---
title: "UAE and Saudi Arabia: AI, media and advertising rules"
description: "A different regulatory style The UAE and Saudi Arabia are among the world's most ambitious AI adopters. Neither has a single EU-style AI statute…"
url: https://optimizeall.com/learn/responsible-ai-disclosure-and-compliance/uae-and-ksa-ai-and-media-rules
updated: 2026-10-05
---

Responsible AI, Disclosure & Compliance · Transparency law, content provenance and Gulf rules · lesson 9 of 11 · 16 min

# UAE and Saudi Arabia: AI, media and advertising rules

## A different regulatory style

The UAE and Saudi Arabia are among the world's most ambitious AI adopters. Neither has a single EU-style AI statute. Instead, three layers apply to your AI-assisted content:

1. **Binding media and advertising law**, including licensing of people who advertise on social media.
2. **Binding data protection and cybercrime law**, which covers images, voices and personal data used with AI.
3. **AI-specific principles and guidelines** from government bodies. Most are not binding, but regulators, platforms and government-linked clients treat them as expectations.

Rules here change quickly and free zones (for example DIFC and ADGM in the UAE) have their own regimes. Always verify on official government sources before a campaign, and take local legal advice for anything high-stakes.

## United Arab Emirates

**Media and advertising**

- **Federal Decree-Law No. 55 of 2023 on media regulation** and its implementing resolutions set media content standards and licensing. The **UAE Media Council** regulates advertising content.
- **Advertiser Permit:** people who promote products or services on social media need a permit from the UAE Media Council. It became mandatory after a grace period that ended on **31 January 2026**. It is issued free for the first three years to UAE citizens and residents; exemptions exist, for example for promoting your own business. Visiting creators who advertise while in the UAE need a separate visitor permit arranged through licensed agencies. Check current terms on the Media Council's channels.
- **Content standards** prohibit, among other things, misleading advertising and content that harms public order or national identity; ads must be clearly identified.

**Data and cybercrime**

- **Federal Decree-Law No. 45 of 2021 on personal data protection (PDPL)** sets lawful bases, rights and transfer rules. Free zones such as DIFC (whose regulation includes specific requirements for processing through autonomous and semi-autonomous systems) and ADGM have separate laws.
- **Federal Decree-Law No. 34 of 2021 on combating rumors and cybercrimes** covers false information, and using people's images or personal information without consent. AI-generated content is not exempt.

**AI principles and guidance**

- **UAE Charter for the Development and Use of Artificial Intelligence (2024):** twelve principles including safety, algorithmic bias, privacy, transparency, human oversight and accountability.
- **Dubai Human-Machine Collaboration (HMC) icons (2025):** a free classification system from the Dubai Future Foundation showing how much of a piece of research, publication or content was produced by humans versus machines, from "all human" to "all machine", with function icons for ideation, writing, translation, visuals and more. It is voluntary, but increasingly recognized in Dubai.

## Saudi Arabia

**Media and advertising**

- The **General Authority for Media Regulation (GAMR)**, which succeeded the former General Commission for Audiovisual Media (GCAM), regulates media and issues the **Mawthooq** license, introduced in 2022, required for people who earn from advertising on social media. Ads must be clearly identified. Check current fees, validity and penalties on official channels.
- Consumer protection and e-commerce rules prohibit misleading claims and fake reviews.

**Data**

- **Personal Data Protection Law (PDPL):** in force since September 2023 and enforced from September 2024, with implementing regulations including cross-border transfer rules. It applies to processing in the Kingdom and to processing of residents' data by entities abroad. SDAIA supervises it.

**AI principles and guidance (SDAIA)**

- **AI Ethics Principles (2023):** fairness, privacy and security, humanity, social and environmental benefit, reliability and safety, transparency and explainability, accountability and responsibility.
- **Generative AI Guidelines (2024):** for government entities and for the public, covering responsible use, transparency, and risks such as hallucination and deepfakes.
- **Deepfakes Guidelines:** consulted on in 2024 and issued in 2026. They emphasize explicit consent before using a person's image, likeness or voice, auditable consent records, watermarking and cryptographic provenance, and labeling synthetic media.

