UAE and Saudi Arabia: AI, media and advertising rules

0:00 UAE and Saudi Arabia

A beauty brand is launching in Riyadh and Dubai next month. Three creators, an AI-generated Arabic voice-over, and a lot of excitement. Then someone asks: does the Dubai creator have her permit? Is the Riyadh creator licensed? Is the AI voice okay under Saudi deepfake guidance? The room goes quiet. In this lecture you'll learn how the UAE and Saudi Arabia regulate AI-assisted content, the licenses creators need, the AI guidelines regulators expect you to follow, and a compliance register that answers those questions before anyone asks.

0:38 Why it matters

Why does this matter? Both countries are among the world's most ambitious AI adopters, and both take media, reputation and public order seriously. Posting paid content without the right license can mean fines, and in Saudi Arabia penalties for unlicensed advertising can be severe. Using a real person's likeness without consent can breach cybercrime law. And government and government-linked clients, who are some of the biggest buyers of marketing in the region, expect you to follow national AI guidelines even when they're not strictly binding.

1:15 Three-layer cake

Here's the mental model. Think of it as a three-layer cake. The bottom layer is binding media and advertising law, including licensing of people who advertise on social media. The middle layer is binding data protection and cybercrime law, which covers images, voices and personal data. The top layer is AI principles and guidelines: mostly not binding, but they're the icing everyone sees and judges you on. Unlike the EU, there's no single AI statute. You need all three layers.

1:50 UAE: media and advertising

Let's start with the UAE. Media is regulated under Federal Decree-Law number fifty-five of twenty twenty-three, and the UAE Media Council regulates advertising content. The big one for creators is the Advertiser Permit. People who promote products or services on social media need one. It became mandatory after a grace period that ended on the thirty-first of January, twenty twenty-six. It's free for the first three years for citizens and residents, and there are exemptions, like promoting your own business. Visiting creators need a separate visitor permit through licensed agencies. Always check the current terms.

2:31 UAE: data, cybercrime, principles

On data and AI in the UAE: the federal personal data protection law, decree-law forty-five of twenty twenty-one, sets lawful bases, rights and transfer rules, while free zones like DIFC and ADGM have their own laws. The cybercrime law, decree-law thirty-four of twenty twenty-one, covers false information and using people's images without consent, and AI content isn't exempt. On principles, there's the UAE Charter for the Development and Use of AI from twenty twenty-four, with twelve principles including transparency and human oversight. And in Dubai, the Human-Machine Collaboration icons from the Dubai Future Foundation let you show, voluntarily, how much of a piece was made by humans versus machines.

3:18 Saudi Arabia: media and data

Now Saudi Arabia. Media is regulated by the General Authority for Media Regulation, which replaced the older General Commission for Audiovisual Media, often called GCAM. So if you see GCAM in an old guide, update it. This authority issues the Mawthooq license, introduced in twenty twenty-two, for people who earn from advertising on social media. Ads must be clearly identified. For data, the Personal Data Protection Law has been enforced since September twenty twenty-four, with transfer rules if data leaves the Kingdom. And SDAIA, the national data and AI authority, supervises it.

3:58 SDAIA guidance

SDAIA has also published AI guidance that matters for content. The AI Ethics Principles from twenty twenty-three. Generative AI Guidelines from twenty twenty-four, for government and for the public, covering transparency and risks like hallucination and deepfakes. And Deepfakes Guidelines, consulted on in twenty twenty-four and issued in twenty twenty-six. For creators and marketers, the message is clear: explicit consent before using someone's image, likeness or voice, auditable consent records, watermarking and provenance, and clear labels on synthetic media.

4:32 Example 1: Riyadh home cook

First example, simple. A Riyadh home cook with a growing Instagram following gets her first paid offer from a spice brand. Before she says yes, she checks she holds a Mawthooq license, because this is paid advertising. She makes the content herself, labels it clearly as an ad, and uses no AI imagery. The brand also wants to post in the UAE through a Dubai creator. The agency confirms that creator's UAE Advertiser Permit separately, because one country's license doesn't cover the other.

5:08 Example 2 (illustrative): beauty launch

Second example, a realistic business scenario with illustrative details. Back to our beauty launch across Riyadh and Dubai. The agency builds a compliance register before signing contracts. Creator permits and licenses: checked and saved. The Arabic voice-over: made from a hired voice artist's cloned voice, with a written consent record, labeled as an AI-generated voice in Arabic and English, and delivered with Content Credentials intact, which lines up with SDAIA's deepfake guidance. Captions: every variant goes through the claims gate. Comment analysis: a business-tier AI tool with a processing agreement, and no Saudi customer data leaves the Kingdom without a transfer check. Illustratively, when the retailer's compliance team asked for evidence, the agency sent one spreadsheet and seven PDFs within the hour.

6:01 Watch me do it: the register

Watch me do it. I open the register template from the lesson. Row one: Creator A, UAE, Advertiser Permit, binding: yes. I paste her permit number and expiry, and save the PDF. Row two: Creator B, Saudi Arabia, Mawthooq license from GAMR. Same. Row three: the AI voice-over, Saudi Arabia, SDAIA deepfakes guidance, binding: no, it's guidance, but I still record the consent file, the label and the credentials check. Row four: the same voice-over under UAE law: written consent. Rows five and six: comment analysis under each country's data law. Row seven: the report cover in Dubai with an HMC icon that matches how we actually made it. Every row has an owner and a verified-on date.

6:52 Common mistakes

Common mistakes. Treating guidelines as optional, when government-linked clients and regulators use them as the standard. Assuming a license in one Gulf country covers another. Forgetting that DIFC and ADGM have their own data laws. Using a famous local personality's likeness as a tribute, without consent. Writing Arabic disclosures with machine translation and no native review. And quoting old names like GCAM in client decks, which quietly tells a client your guidance is out of date.

7:25 Targeting the Gulf from abroad

What if you're based elsewhere and target Gulf audiences? Say you're a Pakistani creator in Lahore with a big following in Dubai and Jeddah. The safest approach is to treat the strictest applicable standard as your baseline. Check whether the brand or its agency needs you to hold a UAE or Saudi license or permit for the campaign; the rules focus on advertising activity in or aimed at those markets, and the answer depends on the details, so get it in writing from the brand's local team. Use clear Arabic and English ad labels. Get consent for any likeness or voice you synthesize. And remember Pakistan's own cybercrime law still applies to what you publish from home.

8:16 Recap + try this now

Recap. The UAE and Saudi Arabia regulate AI content through three layers: media licensing, data and cybercrime law, and AI guidelines. UAE creators need a Media Council Advertiser Permit; Saudi creators need a Mawthooq license from GAMR, the successor to GCAM. SDAIA expects consent, records, watermarks and labels for deepfakes. And Dubai's HMC icons are a voluntary way to show how content was made. Try this now: copy the register template from the lesson and fill it in for your next Gulf campaign, starting with every creator's permit or license. Next module: data protection and your AI usage policy.