Five stages of regulatory maturity

The Lab codes each state on cumulative indicators drawn from primary documents: a national AI strategy, a dedicated governance body, an enacted data protection law, a risk classification scheme, a regulatory sandbox and the number of AI-relevant regulatory instruments. The indicators are combined into five stages, from Nascent to Advanced.

The Advanced stage (the United Arab Emirates, Saudi Arabia and Qatar) combines several binding instruments with enforced data protection law, a dedicated body at federal or prime-ministerial level, risk classification and sandboxes. The Intermediate stage (Bahrain, Egypt and Tunisia) has data protection law, a strategy and a dedicated body in place. Emerging states (Oman, Morocco and Iraq) have adopted or are developing a strategy with partial supporting law. Initial states (Kuwait, Algeria, Jordan and Mauritania) have limited formal arrangements. Nine states are at the Nascent stage, most of them in fragile or conflict-affected contexts.

The Arab AI Governance Index

Three Gulf states hold the first three positions. Bahrain, Egypt and Tunisia follow as a group in which data protection law, a national strategy and a dedicated body are all in place. Oman and Morocco post cybersecurity scores above 80, and Kuwait and Jordan reach the mid-50s on the strength of digital government and cybersecurity. States at the Nascent stage score below 30 where they can be scored.

Four geographic areas

Where the region is unequal

Dispersion differs sharply by pillar (Table 1.3). The coefficient of variation is 0.89 for regulation, against 0.52 for cybersecurity, 0.40 for AI readiness and 0.30 for digital government. The region is far more unequal in the institutionalisation of AI governance than in the administrative and technical capacities on which it rests. The binding inequality is institutional, not technological.

The pattern has a practical corollary. Capacities that took a decade to build, such as e-government platforms and cybersecurity agencies, are already present in many states that have no AI framework. For those states the marginal cost of institutionalisation is low, a point developed in chapter 10.

The binding inequality is institutional, not technological.

References

• Ben Brik, A. (2026a). When rankings disagree: A robustness analysis of artificial intelligence readiness composite indicators. Quality & Quantity. https://doi.org/10.1007/s11135-026-03044-x
• Ben Brik, A., Gilbert, N., & Pycińska, M. (2025). Arab AI Governance Lab Dataset [Data set]. Harvard Dataverse. https://doi.org/10.7910/DVN/MOVIFA
• International Telecommunication Union. (2024). Global Cybersecurity Index 2024. ITU.
• Oxford Insights. (2020–2025). Government AI Readiness Index (annual editions). CC BY-SA 4.0.
• United Nations Department of Economic and Social Affairs. (2018–2024). E-Government Survey (biennial editions). United Nations.

Governance in the region rests on combinations of soft law, data protection statutes, sector rules and cybercrime legislation. Saudi Arabia records the largest number of AI-relevant instruments (11) and governance bodies (6); the United Arab Emirates and Qatar follow with eight instruments each.

Outside the Gulf, Egypt has moved to a second-generation strategy with a phased path from guidance to binding rules, and Tunisia and Morocco anchor their frameworks in long-standing data protection statutes. International alignment is widest in the United Arab Emirates and Egypt (four frameworks referenced each).

Sequence and alignment

The dates of data protection statutes show two generations of legal foundations. Tunisia (2004) and Morocco (2009) legislated more than a decade before any national AI strategy existed in the region; the Gulf statutes cluster between 2016 and 2021, and Egypt legislated in 2020. In every case the statute preceded or accompanied the strategy, which is why data protection authorities, where they exist, are the oldest AI-relevant regulators in the region and the natural anchor for algorithmic oversight.

International alignment rises with regulatory stage (r = 0.87). The United Arab Emirates and Egypt reference four frameworks each; Saudi Arabia, Qatar, Morocco and Tunisia three; Bahrain, Kuwait, Oman and Iraq one; nine states none. Alignment is a marker of institutionalisation, not a substitute for it: no state combines high alignment with a low stage.