## What this means for your work

| Situation | UAE | Saudi Arabia |
|---|---|---|
| Creator promotes a brand on Instagram | Advertiser Permit; clear ad label | Mawthooq license; clear ad label |
| Realistic AI avatar of a real person | Consent; cybercrime and image-rights risk without it; label | Explicit, recorded consent per SDAIA deepfakes guidance; label and watermark |
| Customer chats sent to an AI tool | PDPL (or DIFC/ADGM law); DPA with vendor; transfer rules | PDPL; transfer rules if data leaves the Kingdom |
| Public-facing report drafted with AI | Consider HMC icons in Dubai; human review | Transparency expected under SDAIA guidance; human review |

## Worked example: a Riyadh-and-Dubai beauty launch

A cosmetics brand launches in both markets with three creators and an AI-generated Arabic voice-over.

- Creators: the Dubai creator's Advertiser Permit and the Riyadh creators' Mawthooq licenses are checked and saved to the campaign folder before contracts are signed.
- Voice-over: generated from a hired voice artist's cloned voice under a written, scoped consent record; the video states "AI-generated voice" in Arabic and English, and the files keep Content Credentials.
- Claims: every caption variant goes through the claims gate from Module 3; nothing beyond approved claims.
- Data: comment analysis uses a business-tier AI tool with a processing agreement; KSA customer data is not exported without checking PDPL transfer rules.

## Hands-on: a GCC campaign compliance register

```csv
item,market,instrument,binding,check,evidence,owner,verified_on
Creator A (Dubai),UAE,Advertiser Permit (UAE Media Council),yes,Permit number and expiry,permit_A.pdf,Talent lead,2026-09-18
Creator B (Riyadh),KSA,Mawthooq license (GAMR),yes,License number and expiry,mawthooq_B.pdf,Talent lead,2026-09-18
AI voice-over,KSA,SDAIA Deepfakes Guidelines,no (guidance),Consent record; label; watermark/credentials,consent_VO.pdf,Producer,2026-09-18
AI voice-over,UAE,Cybercrime law 34/2021 + consent,yes,Written consent from voice artist,consent_VO.pdf,Producer,2026-09-18
Comment analysis,UAE,PDPL 45/2021,yes,DPA with AI vendor; minimization,dpa_vendor.pdf,DPO,2026-09-18
Comment analysis,KSA,PDPL + transfer regulations,yes,Transfer assessment,transfer_note.pdf,DPO,2026-09-18
Report cover,Dubai,HMC icons,no (voluntary),Icon matches actual process,report_v3.pdf,Editor,2026-09-18
```

And a bilingual disclosure you can adapt (have a native speaker and the client approve the Arabic):

```text
EN: "This video uses an AI-generated voice created with the artist's consent."
AR: "يستخدم هذا الفيديو صوتًا مُولّدًا بالذكاء الاصطناعي بموافقة الفنان."
```

## Pitfalls

- Treating guidelines as optional when government-linked clients and regulators use them as the standard.
- Assuming a creator's license in one Gulf country covers another.
- Forgetting free-zone data laws differ from onshore federal law.
- Using a famous local personality's likeness "as a tribute" without consent.

## Video lecture: UAE and Saudi Arabia: AI, media and advertising rules

Lecture coming soon · 13 chapters · about 9 minutes. Read the full transcript below.

