Key Finding

Zero standalone AI laws have been enacted across all Arab states. Bahrain's 38-article Draft AI Regulation Law (Shura Council approval April 2024, 7 chapters) awaits parliamentary ratification — if enacted, it would be the region's first dedicated AI legislation. All current frameworks rely on combinations of soft law, PDPL, sector-specific regulations, and existing cybercrime statutes as the backbone for AI governance.

The five-tier classification is constructed from cumulative binary indicators: AI strategy + dedicated body + enacted PDPL + risk classification + regulatory sandbox + regulation count. Kuwait represents the clearest anomaly: high-income GCC member (GDP/cap $34,076) with zero AI regulations, zero governance body, zero PDPL — the wealth-governance paradox crystallised.

Key Findings

Saudi Arabia registers the most dramatic digital governance transformation in the region — rising from rank 52 to rank 6 globally on the UN e-Government index between 2018 and 2024, driven by sustained strategic investment in digital infrastructure and institutional capacity. Lebanon shows the starkest decline in AI readiness, with its composite score falling over 13 points as economic and political collapse eroded the institutional foundations of governance. Egypt demonstrates that non-GCC states can achieve sustained readiness improvements through deliberate national strategy and international engagement, even with severely constrained economic resources.

The Research-Governance Gap

Iraq is the region's most striking governance paradox: among the highest producers of AI research in the Arab world, yet operating without a data protection law, without AI-specific legislation, and with cybersecurity scores among the lowest in the region. Algeria and Jordan present analogous patterns — substantial research communities operating entirely without governance infrastructure. These cases directly challenge the assumption that scientific capacity naturally produces regulatory capacity. The configurational analysis in Theme 05 shows that research output can partially substitute for economic resources in generating governance outcomes, but only when combined with institutional infrastructure — which none of these states currently possesses at the required level.

Infrastructure Paradoxes

Three infrastructure paradoxes define the Arab digital landscape. The Kuwait mobile-only paradox: among the most connected populations on earth by mobile penetration, yet with almost no fixed broadband infrastructure — an architecture uniquely vulnerable to disruption and wholly reliant on wireless networks. The Iraq infrastructure surge: internet penetration nearly tripled in five years, the fastest non-GCC growth in the region, while institutional governance capacity remained nearly static — rapid connectivity without the governance frameworks to manage its consequences. The Libya infrastructure anomaly: world-class telecom infrastructure scores sitting alongside absent state capacity — physical networks built by oil revenues but entirely disconnected from the institutions needed to govern the digital economy they enable.

Two Lenses, One Question: Whose AI?

The humanities and communication sciences converge on a single underlying question: whose values, narratives, languages, and power structures are being encoded into AI systems, and who bears the consequences? In the Arab world, this question has particular urgency. Arabic is the fifth most spoken language globally yet among the most underrepresented in AI training data. Governance frameworks embed ethics from IEEE, OECD, and EU documents — frameworks designed for liberal democratic contexts with strong civil society. And AI is deployed as a communication infrastructure by states whose relationship to public discourse, press freedom, and political speech is fundamentally different from the contexts in which those systems were designed.

The data reveal a stark division: five states (UAE, Saudi Arabia, Qatar, Egypt, Tunisia) are actively building sovereign Arabic AI capabilities — large language models, domain-specific systems, cultural content infrastructure. The remaining 17 states are entirely passive, consuming AI systems designed elsewhere, encoding other languages, embedding other values.

Human Capital as AI Governance Foundation

Human capital is the bridge between governance aspiration and governance reality. A national AI strategy means little without people capable of implementing it; a regulatory framework is empty without civil servants, judges, and technologists who can interpret and enforce it. Saudi Arabia's dramatic rise up the global e-government rankings reflects not just infrastructure investment but sustained investment in education and skills. Conversely, states experiencing human capital decline — through emigration, conflict, or economic collapse — find their governance ambitions systematically undermined at the implementation level. The Arab region's human capital landscape is sharply divided, and that division closely predicts which governance strategies will be realised and which will remain aspirational documents.y attributable to HCI investment: 0.8101 (2018) → 0.9067 (2024). Yemen's HCI = 0.267 (2024, rank 185) represents the most acute human capital deficit — AI governance is structurally impossible without the human infrastructure to staff, implement, and oversee regulatory bodies.

The fsQCA state capacity condition (C1) integrates HCI as a component: full membership requires EGDI ≥ 0.85 AND n_governance_bodies ≥ 4. Countries with strong HCI but weak institutional infrastructure (Jordan HCI 0.6458, institutions=0) demonstrate that human capital alone cannot produce governance without the parallel institutional architecture.

Cybersecurity-Governance Alignment

Cybersecurity capacity and AI governance capacity are deeply interrelated but not identical. The Gulf states demonstrate that deliberate national investment can build world-class cybersecurity frameworks rapidly, achieving global recognition for legal, technical, and organisational preparedness. Yet several Arab states with moderate governance ambitions show significant cybersecurity vulnerabilities, and populations that are heavily connected digitally in some of the conflict-affected states face high exposure to cyber threats with minimal institutional protection — a compounding vulnerability that makes responsible AI deployment effectively impossible.l AI governance and low cybersecurity capacity. The CEI (Cyber Exposure Index) reveals a counterintuitive pattern: states with zero AI governance (Palestine CEI=0.855, Libya CEI=0.793, Morocco CEI=0.748) score highest on cyber exposure — meaning they are most affected by cybersecurity incidents with the least capacity to respond.