Gaps and challenges

Three regularities stand out in the coding. (i) Instruments follow institutions: across the 19 states displayed, the number of AI-relevant instruments correlates at r = 0.97 with the number of dedicated bodies, and no state has accumulated instruments without first creating a body to issue them. (ii) Data protection comes first: each of the eight states with an enacted data protection statute also has a national AI strategy, and no state at the Initial or Nascent stage has such a statute coded. (iii) Two sequencing anomalies mark the frontier of the problem. Iraq has three bodies and six instruments without a data protection statute, so its instruments lack the legal basis on which oversight rests elsewhere. Mauritania has a strategy without any body to implement it.

International visibility is concentrated. Saudi Arabia accounts for 64 of the 91 initiatives registered with the OECD.AI observatory (70 per cent); the United Arab Emirates, Egypt, Tunisia, Morocco and Algeria account for the rest. Registration reflects reporting effort as well as activity, which is one reason why counts of initiatives should not be read as measures of governance quality.

For the Advanced group the challenge is the move from soft law to enforceable obligations: binding force currently comes from data protection law and, in Qatar, from financial regulation, not from AI-specific duties on public bodies. For the Intermediate group the challenge is enactment and resourcing; the Bahrain draft was awaiting parliamentary passage at the time of coding.

References

• Ben Brik, A., Gilbert, N., & Pycińska, M. (2025). Arab AI Governance Lab Dataset [Data set]. Harvard Dataverse. https://doi.org/10.7910/DVN/MOVIFA
• OECD. (n.d.). OECD.AI Policy Observatory. https://oecd.ai

Nine of 17 states improved their score over the period. Saudi Arabia gained 15.34 points and moved ahead of the United Arab Emirates in 2025; Jordan gained 14.31, Egypt 9.91 and Algeria 8.58. Eight states recorded lower scores in 2025 than in 2020, among them states in fragile or conflict-affected contexts.

On the UN index the largest advances were recorded by Saudi Arabia (position 52 to 6), Oman (63 to 41), the United Arab Emirates (21 to 11) and Bahrain (26 to 18). Egypt, Morocco, Algeria and Jordan also improved their positions.

The region is diverging: states that started higher gained more.

Convergence or divergence?

The readiness panel shows divergence, not catch-up. Among the 17 states observed in both years, the standard deviation of Oxford Insights scores rose from 14.07 in 2020 to 17.40 in 2025, and the correlation between the 2020 level and the subsequent change is positive (r = 0.27): states that started higher tended to gain more. The Gulf mean rose from 56.92 to 60.02; the mean of the other states moved from 33.56 to 35.10.

Digital government tells a similar story at a higher level. Every one of the 16 states with data except Lebanon improved its EGDI score between 2018 and 2024, and the regional mean rose from 0.559 to 0.675. The Gulf mean rose by 0.135 and the mean of the other states by 0.105, so the absolute gap widened from 0.303 to 0.333, and the dispersion of scores increased from 0.178 to 0.202.

Two implications follow. Readiness gains track sustained institutional investment, not income alone: Jordan and Egypt, both outside the high-income group, recorded the second and third largest gains, while Kuwait and the United Arab Emirates recorded declines. And because composite scores respond to revisions of method, movements of a few points from one year to the next should not drive policy; the direction over five years is the more reliable signal.

One capacity, two measurements

The two panels are highly correlated (r = 0.93, n = 16). They should be read as two measurements of one underlying administrative capacity, not as independent confirmation of each other. Short-run volatility is considerable: between 2023 and 2025 the mean absolute change in readiness scores was 3.87 points and eight of 19 states improved, against nine of 17 over the full period from 2020.

References

• Ben Brik, A. (2026a). When rankings disagree: A robustness analysis of artificial intelligence readiness composite indicators. Quality & Quantity. https://doi.org/10.1007/s11135-026-03044-x
• Oxford Insights. (2020–2025). Government AI Readiness Index (annual editions). CC BY-SA 4.0.
• United Nations Department of Economic and Social Affairs. (2018–2024). E-Government Survey (biennial editions). United Nations.

Gaps and challenges

Research output is concentrated and its distribution is shifting. Saudi Arabia, Iraq and Egypt produced 65 per cent of the 3,906 indexed publications recorded for 2023. Between 2020 and 2023 output grew by 74 per cent in Saudi Arabia, 67 per cent in Bahrain, 66 per cent in Algeria and 57 per cent in Iraq, and fell in Kuwait (27 per cent), Lebanon (17 per cent), the Syrian Arab Republic (37 per cent) and the State of Palestine (from five publications to three). Of all the correlates of regulatory stage examined in this report, research output is the weakest (Spearman ρ = 0.66, against 0.84 for AI readiness), which confirms that scientific communities and regulatory institutions develop along separate tracks.

