoring, emerging technologies and automated decisions, which squarely captures most AI deployments. Registration with the National Register of Controllers would extend to controllers with core processing activities, those handling sensitive data and those transferring data abroad, and SDAIA requests would carry a 20 business day response window.

Sources: Clyde & Co, Reed Smith

The consultation closes in under two weeks, which is the last cheap moment to influence the text. Whether or not clients comment, they should start mapping where personal data and AI training sets actually sit today. Anyone with Saudi personal data in an out-of-Kingdom region has a re-architecture decision ahead. This is a direct opening for Databorn: automated discovery and classification of personal data across estates is the prerequisite for localisation, DPIAs and 72-hour style breach reporting. Lead conversations with a data-location map, not a policy review.

🟡 CBUAE regularisation window has closed: AI governance expectations for UAE financial institutions

The one-year regularisation period under the new CBUAE Law (Federal Decree-Law No. 6 of 2025, Article 184) ended on 16 September 2026, although the central bank can extend it at its discretion. Administrative fines under the law reach up to AED 1 billion. Article 62 also extends licensing scope to technology providers, APIs and decentralised platforms that enable licensed financial activity, pulling more of the vendor ecosystem into scope.

The CBUAE Guidance Note on Consumer Protection and Responsible Adoption of AI and Machine Learning, issued on 11 February 2026, is technically non-binding but is shaping supervisory dialogue. It expects documented AI governance frameworks with board accountability, a complete AI model inventory aligned to the 2022 Model Management Standards, annual bias testing, and outsourced AI contracts that include audit rights and the ability to cease use immediately. Note that these requirements are summarised from a vendor analysis (Kiteworks), so confirm against the primary CBUAE texts.

Sources: Kiteworks analysis of the UAE financial AI compliance stack

The deadline has passed, so the question for UAE banks and fintechs is now evidence, not intent. An AI model inventory and bias testing record are the first things a supervisor will ask to see. Offer a short readiness check against the Guidance Note, and pair it with ISO 42001 as the management system that makes the evidence repeatable.

What UAE and KSA Compliance Leaders Are Dealing With

The two markets are converging on the same demand from different directions. Saudi Arabia is tightening where data lives and how fast incidents are reported, while the UAE financial sector is turning principle-based AI guidance into supervisory expectation. In both cases the common failure point is visibility: most organisations cannot yet say which AI systems they run, what personal data feeds them, and where that data is stored.

That makes governance a data problem first and a policy problem second. Teams are being asked to produce inventories, impact assessments and breach evidence on timelines that manual spreadsheets cannot meet, and frameworks such as ISO 42001 are becoming the practical way to organise that work across PDPL regimes.

Three Things Worth Watching Next Week

1. SDAIA consultation close (5 November) — Expect law-firm and industry submissions on data localisation. Watch for any signal of carve-outs for cloud and cross-border AI workloads.

2. CBUAE supervisory follow-up — Any extension notice or first supervisory feedback after the 16 September window would show how strictly AI governance will be assessed.

3. ISO 42001 adoption announcements — Regional banks and government entities citing certification would indicate the standard becoming the default evidence route.

Questions? hello@paringa.ai

Paringa helps UAE and KSA organisations turn AI and data governance obligations into working controls, with Databorn as the data discovery and governance layer. We focus on evidence that stands up to regulators, not shelfware. | 26 October 2026 | © Paringa Ltd