Does Your Company Need AI Governance in the UAE or Saudi Arabia? The 2026 Framework

Gulf companies are no longer asking whether to use AI. They are asking how to document and account for it. Three developments in 2026 made that question concrete.

🟢 14 June 2026 — UAE Federal Authority for AI and Data. A single body now consolidates the AI and Digital Economy office, the digital government sector at the telecom regulator, and the UAE Data Office, reporting to the Cabinet under Minister of State for AI Omar Sultan Al Olama.

🟢 February 2026 — CBUAE Guidance Note. Published in the central bank rulebook, it targets every licensed financial institution: banks, insurers, exchange houses and payment providers. It uses "should" language but carries strong supervisory expectation.

🟢 2026 — SDAIA National AI Risk Management Framework. One national methodology for identifying, assessing and monitoring AI risk, built on four pillars and a five-stage cycle scored on a 4×4 likelihood-impact matrix.

The requirements that surprise engineering teams

The CBUAE note is not a list of principles. Three clauses are engineering deliverables, not paperwork:

🟢 A model inventory — every model in production, with its name, purpose and risk rating 🟢 A kill switch — a real control that halts responses and scheduled jobs immediately 🟢 Human review — a defined path for when a person takes over an AI decision

Board-level accountability covers all three. Written policy without a working kill switch does not satisfy the requirement.

⚠️ Scope matters: these apply to licensed financial institutions today, not to ordinary retailers. But any supplier selling to Gulf banks can build the inventory and kill switch once and deliver them ready.

Katbi's view

We see the same pattern in Riyadh and Dubai projects. A client asks for a WhatsApp bot, then an API, then an app. Then procurement asks: what if a bank buys this? Nobody has the answer, because the build started without an inventory.

Governance is not a layer added at the end. It is how you build from day one. For most companies that means one central settings file instead of a PDF in a drawer, and audit rights in AI vendor contracts. Our managed AI agents are built on that basis.

Frequently Asked Questions

Do these rules apply to a small non-financial company?

Not directly today. But start the inventory and kill switch anyway. They cost a day of work and become a procurement requirement in at least one tender.

What is the difference between SDAIA and the CBUAE note?

SDAIA is a general methodology for any sector: system types, likelihood and impact scales. The CBUAE note is financial-sector guidance about operation: who approves, reviews and stops.

Is data protection separate from AI governance?

No. Data protection law governs whether you may use data and on whom. AI governance governs whether your system is safe and accountable.

Who approves the system before launch?

Under the CBUAE note, the board, not the technology team.

What about Qatar and Bahrain?

Qatar's central bank is the only one in the region with binding national AI rules. Bahrain's 38-article AI bill was not enacted as of July 2026.

How Katbi helps

📱 WhatsApp business bots — message logs, usage limits and opt-out 🤖 Managed AI agents — monitoring and incident response 📊 Audit-ready governance pack — inventory, risk classes, shutdown procedures

📱 Book a free AI governance consultation