Research spending does not predict output. Among the eight states that report both, Egypt (1.03 per cent of GDP, 669 publications) and Tunisia (0.75 per cent, 357) combine spending with output, Saudi Arabia produces the most on 0.56 per cent, and Iraq produces 679 publications on 0.04 per cent. Output at that level of spending rests on the effort of university staff, not on funded programmes, which makes it fragile and leaves it unconnected to the policy process.

References

• Ben Brik, A., Gilbert, N., & Pycińska, M. (2025). Arab AI Governance Lab Dataset [Data set]. Harvard Dataverse. https://doi.org/10.7910/DVN/MOVIFA
• OECD. (n.d.). OECD.AI Policy Observatory. https://oecd.ai
• World Bank. (2023). World Development Indicators. World Bank.

The United Arab Emirates gained 0.26 and Saudi Arabia 0.10. Human capital fell in eight of 16 states, including every fragile or conflict-affected state with data. Strategies depend on regulators, engineers and civil servants to carry them out; where human capital is under pressure, implementation support and regional training programmes matter most.

The erosion is largest exactly where public administration will need to be rebuilt.

Gaps and challenges

The human capital evidence is sharper. The regional mean of the Human Capital Index was flat between 2018 and 2024 (0.645 to 0.651), but the average conceals a split: the Gulf states gained 0.099 on average, while Iraq, Lebanon, Libya, the Syrian Arab Republic and Yemen lost 0.092. The erosion is largest exactly where public administration will need to be rebuilt. For these states the constraint on AI governance is not the absence of a strategy but the availability of trained officials to staff any institution a strategy might create.

A comparison of the Online Services Index with the Human Capital Index shows which administrations convert skills into services. Jordan (+0.113), Egypt (+0.085) and Saudi Arabia (+0.083) deliver more online than their human capital score would suggest. Libya (−0.514), Algeria (−0.310) and Iraq (−0.309) have human capital that is not reflected in digital services. For AI governance the second group is the more telling: the skills exist in the population but not in the machinery of government. E-participation rises with regulatory stage (r = 0.71), with exceptions in both directions.

References

• United Nations Department of Economic and Social Affairs. (2018–2024). E-Government Survey (biennial editions). United Nations.

Six states report internet use above 95 per cent. Internet use in Iraq rose by 47.8 percentage points between 2018 and 2023, and Morocco, Jordan, Egypt and Algeria each added more than 25 points. Connectivity has expanded faster than AI frameworks: two states with telecom infrastructure scores above 0.96 have no AI strategy coded.

Gaps and challenges

Network architecture adds a resilience dimension. Kuwait records 166 mobile subscriptions for every fixed broadband subscription and Mauritania 154, against a ratio below 10 in nine of the 15 states with data. Data-intensive public sector AI depends on fixed capacity; where it is thin, cloud and data-centre strategies carry more of the load. In five states (Algeria, Iraq, Libya, the Syrian Arab Republic and Yemen) the Online Services Index is below 0.35 and e-participation below 0.20, so the public-facing digital state on which AI services would be built is still to be developed.

Infrastructure is the weakest correlate of regulatory stage among the capacity measures: internet use correlates with stage at r = 0.30 and the telecom infrastructure index at r = 0.60. Six states added more than 20 percentage points of internet use in five years (Iraq, Algeria, Jordan, Morocco, Egypt and the State of Palestine), so a large share of users came online before any framework for automated decision-making existed.

References

• United Nations Department of Economic and Social Affairs. (2018–2024). E-Government Survey (biennial editions). United Nations.
• World Bank. (2023). World Development Indicators. World Bank.

Five states score above 94 on the ITU index: Saudi Arabia, the United Arab Emirates, Oman, Egypt and Qatar. The ITU index and the National Cyber Security Index agree fairly well across the region (r = 0.83, n = 15). Where cybersecurity institutions are strong and AI bodies are still thin, as in Oman, the former can host early AI oversight functions.

