The Middle East’s Big Bet on Artificial Intelligence and Data Security

The states of the Persian Gulf are moving rapidly to establish themselves as global centers of investment and innovation in artificial intelligence (AI). The Kingdom of Saudi Arabia, the United Arab Emirates (UAE), and the State of Qatar are making substantial outlays in technology and infrastructure as they seek to diversify their economies away from oil. As important, their governments are implementing digital regulations and AI strategies in a bid to attract foreign investment and develop technology companies that can go toe-to-toe with American and European competitors. 

While Gulf countries face significant challenges in achieving their AI and digital development goals, they are making considerable progress, due in part to early public-private initiatives and clear and decisive policy leadership, with important implications for the development of the tech industry.

I. From Oil Rigs to Data Centers 

Gulf nations are investing heavily in AI. Technology spending in the Middle East and North Africa (MENA) region will reach $169 billion in 2026, according to Gartner forecasts.

Saudi Arabia
This trend dates back several years. For example, in 2024, Saudi Arabia announced plans to earmark a $40 billion fund for investing in AI technology, including semiconductor manufacturers, data centers, and AI companies. 

And in May 2025, Qualcomm and HUMAIN, a company backed by Saudi Arabia’s sovereign wealth fund, the Public Investment Fund (PIF), signed a memorandum of understanding to deliver to the region advanced AI data centers, hybrid AI across edge devices and cloud infrastructure, and AI services. Qualcomm also announced plans to work with the Kingdom’s Ministry of Communications and Information Technology to establish a design center to nurture the Saudi semiconductor ecosystem and foster local engineering talent. The collaboration between an American hyper-scaler and a Saudi company delivering full-stack AI capabilities will likely further position the Kingdom as an emerging AI leader.

Also in May 2025, Google Cloud and the Kingdom’s PIF announced the advancement of a $10 billion partnership to build and operate a global AI hub in Saudi Arabia with HUMAIN, originally discussed in the autumn of 2024.  The AI hub will bring Google’s AI technology and cloud infrastructure to the Kingdom.  

UAE

The UAE is likewise investing heavily in a massive data center cluster as part of a “Stargate” project, with support from OpenAI, NVIDIA, and other U.S. companies. A UAE-supported company called G42, which operates dozens of data centers across the Emirates, is building infrastructure for Stargate. As part of this partnership, UAE and OpenAI reached an agreement for OpenAI to provide nationwide access to ChatGPT Plus for all residents of the Emirates, making the UAE among the first nations in the world to enable ChatGPT access nationwide.

The UAE’s state-owned investment firm Mubadala is supporting G42 and MGX, a technology investment venture focused on investing to accelerate the development and deployment of AI through partnerships in the UAE and globally.  Mubadala concentrates on AI infrastructure, semiconductors, and core AI technologies and applications, including AI models, software, data, life sciences, and robotics. 

In September 2024, BlackRock, Global Infrastructure Partners, Microsoft, and MGX inaugurated a new AI partnership to invest in data centers and power infrastructure with a potential for $100 billion investment in the United States and abroad.

And in May 2025, the White House announced that it would allow the UAE to gain access to hundreds of thousands of the most advanced semiconductors to support an AI campus in Abu Dhabi built by G42 in partnership with U.S. firms. The project would expand upon an agreement between the countries called the “U.S.-UAE AI Acceleration Partnership,” according to the Trump Administration.

Qatar

Qatar, too, is developing AI infrastructure with regional enterprises and global corporations in an attempt to vary its economy and workforce.

In May 2024, the Qatari government earmarked $2.5 billion to boost its digital transformation program. The Qatari Prime Minister also launched  a “Al-Fanar” AI project to gather data to support Arabic-language AI-powered linguistic tools.

The Qatar Investment Authority (QIA) has said it will prioritize investments in AI-related fields, including data centers, data categorization, software applications, and semiconductors. Ooredoo, the Qatari multinational telecommunications company, secured in September 2024 $500 million in financing to speed the expansion of its data center and AI work, with plans to construct 120 megawatt data center capacity in five years. “The company also has an ongoing partnership with Nvidia to develop AI-ready platforms for its clients across MENA,” according to the International Monetary Fund.

