Regulatory And Sovereignty
In this region, AI governance stopped being good practice and became a supervisory expectation. The UAE Central Bank has written down what it expects of every licensed financial institution. Saudi PDPL has been enforced since 2024. SAMA requires sensitive data to stay in the Kingdom.
Most organisations cannot currently produce the evidence any of this asks for. That gap is the work.
THE OBLIGATIONSWhat Is Actually Required, And By Whom
CBUAE Guidance Note
Issued 11 February 2026. Documented AI governance proportionate to size and complexity, a comprehensive model inventory, regular bias stress testing, Arabic and English disclosure of AI-assisted decision logic, defined human oversight, and third-party due diligence. Non-binding, but examinable.
UAE PDPL Article 18
Restricts decisions made solely by automated processing where they carry legal or similarly significant effects. Credit scoring, hiring, eligibility and fraud decisions sit squarely inside this. The executive regulations remain unpublished, and publication starts a six-month clock.
HOW WE CLOSE ITA Governance Gap Assessment
We start where the guidance starts: what AI is actually in use, who owns it, and what it decides. In most organisations this list has never been written down, and assembling it is the single most useful week of the engagement.
Every model, agent and vendor feature in use across the business, including the ones procurement never saw because they arrived inside a product someone already licensed.
Which systems make or materially influence decisions about people and money. That is the line Article 18 draws, and it determines which controls are mandatory rather than advisable.
Bias and performance testing, documented and repeatable, on the models that carry decision weight — designed so the same test can be re-run after material change rather than rebuilt.
Human in the loop, on the loop or out of it, chosen deliberately per process. Then the disclosure language in Arabic and English, the audit trail, and the vendor clauses that make the third-party accountability real.
WHY THIS MATTERS COMMERCIALLYSovereignty Is A Sales Argument, Not Just A Control
Data residency is now hard law in the segments that pay. That is also why we built Ace and Cue to deploy inside the customer’s own cloud account rather than as multi-tenant SaaS — a regulated buyer here often cannot use the global platforms at all, whatever the feature comparison says.
One caution we would rather state than sell around: Arabic language capability is commoditising quickly. Open-weight Arabic models are freely licensed and the Saudi models now ship on major cloud platforms. Arabic will be table stakes. What stays durable is the evidence layer — being able to show a regulator a documented residency architecture, a model inventory, a bias-test record and a human oversight design.
