Sovereign AI in the UAE and the Gulf: what it means for your company

Sovereign AI has moved from conference keynotes to cabinet decisions. The UAE has created a national AI and data authority. Saudi Arabia has declared 2026 the Year of AI. Both are building gigawatt-scale AI infrastructure at home, and both have homegrown Arabic models.

This guide explains what sovereign AI is, what is driving it in the Gulf, and what it means for a company in Dubai or the wider region. The short version: the direction of travel is data and AI staying under local control, and your company can act on that today with on-premise AI. This is general information, not legal advice.

What is sovereign AI?

Sovereign AI is the ability to develop and run AI on infrastructure, models and data that a country, or an organisation, controls itself. For a state, that means data centres on its own soil, models its own institutions built, and rules that decide where data may go. For a company, it means the same idea at a smaller scale: AI running on hardware you own, on your own network. That company-level version is usually called private AI.

Four layers make up the stack:

• Rules. Data protection laws that set where personal data may be stored, processed and transferred.
• Compute. Data centres and GPU capacity inside the country, rather than rented exclusively abroad.
• Models. Homegrown or open-weight models that can run anywhere, including in Arabic.
• Data. The documents, records and prompts themselves, and who controls them.

Gulf states are now investing in all four layers at once.

Why are Gulf states investing in sovereign AI?

The UAE

The UAE was the first country to appoint a Minister of State for Artificial Intelligence, in 2017, alongside a national AI strategy that the UAE Government describes as the first of its kind in the world. In June 2026, Sheikh Mohammed bin Rashid approved the establishment of the Artificial Intelligence and Data Authority, a single national body for data, AI and digital government that merges the Office of AI, the digital government sector of the TDRA and the UAE Data Office.

On the compute layer, the G42-led Stargate UAE project, announced in May 2025, plans a one-gigawatt compute cluster in Abu Dhabi, built with US technology partners inside a proposed five-gigawatt UAE–U.S. AI campus, the largest such deployment outside the United States. At the launch, Oracle’s Larry Ellison called it “a new standard for digital sovereignty”, and SoftBank’s Masayoshi Son said the UAE “becomes the first nation beyond America to embrace this sovereign AI platform.” By September 2026, Reuters reported that the UAE was revising the campus design towards a distributed, hardened network of data centres across the country, a reminder that sovereignty includes physical resilience. Abu Dhabi’s AI investment firm MGX, meanwhile, closed a US$49 billion AI fund in July 2026, one of the largest ever raised.

On the model layer, Abu Dhabi’s Technology Innovation Institute and the G42 ecosystem have released open-weight models since 2023, including Arabic-first models trained on native Arabic data rather than translations. These are open-weight models: organisations can download the weights and run them on their own servers.

Saudi Arabia

Saudi Arabia anchors its programme in SDAIA, the national data and AI authority, which is also the Kingdom’s data protection regulator. In May 2025, Crown Prince Mohammed bin Salman launched HUMAIN, a PIF company that operates across the AI value chain. Its launch announcements describe AI “factories” with a projected capacity of up to 500 megawatts and several hundred thousand GPUs over five years, part of a national target of about 1.5 gigawatts of AI infrastructure by 2030; the Saudi Press Agency counts HUMAIN’s data centres among the Kingdom’s flagship AI projects. SDAIA’s National Center for AI built ALLaM, the Kingdom’s Arabic large language model, and HUMAIN now carries it forward. The Cabinet has designated 2026 the Year of Artificial Intelligence.

Qatar and the wider Gulf

Qatar launched Fanar, a state-backed Arabic AI platform developed by the Qatar Computing Research Institute, in December 2024, and Reuters reported a US$20 billion AI infrastructure joint venture between Brookfield and the Qatari company Qai in December 2025. Bahrain adopted a National Policy for AI in July 2025, Kuwait has drafted a national AI strategy, and Oman published its National AI Policy the same year.

The pattern is consistent: rules, compute, models and money, all moving towards national control.

What do Gulf data protection laws require?

The legal picture is uneven, and that is the point: whatever regime you sit under, control over where your data lives is what the rules turn on.

The UAE, in depth

The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in force since January 2022, but its executive regulations had still not been issued as of late September 2026, according to Chambers’ practice guide, which notes limited enforcement activity so far. The new Artificial Intelligence and Data Authority absorbs the UAE Data Office, so federal enforcement may consolidate. In the financial free zones the picture is firmer: the DIFC amended its Data Protection Law in July 2025 to strengthen enforcement, including a private right of action before the DIFC courts, and the ADGM’s regime carries fines of up to US$28 million. Health data is the strictest case: federal law generally does not allow health information to be stored or processed outside the UAE. We cover these regimes in detail in our guide to private AI and UAE data privacy.

Saudi Arabia

The Saudi PDPL, Royal Decree M/19 of 2021 as amended in 2023, has been fully enforceable since September 2024. Its transfer regulation, in force since September 2024, lets personal data leave the Kingdom only where the destination offers adequate protection, assessed by SDAIA, or where appropriate safeguards and a documented risk assessment exist, and transfers must not compromise national security or vital interests. On top of that, government data must remain inside the Kingdom, and financial institutions need central bank approval to host data offshore. Enforcement has started: by early 2026, SDAIA’s specialised committees had issued 48 decisions confirming violations, according to Chambers’ TMT guide.

Qatar, Bahrain, Kuwait and Oman

• Qatar is the Gulf’s deliberate outlier: its 2016 data privacy law actually prohibits controllers from restricting cross-border flows unless the processing breaks the law or risks serious damage. The Qatar Financial Centre runs its own GDPR-style regime with tighter transfer rules.
• Bahrain takes an adequacy-list approach: transfers are allowed to the 83 countries on its 2022 order, and need the authority’s permission elsewhere.
• Kuwait has no comprehensive data protection law, but its CITRA cloud framework requires the most sensitive government and central bank data to be hosted in data centres physically inside Kuwait.
• Oman’s law became fully enforceable in February 2026, transfers to countries without adequate protection need ministry permission, and a September 2026 amendment broadened the law’s reach.

One conclusion holds across all six countries: the fewer borders your data crosses, the fewer of these rules you have to interpret.

What does sovereign AI mean for your company?

National programmes are about gigawatts and geopolitics. Company-level sovereignty is practical and available now, and the same logic applies:

• Fewer transfer questions. Data that never leaves your building never crosses a border, under any of the regimes above.
• Readiness where rules are still moving. The UAE’s federal executive regulations are still pending; companies that already keep AI processing in-house have less to re-engineer when enforcement arrives.
• No shadow AI. An approved in-house assistant removes the incentive to paste contracts and client files into personal accounts on public tools.
• Arabic and English, on your terms. Open-weight models, including Arabic-first models from the region’s own institutes and companies, run on your own GPU servers, connected to your own Arabic and English documents.
• Auditability. Prompts, logs and access controls sit in systems you already audit, not on a provider’s platform.

The bridge from national strategy to your server room is hardware: right-sized GPU servers, storage and networking, deployed by partners who install the models and connect your documents. That is what we supply from Dubai. Start with our on-premise AI bundles, the cost comparison between on-premise and cloud, or what a private LLM needs to run.