Gaps and challenges

The two cybersecurity indices rest on different evidence. The ITU index records commitments across legal, technical, organisational, capacity and cooperation pillars, largely from national questionnaires; the National Cyber Security Index scores publicly verifiable evidence of implemented measures. The difference between them is therefore informative. It exceeds 50 points in the United Arab Emirates (57.8), Bahrain (51.9) and Oman (50.6) and 40 points in Jordan (42.4), and is close to zero in Algeria (0.2). Saudi Arabia is the only state above 80 on both. A large difference does not show weak security; it shows that implemented capacity is less visible in public evidence than declared commitments, which matters once AI systems run on the same infrastructure.

The National Cyber Security Index is published with a Digital Development Level, and the difference between the two indicates whether security keeps pace with digitalisation. Morocco (+23.2), Saudi Arabia (+20.5) and Egypt (+10.2) secure more than their level of digital development would predict. Bahrain (−39.2), Libya (−30.7), the United Arab Emirates (−28.6) and Jordan (−25.5) have digitalised faster than their publicly documented security measures. In these states public sector AI would run on foundations whose security is the least documented.

References

• e-Governance Academy. (n.d.). National Cyber Security Index. https://ncsi.ega.ee
• International Telecommunication Union. (2024). Global Cybersecurity Index 2024. ITU.

National ethics documents draw mainly on OECD, UNESCO, IEEE and EU texts, and the GCC AI Ethics Manual (2020) follows the same sources. An ethics framework grounded in regional jurisprudential traditions, such as maqāṣid al-sharīʿa, is an open opportunity for regional leadership.

Regulatory sandboxes concentrate on finance and health. Recommendation systems, conversational agents and content moderation fall largely outside existing frameworks, and eight states have a formal risk classification scheme, the basic instrument for extending oversight to these systems.

Gaps and challenges

The gap in this area is one of coverage. Instruments are concentrated where risks are most legible to regulators (finance, health, personal data) and thinnest where AI shapes public communication. Language capacity is similarly concentrated: the five states with sovereign language-model programmes include all three Advanced states, so Arabic language resources are being built where governance capacity is already highest. For the remaining 17 states the realistic route to linguistic and cultural fit is shared regional infrastructure: open corpora, evaluation benchmarks that cover Arabic dialects, and common procurement requirements for performance in Arabic.

The sources of ethical guidance are external and recent. As coded in the dataset, seven states reference the UNESCO Recommendation on the Ethics of Artificial Intelligence, seven show the influence of the EU AI Act, three reference the GCC ethics manual and one adheres to the OECD principles. None of the documents coded draws primarily on regional jurisprudence, which leaves room for a regional contribution to the global debate and not only for the reception of it.

References

• Ben Brik, A., Gilbert, N., & Pycińska, M. (2025). Arab AI Governance Lab Dataset [Data set]. Harvard Dataverse. https://doi.org/10.7910/DVN/MOVIFA
• OECD. (n.d.). OECD.AI Policy Observatory. https://oecd.ai

Where a model exists, authority sits at the centre of government. Saudi Arabia, Qatar and Iraq place AI under prime-ministerial authority, the United Arab Emirates under a federal portfolio, Egypt and Bahrain under a ministry, and Tunisia under a council attached to the head of government; Morocco is the only multi-stakeholder arrangement and Oman is coded as fragmented. Centralisation is common to the three Advanced states and to Iraq, which shows that the institutional form travels more easily than the capacity behind it.

Enforcement is where models diverge most. Nine different enforcement arrangements are coded for the nine states with a defined model, from procurement levers to direct fines, and no two states share one. The region has converged on where authority sits and has not converged on how rules are made to bind.

References

• Ben Brik, A., Gilbert, N., & Pycińska, M. (2025). Arab AI Governance Lab Dataset [Data set]. Harvard Dataverse. https://doi.org/10.7910/DVN/MOVIFA

The analysis uses fuzzy-set Qualitative Comparative Analysis (Ragin, 2008; Schneider & Wagemann, 2012). Conditions are calibrated as set memberships between 0 and 1: state capacity, economic resources, digital infrastructure, data protection, international alignment and research output, among others.

