UAE AI Governance: Policies Exist, Enforcement Does Not

UAE AI Governance: Policies Exist, Enforcement Does Not

Week of 2 November 2026 | Compiled by Team Paringa

Regulators in the UAE and Saudi Arabia are setting expectations for AI governance faster than most organisations can evidence them. This week's signal is about enforcement inside the business, not just policy on paper.

What Happened This Week

🔴 UAE organisations have AI policies, but enforcement lags

On 28 October, Security Middle East Magazine reported findings from Delinea's 2026 Identity Security Report, conducted by Censuswide. The survey covered 2,004 IT and security leaders across seven countries at organisations with 500+ employees using or piloting AI, including 251 respondents in the UAE. This is vendor-reported research and we have not found independent corroboration, so treat the figures as directional.

According to Delinea, 98% of UAE respondents reported confirmed or suspected AI tools accessing sensitive data beyond what their tasks required (87% globally). All UAE respondents said they have a formal AI data access policy, but only 59% said it is actively enforced. 70% did not detect their latest excessive AI access instance in real time or within 24 hours, and only 16% could immediately revoke an AI tool's credentials and end its session.

This matters because the CBUAE's Guidance Note on Consumer Protection and Responsible Adoption of AI and Machine Learning, issued on 11 February 2026, expects licensed financial institutions to keep an AI inventory, board-level oversight, drift monitoring and meaningful human oversight of high-impact decisions. The note is described by law firms as non-binding, but expected to inform supervisory dialogue. A gap between written policy and runtime control is exactly what a supervisor would probe.

Sources: Security Middle East Magazine, Hadef & Partners, Kiteworks (vendor)

If your AI governance evidence is a policy PDF, it will not survive a supervisory question about who authorised a given AI access and how fast you can revoke it. Start with an AI inventory, a named human owner per AI system, and a tested kill switch. Those three items map directly onto the CBUAE note and onto ISO 42001 controls, so the work counts twice.

🟡 The UAE's AI regulator is new, and PDPL rules are still missing

The UAE announced an Artificial Intelligence and Data Authority in mid-June 2026. Gulf Business reports it reports directly to the Cabinet, is chaired by Minister of State for AI Omar Sultan Al Olama, and absorbs the Office of AI, the TDRA's digital government sector and the UAE Data Office. Al Tamimi notes it is not yet clear whether it has rulemaking, supervisory or enforcement powers.

Meanwhile, a commercial company-formation firm's August analysis says the UAE PDPL's Executive Regulations had still not been issued, citing Chambers, and that it could trace no published enforcement decision. That is a single non-regulator source, so verify against official channels before relying on it. The practical result is a regime where obligations exist but the enforcement shape is unclear.

Sources: Gulf Business, Al Tamimi, Business Dubai (commercial)

Uncertainty is not a reason to wait. Build to the stricter of CBUAE, PDPL and ISO 42001 now, and you will absorb whatever the new Authority issues without a rebuild.

🟡 Saudi SDAIA is enforcing PDPL, not just advising

A March 2026 compliance-vendor article reports that SDAIA's enforcement committees issued 48 formal decisions during 2025, with common violations including processing without a lawful basis, weak transparency and unlawful marketing. This is a single secondary source, vendor-reported and uncorroborated, and it gives no fine amounts.

Sources: Captain Compliance (vendor)

Saudi is the market where "we will deal with it when asked" is the riskiest posture. Map your KSA processing activities, lawful bases and notices before an investigation does it for you.

What UAE and KSA Compliance Leaders Are Dealing With

The shift is from writing AI policy to proving control. Regulators and surveys are converging on the same questions: which AI systems do we run, who owns each one, what data can they reach, and can we stop them quickly.

At the same time the regulatory map is moving. The UAE has a new AI authority with undefined powers and PDPL rules still pending, while Saudi appears further into enforcement. Teams serving both markets need one control framework mapped to several regimes, not several parallel programmes.

Three Things Worth Watching Next Week

1. UAE AI and Data Authority mandate — Any publication of its powers or first guidance would change how PDPL and AI obligations are supervised. 2. CBUAE supervisory signals — Watch for follow-up on the AI Guidance Note, and whether any general extension to the new CBUAE Law reconciliation period (due mid-September) is announced. 3. SDAIA enforcement and accreditation updates — Further PDPL decisions or published guidance would confirm the direction of travel.

Could not verify: The Delinea survey figures, the SDAIA "48 decisions" figure and the PDPL regulations status rest on single vendor or commercial sources; no new CBUAE, SDAIA or UAE Data Office primary publications from 26 Oct to 2 Nov were found, and zawya.com could not be accessed.

Questions? hello@paringa.ai

Paringa helps GCC organisations turn AI governance requirements into evidenced, auditable controls across the UAE and KSA. | 2 November 2026 | © Paringa Ltd