Three regulatory regimes, one compliance window
The Central Bank of the UAE's AI Governance Guidance Note requires all licensed financial institutions to implement an AI governance framework by 16 September 2026 — covering model inventory, board accountability, and privacy-by-design, and aligned to the ISO 42001 AI Management Systems standard.
At the same time, Saudi Arabia's PDPL (Royal Decree M/19) and the Saudi NCA's Essential Cybersecurity Controls create parallel data privacy and security obligations for organisations operating in the Kingdom. UAE PDPL adds a further data protection layer for organisations holding UAE personal data.
Three separate regulatory regimes, arriving on overlapping timelines, all referencing the same underlying framework: ISO 42001. That overlap is the opportunity — a single, well-structured AI governance programme can satisfy all three at once.
| Regulation | Jurisdiction | What it requires |
|---|---|---|
| CBUAE AI Governance Guidance Note | UAE (financial institutions) | AI governance framework live by 16 Sep 2026 — model inventory, board accountability, privacy-by-design, ISO 42001 alignment |
| UAE PDPL | UAE | Federal data protection law — GDPR-equivalent obligations for any organisation holding UAE personal data |
| Saudi PDPL | Saudi Arabia | Royal Decree M/19 — data privacy obligations enforced by SDAIA |
| Saudi NCA Essential Controls | Saudi Arabia | Baseline cybersecurity controls for organisations operating in the Kingdom |
| ISO 42001 | International | AI Management Systems standard — referenced by CBUAE and Saudi regulators as the implementation framework |
Why speed matters
A 12-month compliance programme is the wrong pace for a deadline that's now inside a single financial year. Paringa, Databorn, and CNS scope Middle East AI governance engagements specifically for speed: gap assessment through to a board-ready remediation report, typically in under 60 days.
- Regulatory gap analysis. Mapping the AI and data landscape against CBUAE guidance, UAE/Saudi PDPL, and ISO 42001 controls — gaps prioritised by regulatory severity and deadline.
- Track A framework deployment. Paringa's six-layer AI governance stack configured to the client's environment and applicable regulations.
- Data protection foundation. Skyflow's PII tokenisation layer provides the technical control that underpins both UAE and Saudi PDPL compliance.
- Board-ready compliance report. A regulator-ready report with a prioritised remediation roadmap, ready for submission to the Central Bank or presentation to the board within the regulatory deadline.
Delivered in market, by partners who know the region
Databorn is Paringa's UAE and Saudi Arabia AI and data systems integration partner, combining a Builder and Protector delivery model to implement AI governance frameworks on the ground. Learn more about Databorn →
CNS Middle East, part of the Ghobash Group, is one of the UAE's leading systems integrators, delivering cybersecurity and digital transformation across the GCC since 1990, with ISO 42001 lead implementer capability on staff. Learn more about CNS →
Both partners work under Paringa's Track A framework and regulatory mapping — giving GCC clients a single commercial relationship, local delivery capability, and international governance standards, together.
Frequently asked questions
What is the CBUAE AI Governance Guidance Note deadline?
The Central Bank of the UAE's AI Governance Guidance Note requires all licensed financial institutions to implement an AI governance framework by 16 September 2026. It covers model inventory, board accountability, and privacy-by-design, and is aligned to the ISO 42001 AI Management Systems standard.
Does Saudi Arabia have equivalent AI or data privacy requirements?
Yes. Saudi Arabia's PDPL (Royal Decree M/19) governs data privacy, and the Saudi NCA's Essential Cybersecurity Controls set baseline security requirements. Both create compliance obligations that run alongside AI governance work for organisations operating in the Kingdom.
What is ISO 42001 and why does it matter for UAE and Saudi Arabia compliance?
ISO 42001 is the international AI Management Systems standard. Both CBUAE and Saudi regulators reference it as an implementation framework, so building an ISO 42001-aligned AI governance programme gives an organisation a structured, certifiable path that satisfies both UAE and Saudi regulatory expectations at once.
How quickly can an organisation become compliant before the CBUAE deadline?
Paringa, with Databorn and CNS, scopes engagements for speed — typically gap assessment through to a board-ready remediation report in under 60 days, rather than the 12-month timelines a generic compliance programme might assume.
Who delivers Paringa's Middle East AI governance work?
Databorn (UAE and Saudi Arabia AI and data systems integration) and CNS Middle East (part of the Ghobash Group, GCC systems integration since 1990, with ISO 42001 lead implementer capability) deliver in-market implementation. Paringa provides the Track A framework, regulatory mapping, and board-ready reporting.