A Practical AI Governance Framework for Saudi Arabia, the UAE and Jordan
An AI governance framework sets who decides on AI, which rules apply and how risk is tracked. This is a practical model for organisations in Saudi Arabia, the UAE, Jordan and the wider GCC.
An AI governance framework is the set of decision rights, policies, registers and controls that decides which AI your organisation uses, for what purpose and under whose accountability. For organisations in Saudi Arabia, the UAE, Jordan and the wider GCC, a workable AI governance framework has five parts: named decision owners, a short AI policy, an AI register with a risk register, a control set, and a review cycle. It takes its structure from ISO/IEC 42001 or the NIST AI Risk Management Framework and maps every AI use to the data protection law that applies to it.
Most organisations already own pieces of this: an IT approval process, a data protection officer, an information security policy. The framework connects them for AI, so that a new tool or model does not fall into the gap between them.
What does an AI governance framework include?
We build frameworks from five components. Each one answers a question that a board, a regulator or an auditor will eventually ask.
- Decision rights: who approves an AI tool, a use case, a model change and the residual risk.
- AI policy: what staff may and may not do with AI, in two or three pages, in Arabic and English.
- AI register and risk register: every AI system in use, its owner, the data it touches, and its risks with their treatment.
- Control set: the technical and procedural controls that apply, such as single sign-on, data loss prevention, human review and vendor contract terms.
- Assurance: monitoring, incident handling, internal audit and a regular management review.
The order matters. Controls bought before decision rights and a register exist tend to address the wrong risks.
Who decides? Setting decision rights for AI
Decision rights are the part most often missing. A regional bank may have a model risk committee but no owner for the generative AI tools that business units subscribe to; a family-owned retailer may have nobody at all. Write down who decides each of the following.
| Decision | Typical owner | Consulted |
|---|---|---|
| AI strategy and risk appetite | Board or executive committee | Chief executive, risk, legal |
| Approve a new AI tool or vendor | AI governance committee or CIO | Information security, data protection officer, procurement |
| Approve a high-risk use case | Executive sponsor, after an impact assessment | Legal, risk, the affected business owner |
| Accept residual risk | Named risk owner | Risk function |
| Suspend or retire an AI system | System owner and CISO | Business owner, communications |
Saudi Arabia's AI Ethics Principles describe similar roles inside entities, including a Responsible AI Officer who acts as the operational lead for responsible AI. Smaller organisations can combine roles, provided one named executive is accountable and the person who approves a use case is not the person who built it.
Which laws and rules shape AI governance in Saudi Arabia, the UAE and Jordan?
In all three countries, personal data protection law carries most of the binding obligations for any AI that processes personal data. Check your sector regulator as well: central banks, health authorities and telecommunications regulators add their own rules.
Saudi Arabia
The Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H, requires controllers to assess the impact of processing for their products and services (Article 22) and to notify the competent authority of any breach or illegal access (Article 20). The Implementing Regulations of the PDPL make that assessment written and documented in listed cases, including processing based on newly adopted technologies and decisions based on automated processing (Article 25). They also require explicit consent where a decision rests solely on automated processing, and notification of a breach within 72 hours where it may cause harm.
SDAIA's AI Ethics Principles are a policy document, not a statute, and state that they apply to anyone designing, developing, deploying or using AI systems in the Kingdom, including private and non-profit entities. They set seven principles: fairness; privacy and security; humanity; social and environmental benefits; reliability and safety; transparency and explainability; and accountability and responsibility. They also sort AI systems into four risk levels. Systems with little or no risk carry no restrictions, limited-risk systems are expected to apply the principles, high-risk systems call for conformity assessments before and after deployment, and systems with unacceptable risk are not allowed. The English edition on SDAIA's website is dated May 2025.
United Arab Emirates
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data has been in force since 2 January 2022, according to the UAE government portal. It requires consent for processing except in defined cases, gives individuals the right to correct their data and to restrict or stop processing, and sets conditions for cross-border transfers. The UAE Data Office is designated as the federal data regulator. The law has exclusions: free zones with their own data protection law, such as the Dubai International Financial Centre, sit outside it, and Article 2 also excludes categories such as government data and health, banking and credit data covered by their own legislation. Map each legal entity and data set to the regime that covers it. Many operational details of the federal law depend on executive regulations; confirm their current status with counsel rather than relying on secondary summaries.
Jordan
The Personal Data Protection Law No. 24 of 2023 was published in the Official Gazette on 17 September 2023 and took effect on 17 March 2024. The Ministry of Digital Economy and Entrepreneurship's published guidance gives 17 March 2025 as the date for full compliance. The law requires a data protection officer in listed cases, including processing of sensitive data or financial information and transfer of databases outside the Kingdom (Article 11). Where a breach is likely to cause severe harm, the controller must notify affected people within 24 hours and the ministry's data protection unit within 72 hours (Article 20). Individuals may object to processing and profiling that go beyond the purpose of collection or are discriminatory. The ministry also lists a guide on data protection impact assessment among its published guidance.
This is general information, not legal advice. Your obligations depend on your sector, the data you process and where your entities are registered.
