Governance typology
How AI governance is organised as an institutional practice: who holds authority, by what regulatory philosophy, and with what enforcement.
Key messages
- Seven states place AI authority at prime-ministerial, federal or ministerial level.
- Three distinct Gulf models coexist: soft law with procurement levers (UAE), binding data protection with direct enforcement (Saudi Arabia), and binding sector rules in finance (Qatar).
- Egypt, Tunisia and Morocco reach high data protection scores without high income: an institutional pathway that is not contingent on fiscal capacity.
- Ten of the 19 states displayed have not so far defined a governance type for AI.
The analysis uses fuzzy-set Qualitative Comparative Analysis (Ragin, 2008; Schneider & Wagemann, 2012). Conditions are calibrated as set memberships between 0 and 1: state capacity, economic resources, digital infrastructure, data protection, international alignment and research output, among others.
| State | Governance type | Regulatory approach | Enforcement model | Sovereignty posture | International alignment | Cluster label |
|---|---|---|---|---|---|---|
| UAE | Centralised, federal | Soft law and experimental legislation | Indirect (procurement) | Active | Western multilateral | Gulf Innovation Leader |
| SAU | Centralised, prime-ministerial level | Hybrid (binding PDPL, soft AI guidance) | Direct (SDAIA fines) | Assertive | Selective multilateral | Gulf Sovereignty Pioneer |
| QAT | Centralised, prime-ministerial level | Hybrid (ethics guidance, binding in finance) | Sectoral (QCB binding) | Moderate | Regional (GCC and DCO) | Gulf Sectoral Regulator |
| BHR | Ministerial | Licensing-based (draft AI law) | Proposed (custodial and financial penalties) | Aspirational | GCC-oriented | Gulf Early Legislator |
| KWT | To be defined | To be defined | To be defined | To be defined | To be defined | Gulf: framework pending |
| OMN | Fragmented | Strategic vision only | To be defined | Aspirational | GCC-oriented | Gulf Emerging |
| EGY | Centralised, ministerial | Phased, soft to hard | Supervisory (MCIT) | Active | OECD adherent | MENA Institutional Leader |
| MAR | Multi-stakeholder | Horizontal framework law | Graduated sanctions | Moderate | EU and UNESCO | North Africa Digital Hub |
| TUN | Prime-ministerial council | Hybrid (hard law and sandboxes) | Bifurcated (INPDP and Decree-Law 2022-54) | Aspirational | EU-influenced | North Africa Innovation Bridge |
| DZA | To be defined | To be defined | To be defined | To be defined | To be defined | North Africa: framework pending |
| LBY | To be defined | To be defined | To be defined | To be defined | To be defined | Fragile or conflict-affected context |
| MRT | To be defined | Strategic vision only | To be defined | To be defined | To be defined | Initial stage |
| JOR | To be defined | To be defined | To be defined | To be defined | To be defined | Levant: framework pending |
| LBN | To be defined | To be defined | To be defined | To be defined | To be defined | Fragile or conflict-affected context |
| PSE | To be defined | To be defined | To be defined | To be defined | To be defined | Fragile or conflict-affected context |
| SYR | To be defined | To be defined | To be defined | To be defined | To be defined | Fragile or conflict-affected context |
| IRQ | Centralised, prime-ministerial level | Agile governance and sectoral sandbox | No AI-specific penalties | Aspirational | UNDP-supported | Emerging, reconstruction context |
| YEM | To be defined | To be defined | To be defined | To be defined | To be defined | Fragile or conflict-affected context |
| SDN | To be defined | To be defined | To be defined | To be defined | To be defined | Fragile or conflict-affected context |
Note. Manual coding from qualitative profiles (D1) and table F1. Category labels are reproduced as coded. Comoros, Djibouti and Somalia are at the Nascent stage; their indicator values are not displayed in the 2025 release.
The Lab designs and delivers capacity building for ministries, regulators, data protection authorities and regional bodies: executive programmes, regulator training and institutional development, grounded in its comparative evidence and delivered in Arabic, English or French.
Contact the LabOther areas
Regulatory and legal frameworksAI readiness and digital governmentAI research and publicationsDigital infrastructureAI, culture and communicationHuman capital and capacityCybersecurity