Middle East and North Africa
Most of the region governs AI through data protection law, national cybersecurity controls and AI guidance rather than a single AI statute. Here is what binds, what guides, and how the platform supports each.
What the region asks for
Across six jurisdictions, four requirements come up again and again.
Data stays in-country
Kronos Lab runs on your infrastructure, in your jurisdiction, including air-gapped. Nothing is sent to a vendor cloud.
Keys stay with you
Content is encrypted under keys in your own HSM or KMS. The platform never holds key material, so it can't be compelled to hand over plaintext.
Personal data never reaches the model
PII is detected and redacted, masked or rejected before it is indexed, embedded or sent in a prompt.
Every decision is accountable
Who processed what, under which policy and with what result, kept in a record a regulator can verify.
Country by country
Saudi Arabia
No AI-specific statute: AI is governed through data protection law, SDAIA guidance and NCA controls, with sector regulators on top.
Binding
- Personal Data Protection Law (PDPL), enforced by SDAIA since September 2024
- NCA Essential Cybersecurity Controls (ECC-2:2024), with the Cloud and Data Cybersecurity Controls, for government, critical infrastructure and their suppliers
- SAMA cybersecurity requirements for supervised financial institutions
Guidance
- SDAIA AI Ethics Principles
- SDAIA Generative AI Guidelines
How Kronos Lab supports it
Deploys in-Kingdom on your infrastructure with keys in your own HSM. PII is redacted before it reaches an index, and every processing decision is recorded for PDPL accountability.
United Arab Emirates
Federal information assurance and data protection law, with free-zone regimes in DIFC and ADGM.
Binding
- UAE Information Assurance Regulation and Standard, issued by TDRA, with the newer version under the UAE Cyber Security Council
- Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)
- DIFC Data Protection Regulation 10 on autonomous and semi-autonomous systems, for DIFC entities
Guidance
- UAE Charter for the Development and Use of Artificial Intelligence
- UAE National Cybersecurity Strategy
How Kronos Lab supports it
Maps its management and technical controls to IA requirements, keeps data and keys in-country, and gives DIFC entities the processing record and human-review trail Regulation 10 expects.
Qatar
The National Cyber Security Agency sets both information assurance and AI security guidance.
Binding
- National Information Assurance standard (NIA)
- Personal Data Privacy Protection Law (Law No. 13 of 2016)
Guidance
- NCSA Guidelines for Secure Adoption and Usage of AI (2024), covering people, process and technology across the AI lifecycle
How Kronos Lab supports it
Supplies the lifecycle controls the NCSA guidelines describe, from supply chain checks to runtime guardrails, with the record NIA audits ask for.
Oman
A national AI policy alongside a data protection law.
Binding
- Personal Data Protection Law (Royal Decree No. 6/2022)
Guidance
- National AI Policy (2025)
How Kronos Lab supports it
Redacts and encrypts personal data before it reaches AI systems and records every decision for accountability.
Bahrain
Data protection law in force, with AI policy for government use and an AI law under discussion.
Binding
- Personal Data Protection Law (Law No. 30 of 2018)
- General policy for AI use, for government entities
Guidance
- None specific to AI yet; national policy is in development.
How Kronos Lab supports it
Keeps personal data out of indexes and prompts, and holds the record a data protection authority will ask for.
Egypt
Data protection law with executive regulations now issued, and a national AI strategy.
Binding
- Personal Data Protection Law (Law No. 151 of 2020) and its executive regulations
Guidance
- National AI Strategy and Egyptian Charter for Responsible AI
How Kronos Lab supports it
Applies PII detection and customer-held encryption before data reaches AI systems, and records processing decisions.
Regional rules are changing quickly: Saudi Arabia is consulting on in-Kingdom storage under the PDPL, the UAE has moved its information assurance standard to the Cyber Security Council, and Bahrain is debating an AI law. Reviewed in October 2026; confirm current text with the issuing authority.