ISO/IEC 42001 or NIST AI RMF: which structure should you use?
ISO/IEC 42001:2023, published in December 2023, specifies requirements for an AI management system: the policies, objectives and processes an organisation needs to develop, provide or use AI responsibly, run on a Plan-Do-Check-Act cycle. Independent certification bodies certify organisations against it; ISO itself does not certify anyone.
The NIST AI Risk Management Framework 1.0, released on 26 January 2023, is voluntary and organised around four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile (NIST AI 600-1) in July 2024 and says the framework is now being revised.
Our rule of thumb: use ISO/IEC 42001 as the management system if customers, regulators or a group head office may ask for a certificate, and use the NIST AI RMF as a risk vocabulary and checklist inside it. If you already hold ISO/IEC 27001, both standards follow ISO's harmonised management-system structure, so internal audit and management review can run as one integrated cycle covering both.
How to build the AI register and risk register
The register is where governance becomes concrete. List every AI system in use, including AI features inside software you already pay for, then add one risk entry for each material risk. A minimal template:
| Field | What to record | Example |
|---|---|---|
| AI system and use case | Name, vendor, business purpose | Meeting-notes assistant used by the sales team |
| Owner | One named person | Head of sales operations |
| Data classes | Highest classification of data entered or produced | Customer personal data |
| Legal triggers | Laws and sector rules engaged | PDPL impact assessment; transfer outside the Kingdom |
| Risk and rating | What could go wrong, likelihood and impact | Recordings stored abroad without a transfer basis; high |
| Controls | In place and planned | Enterprise licence, storage location confirmed in contract, retention limit, notice to participants |
| Review date | When the entry is next checked | Quarterly |
Rate risks with the method your enterprise risk function already uses. A separate AI scoring scale creates a second language that the board will not read.
A 90-day sequence to put the framework in place
- Days 1 to 15: name the accountable executive and the approval committee, and publish an interim acceptable-use note that lists the AI tools staff may use now.
- Days 15 to 45: build the AI register from staff surveys, single sign-on logs, procurement records and expense claims, and classify the data each system touches.
- Days 30 to 60: run impact assessments for the systems that trigger them under the data protection law that applies to each entity (the Saudi PDPL, the UAE decree-law or Jordan's law) or your sector rules, and fill the risk register.
- Days 45 to 75: approve the full AI policy and control set, and map controls to ISO/IEC 42001 and to your existing information security controls.
- Days 75 to 90: hold the first management review, agree the measures the board will see each quarter, and decide whether to pursue ISO/IEC 42001 certification.
A ministry with an established data management office will move faster on registers; a fast-growing company without a data protection officer will spend longer on roles. Adjust the dates, not the order.
How to start
If you do not yet know which AI tools your staff use or what data they share, start with our free AI Exposure Scan, a 45-minute conversation that ends in a written next step. When you are ready to build the framework, our AI Governance & Compliance Foundation covers policy, decision rights, AI and risk registers, PDPL alignment and ISO/IEC 42001 readiness. If you need senior ownership without a full-time hire, see the Fractional Chief AI Officer service. For regulator-specific questions, read our page on PDPL and regional regulators or browse the Governance Lab.
Frequently asked questions
What is an AI governance framework?
An AI governance framework is the set of decision rights, policies, registers and controls that decides which AI an organisation uses, for what purpose and who is accountable. A practical version has five parts: named decision owners, a short AI policy, an AI register with a risk register, a control set mapped to the applicable laws, and a regular review that reports to the board.
Do SDAIA's AI Ethics Principles apply to private companies in Saudi Arabia?
Yes. SDAIA's AI Ethics Principles state that they apply to all stakeholders who design, develop, deploy, use or are affected by AI systems in the Kingdom, including public, private and non-profit entities. They group AI systems into four risk levels, from little or no risk to unacceptable risk, and call for conformity assessments for high-risk systems. They are a policy document rather than a statute, so ask counsel how they apply to your sector.
Do we need ISO/IEC 42001 certification to have an AI governance framework?
No. ISO/IEC 42001 certification is voluntary. Many organisations use the standard as a structure for their AI governance without seeking a certificate. Certification makes sense when customers, regulators or a parent company ask for independent confirmation. If you may need it later, build your registers and records to the standard's requirements from the start.
How do data protection laws in the UAE and Jordan affect AI projects?
Most AI projects that process personal data fall under a data protection law, but which one depends on the entity, the sector and, in the UAE, whether the entity sits in a free zone with its own law. In the UAE, Federal Decree-Law No. 45 of 2021 covers consent, individual rights and cross-border transfers. In Jordan, Law No. 24 of 2023 adds data protection officer duties, 24- and 72-hour breach notices and a right to object to profiling. This is general information, not legal advice.
Who should own AI governance in a mid-sized company?
One named executive should be accountable, for example the chief operating officer, chief information officer or chief risk officer, supported by a small committee that includes information security, the data protection officer and legal. Companies without senior AI expertise in-house can use a fractional chief AI officer to run the portfolio and report to the board.
Get new insights by email
One email when we publish something useful. No spam; leave any time.
Services in this article
Related lab: Governance Lab ↗