II. A Diversity in Data Protection Rules 

With the surge in digital and AI investments, Saudi Arabia, the UAE, and Qatar have actively worked to strengthen their digital policy frameworks to create predictable and trustworthy environments for foreign investors. These efforts align closely with the states’ national strategies, including Saudi Vision 2030 and the UAE Digital Economy Strategy,  which place digital transformation and data-driven industries at the core of their economic diversification.

A key part of these strategies is the development of data protection regimes. These regimes include proactive approaches to implement comprehensive privacy frameworks to protect citizens’ personal data while also fostering trust and credibility among global businesses and investors.

In 2016, Qatar was the first country to enact such a regulation, Law No. 13, which was later supplemented by Executive Regulations in 2021 and enforced by the National Cyber Security Agency. Saudi Arabia followed suit with its Personal Data Protection Law in September 2021 (amended in March 2023), enforced by the Saudi Data & Artificial Intelligence Authority. And the UAE enacted its Federal Personal Data Protection Law in November 2021, enforced by the UAE Data Office.

These frameworks largely align with international best practices, particularly the European Union’s General Data Protection Regulation (GDPR). They share foundational principles related to data subject rights and data processing.

However, there are several salient differences among the regimes, particularly with respect to data localization requirements, the legal basis for processing data, and the complexity of their regulatory environments.

For example, Saudi Arabia’s Personal Data Protection Law imposes strict data localization obligations, requiring businesses operating within the Kingdom to store personal data domestically, with cross-border transfers permitted only under specific conditions and approval. The Personal Data Protection Law also lacks implementing guidelines that preserves uncertainty for business leaders. For example, the GDPR affords organizations a specialized alternative to seeking consent for processing personal data if there is a “legitimate interest” to process the data, and the European Data Protection Board has issued guidelines on how that provision shall be interpreted by Data Protection Authorities. Saudi Arabia, after omitting a “legitimate interest” legal basis from its original Personal Data Protection Law, has adopted a revised version that permits data controllers to use such a legal basis for processing non-sensitive data, but the law lacks specific guidelines on how to implement it.

NEOM, the futurist and technology rich urban development in northwest Saudi Arabia, has been established as a special economic zone (SEZ) to attract global investment and innovation. As an SEZ, NEOM operates under a distinct regulatory framework that differs from broader Saudi law, enabling tailored governance, business incentives, and streamlined administrative processes. NEOM’s approach prioritizes digital transformation, with regulations designed to foster emerging technologies, including AI and advanced data-driven solutions. Relevant digital regulations within NEOM include robust data protection standards that align with international practices, aiming to safeguard personal and commercial data while promoting responsible AI development. Its regulatory environment encourages transparency, ethical AI use, and secure digital infrastructure, positioning NEOM as a forward-thinking hub for technology and sustainable growth.

An additional layer of regulatory complexity arises from the interaction between federal laws in the Gulf and the independent regulatory frameworks governing such Gulf state-run financial free zones. For example, the Dubai International Financial Centre (DIFC), the UAE’s financial hub focused on banking and capital markets, and the Qatar Financial Centre (QFC), a global business and financial hub, operate under common law systems, separate from the federal legal frameworks of the UAE’s and Qatar’s mainland. These free zones have developed their own comprehensive data protection regimes, often with distinct rules and obligations. The zones’ respective regulators carry out oversight in these zones and typically enforce compliance more stringently than the mainlands to maintain international credibility and competitiveness. Notably, in places such as the DIFC, QFC, and the Abu Dhabi Global Market (a distinct Emirati international financial center and free economic zone), English common law prevails, incentivizing many U.S. and UK companies to establish offices within these zones.

Distinctions between the laws of the SEZs, financial centers, and the mainlands present unique challenges, particularly for businesses operating under concurrent regulatory frameworks. An opportunity for further alignment and consolidation across the Gulf on data protection laws may be afforded by the upcoming48^thannual Global Privacy Assembly, which is due to be hosted in the fourth quarter of 2026 by Dubai and the DIFC. This hosting opportunity – the first of its kind in the region – not only recognizes the Gulf’s ascendance and relevance within global data protection circles but also acknowledges the value of the DIFC’s own recent regulatory innovation, particularly in the context of AI governance.