The capacity and regulation gap

A simple diagnostic separates two governance problems that the index averages away. For each state, the mean of the three capacity pillars (readiness, digital government, cybersecurity) is compared with the regulation pillar (Figure 10.1). A positive difference indicates latent capacity: administrative and technical capacity ahead of the institutionalisation of AI governance. A negative difference indicates regulation ahead of capacity.

Latent capacity. Kuwait (+40.7), Jordan (+40.2), Oman (+29.5), Algeria (+20.2) and Morocco (+14.6) have capacity that their regulatory stage does not reflect. In these states the obstacle is a decision, not a deficit: a lead body, a strategy and a data protection statute could be put in place with the administrative means already available.

Regulation ahead of capacity. Iraq (−18.1) and Tunisia (−9.1) have adopted strategies, bodies and instruments that outrun measured administrative capacity. This is the configuration in which formal adoption is most likely to decouple from practice, and in which investment in implementation (staffing, online services, cybersecurity) will yield more than further instruments. The negative values for Qatar (−21.5), the United Arab Emirates (−12.2) and Saudi Arabia (−11.0) partly reflect the ceiling of the regulation scale, but they also identify where capacity is lowest relative to ambition: AI readiness in all three, and digital government in Qatar.

Bahrain (+1.5), Egypt (−1.1) and Mauritania (−1.7) are in balance, at very different levels. For the nine Nascent states the regulation pillar is zero, so the difference equals mean capacity; it ranges from 39.7 in Lebanon and 37.3 in Libya to 18.8 in Yemen, a reminder that the Nascent stage covers very different starting points.

In latent-capacity states the obstacle is a decision, not a deficit.

Three insights

Resources alone do not produce a framework. Kuwait combines a GDP per capita of US$34,076 and 99.75 per cent internet use with no strategy or dedicated body coded, while the five other Gulf states have both. The deciding factor is institutional choice, and progress can be rapid once a lead body is designated.

Research capacity can run ahead of regulation. Iraq, Jordan and Algeria hold research communities larger than their regulatory stage would suggest. These communities are an asset for regulators.

Composite scores can lag institutional change. The Lebanese readiness score rose between 2020 and 2023 during a severe economic crisis, then fell by 13.36 points by 2025.

References

• Ben Brik, A., Gilbert, N., & Pycińska, M. (2025). Arab AI Governance Lab Dataset [Data set]. Harvard Dataverse. https://doi.org/10.7910/DVN/MOVIFA
• Ragin, C. C. (2008). Redesigning social inquiry: Fuzzy sets and beyond. University of Chicago Press.
• Schneider, C. Q., & Wagemann, C. (2012). Set-theoretic methods for the social sciences. Cambridge University Press.

International guidance organises policy action for AI in government around enablers, guardrails and engagement (OECD, 2025). The evidence in this report suggests a complementary ordering for the Arab region, in which foundations and institutions precede instruments.

Priority gaps and recommendations

Recommendations by actor

Centres of government. Treat AI governance as a machinery-of-government question: assign a single lead mandate, fund it, and require sector regulators to coordinate through it.

Regulators and data protection authorities. Build enforcement capacity before extending the rulebook; publish decisions and enforcement data so that compliance can be observed.

Legislatures. Where draft AI laws are under consideration, legislate implementing capacity and review clauses alongside obligations.

Regional organisations. Provide shared instruments (risk classification, procurement clauses, incident reporting) and a regional training programme, which lower entry costs for smaller administrations.

International partners. Align support with absorptive capacity and with the sequence set out in this report; avoid financing strategy documents that no institution is mandated to implement.

Instruments follow institutions: designate the body first.

Policy sequencing deserves particular attention. Evidence from other developing regions shows that adopting advanced instruments before the capacity to implement them exists can lock administrations into commitments they cannot meet (Ben Brik, 2026b).

References

• Ben Brik, A. (2026b). Policy sequencing and the capability trap: AI governance instrument design across Asian developing countries. Journal of Asian Public Policy, 1–20. https://doi.org/10.1080/17516234.2026.2697934
• OECD. (2025). Governing with artificial intelligence: The state of play and way forward in core government functions. OECD Publishing. https://doi.org/10.1787/795de142-en

For capacity building on AI governance, please contact the Lab: anis.ben.brik@usi.ch.