1. UAE and Saudi Arabia
2. Why it matters
3. Three-layer cake
4. UAE: media and advertising
5. UAE: data, cybercrime, principles
6. Saudi Arabia: media and data
7. SDAIA guidance
8. Example 1: Riyadh home cook
9. Example 2 (illustrative): beauty launch
10. Watch me do it: the register
11. Common mistakes
12. Targeting the Gulf from abroad
13. Recap + try this now

## Lecture transcript

### UAE and Saudi Arabia

A beauty brand is launching in Riyadh and Dubai next month. Three creators, an AI-generated Arabic voice-over, and a lot of excitement. Then someone asks: does the Dubai creator have her permit? Is the Riyadh creator licensed? Is the AI voice okay under Saudi deepfake guidance? The room goes quiet. In this lecture you'll learn how the UAE and Saudi Arabia regulate AI-assisted content, the licenses creators need, the AI guidelines regulators expect you to follow, and a compliance register that answers those questions before anyone asks.

### Why it matters

Why does this matter? Both countries are among the world's most ambitious AI adopters, and both take media, reputation and public order seriously. Posting paid content without the right license can mean fines, and in Saudi Arabia penalties for unlicensed advertising can be severe. Using a real person's likeness without consent can breach cybercrime law. And government and government-linked clients, who are some of the biggest buyers of marketing in the region, expect you to follow national AI guidelines even when they're not strictly binding.

### Three-layer cake

Here's the mental model. Think of it as a three-layer cake. The bottom layer is binding media and advertising law, including licensing of people who advertise on social media. The middle layer is binding data protection and cybercrime law, which covers images, voices and personal data. The top layer is AI principles and guidelines: mostly not binding, but they're the icing everyone sees and judges you on. Unlike the EU, there's no single AI statute. You need all three layers.

### UAE: media and advertising

Let's start with the UAE. Media is regulated under Federal Decree-Law number fifty-five of twenty twenty-three, and the UAE Media Council regulates advertising content. The big one for creators is the Advertiser Permit. People who promote products or services on social media need one. It became mandatory after a grace period that ended on the thirty-first of January, twenty twenty-six. It's free for the first three years for citizens and residents, and there are exemptions, like promoting your own business. Visiting creators need a separate visitor permit through licensed agencies. Always check the current terms.

### UAE: data, cybercrime, principles

On data and AI in the UAE: the federal personal data protection law, decree-law forty-five of twenty twenty-one, sets lawful bases, rights and transfer rules, while free zones like DIFC and ADGM have their own laws. The cybercrime law, decree-law thirty-four of twenty twenty-one, covers false information and using people's images without consent, and AI content isn't exempt. On principles, there's the UAE Charter for the Development and Use of AI from twenty twenty-four, with twelve principles including transparency and human oversight. And in Dubai, the Human-Machine Collaboration icons from the Dubai Future Foundation let you show, voluntarily, how much of a piece was made by humans versus machines.

### Saudi Arabia: media and data

Now Saudi Arabia. Media is regulated by the General Authority for Media Regulation, which replaced the older General Commission for Audiovisual Media, often called GCAM. So if you see GCAM in an old guide, update it. This authority issues the Mawthooq license, introduced in twenty twenty-two, for people who earn from advertising on social media. Ads must be clearly identified. For data, the Personal Data Protection Law has been enforced since September twenty twenty-four, with transfer rules if data leaves the Kingdom. And SDAIA, the national data and AI authority, supervises it.

### SDAIA guidance

SDAIA has also published AI guidance that matters for content. The AI Ethics Principles from twenty twenty-three. Generative AI Guidelines from twenty twenty-four, for government and for the public, covering transparency and risks like hallucination and deepfakes. And Deepfakes Guidelines, consulted on in twenty twenty-four and issued in twenty twenty-six. For creators and marketers, the message is clear: explicit consent before using someone's image, likeness or voice, auditable consent records, watermarking and provenance, and clear labels on synthetic media.

### Example 1: Riyadh home cook

First example, simple. A Riyadh home cook with a growing Instagram following gets her first paid offer from a spice brand. Before she says yes, she checks she holds a Mawthooq license, because this is paid advertising. She makes the content herself, labels it clearly as an ad, and uses no AI imagery. The brand also wants to post in the UAE through a Dubai creator. The agency confirms that creator's UAE Advertiser Permit separately, because one country's license doesn't cover the other.