III. AI Strategies Pursue Innovation and Ethical Development

Alongside privacy reforms, Saudi Arabia, the UAE, and Qatar have been increasingly focused on developing AI governance standards in a bid to harness AI’s potential and position themselves as leading players in the global AI race.

These ambitions are reflected in each country’s AI strategy:  the UAE’s National Strategy for Artificial Intelligence 2031, Saudi Arabia’s National Strategy for Data and Artificial Intelligence, and Qatar’s AI Strategy and its National Vision 2030.

A central focus of these strategies is balancing innovation with ethical development and deployment, while ensuring alignment with international standards and national, cultural, and religious values. To achieve this balance, Gulf countries have largely adopted a “soft law” approach, focused on guidelines and ethical principles.

The UAE and Saudi Arabia stand out as early leaders in this space.

In December 2022, the UAE introduced the AI Ethics Principles and Guidelines to promote the ethical use, development, and deployment of AI systems, followed in June 2024 by the Charter for the Development and Use of AI, which sets out twelve principles for ethical and inclusive implementation. The UAE also became the first country to create a dedicated AI ministry, appointing a Minister of State for AI in 2017.

Similarly, Saudi Arabia issued the Principles of AI Ethics in September 2023. In January 2024, the Kingdom’s Data and Artificial Intelligence Authority released Generative AI Guidelines that provided non-binding advice to government entities and the public. In parallel, the Saudi Authority for Intellectual Property released a draft Intellectual Property Legislation in April 2023 for comment to address ownership and rights related to AI-generated works.

Qatar, meanwhile, has concentrated its AI governance efforts on risk management, primarily through its Guidelines for Secure Adoption and Usage of Artificial Intelligence (February 2024), which provide a framework to manage AI-related security risks. In April 2024, the Qatar Central Bank (QCB) issued mandatory AI guidelines, requiring financial entities to implement strict AI governance and risk management frameworks and to obtain prior approval from the QCB from all high-risk AI systems.

Across the region, governments are also weaving AI considerations into existing data protection regimes to safeguard privacy. For example, in 2023, the Dubai International Financial Centre amended its Data Protection Regulation to explicitly cover AI applications by enacting Regulation 10, the first regulation in the Middle East addressing autonomous AI systems.

Gulf states are focused not only within their borders but also without, embracing international standards and multilateral organizations to position themselves as active players in global AI governance.

Saudi Arabia has been especially prominent. In September 2024, the country partnered with the Organization for Economic Cooperation and Development (OECD) to launch the AI Policy and Incident Observatory for the Middle East. Additionally, the country adopted the OECD’s Recommendation on Artificial Intelligence, becoming one of ten non-OECD member states to embrace the global standard. Saudi Arabia also hosted the first Global AI Summit in Riyadh in 2020 and the third in 2024, convening international leaders across government, industry, and academia.  

Qatar, meanwhile, participated in the Global Forum on AI Safety in South Korea in May 2024,  held under the theme “Building on the AI Safety Summit: Towards an Innovative and Inclusive Future.” The Qatari delegation engaged in discussions with major technology companies and took part in a high-level roundtable on “Sharing the Benefits of AI and Enhancing Inclusivity of Governance Framework.” 

In March 2025, the UAE participated in the Global Conference on AI, Security, and Ethics and hosted the World Governments Summit in Dubai, where it led an international dialogue on the role of AI in governance.  

Finally, the Kingdom of Bahrain deserves special notice. While a small market, it hosts a strong American and British presence and has also established an AI strategy that focuses on responsible adoption within a comprehensive ethical and legal framework that emphasizes human oversight, data, privacy, fairness, and transparency. It, too, aims to be a leader in the Gulf for the responsible and ethical adoption of AI.

*

The Middle East is rapidly emerging as a major center for AI development, due in large measure to generous investments in AI and digital infrastructure, complex data protection rules, and ambitious AI strategies that mix international engagement with domestic particulars. As these nations seek to position themselves as global AI leaders, we anticipate their ongoing engagement in international forums, as well as their continued efforts to cooperate with global standards and initiatives. Companies both rooted in the region and wishing to do business there face a complicated path with the potential for substantial returns.