### Example 2 (illustrative): beauty launch

Second example, a realistic business scenario with illustrative details. Back to our beauty launch across Riyadh and Dubai. The agency builds a compliance register before signing contracts. Creator permits and licenses: checked and saved. The Arabic voice-over: made from a hired voice artist's cloned voice, with a written consent record, labeled as an AI-generated voice in Arabic and English, and delivered with Content Credentials intact, which lines up with SDAIA's deepfake guidance. Captions: every variant goes through the claims gate. Comment analysis: a business-tier AI tool with a processing agreement, and no Saudi customer data leaves the Kingdom without a transfer check. Illustratively, when the retailer's compliance team asked for evidence, the agency sent one spreadsheet and seven PDFs within the hour.

### Watch me do it: the register

Watch me do it. I open the register template from the lesson. Row one: Creator A, UAE, Advertiser Permit, binding: yes. I paste her permit number and expiry, and save the PDF. Row two: Creator B, Saudi Arabia, Mawthooq license from GAMR. Same. Row three: the AI voice-over, Saudi Arabia, SDAIA deepfakes guidance, binding: no, it's guidance, but I still record the consent file, the label and the credentials check. Row four: the same voice-over under UAE law: written consent. Rows five and six: comment analysis under each country's data law. Row seven: the report cover in Dubai with an HMC icon that matches how we actually made it. Every row has an owner and a verified-on date.

### Common mistakes

Common mistakes. Treating guidelines as optional, when government-linked clients and regulators use them as the standard. Assuming a license in one Gulf country covers another. Forgetting that DIFC and ADGM have their own data laws. Using a famous local personality's likeness as a tribute, without consent. Writing Arabic disclosures with machine translation and no native review. And quoting old names like GCAM in client decks, which quietly tells a client your guidance is out of date.

### Targeting the Gulf from abroad

What if you're based elsewhere and target Gulf audiences? Say you're a Pakistani creator in Lahore with a big following in Dubai and Jeddah. The safest approach is to treat the strictest applicable standard as your baseline. Check whether the brand or its agency needs you to hold a UAE or Saudi license or permit for the campaign; the rules focus on advertising activity in or aimed at those markets, and the answer depends on the details, so get it in writing from the brand's local team. Use clear Arabic and English ad labels. Get consent for any likeness or voice you synthesize. And remember Pakistan's own cybercrime law still applies to what you publish from home.

### Recap + try this now

Recap. The UAE and Saudi Arabia regulate AI content through three layers: media licensing, data and cybercrime law, and AI guidelines. UAE creators need a Media Council Advertiser Permit; Saudi creators need a Mawthooq license from GAMR, the successor to GCAM. SDAIA expects consent, records, watermarks and labels for deepfakes. And Dubai's HMC icons are a voluntary way to show how content was made. Try this now: copy the register template from the lesson and fill it in for your next Gulf campaign, starting with every creator's permit or license. Next module: data protection and your AI usage policy.

## Key takeaways

- The UAE and KSA regulate AI content through media licensing, data protection and cybercrime law, plus AI guidelines.
- UAE creators need a Media Council Advertiser Permit; Saudi creators need a Mawthooq license from GAMR (formerly GCAM).
- SDAIA guidance expects explicit, recorded consent, labeling and watermarking for deepfakes.
- Dubai HMC icons offer a voluntary way to show human versus machine contribution.

## Try it

Build a GCC compliance register for your next UAE or Saudi campaign using the CSV template, and confirm every creator permit or license before contracts are signed.

- [Previous: Content Credentials (C2PA), watermarks and provenance](https://optimizeall.com/learn/responsible-ai-disclosure-and-compliance/c2pa-content-credentials-and-watermarks)
- [Next: Data protection principles for AI use](https://optimizeall.com/learn/responsible-ai-disclosure-and-compliance/data-protection-principles)
- [All lessons of Responsible AI, Disclosure & Compliance](https://optimizeall.com/learn/responsible-ai-disclosure-and-compliance)