Regulatory reference tables

MENA Jurisdictional Comparison Matrix

The matrix maps the six core MENA jurisdictions (UAE, Saudi Arabia, Qatar, Bahrain, Kuwait, Oman, Egypt, Jordan) across twenty-five compliance dimensions. The dimensions cover the data protection foundation, the AI-specific provisions, the supervisory architecture, and the operational obligations the institutions operating in each jurisdiction must satisfy.

A.1.1 Data Protection Foundation (Dimensions 1 through 10)

A.1.2 AI-Specific Provisions (Dimensions 11 through 17)

A.1.3 Supervisory Architecture and Operational Obligations (Dimensions 18 through 25)

The matrix is the navigation aid. The chapters specify what the matrix indexes. The institution operating across multiple jurisdictions calibrates discipline to the strictest applicable obligation per dimension, then operationalizes the calibrated discipline as the regional baseline the MESA framework Chapter 4 specifies sustains.

Three operational notes anchor the matrix interpretation. The first note is the consent-standard convergence. The eight frameworks converge on explicit, specific, informed consent as the operational consent standard. The convergence enables a single consent-management discipline to satisfy all eight perimeters through the strictest formulation. The institutions operating across multiple perimeters operationalize one consent posture rather than eight. The second note is the breach-notification convergence. The 72-hour breach notification timeline is shared across UAE, Saudi Arabia, Qatar, Bahrain, Kuwait, Oman, Egypt, and Jordan. The shared timeline enables a single incident-response discipline to satisfy all eight perimeters through the cadence the strictest timeline requires. The discipline the Chapter 13 Data Governance Stack specifies operationalizes the convergence. The third note is the data-localization divergence. Saudi Arabia is the binding localization outlier. The Saudi data architecture must accommodate the localization. The non-Saudi data architecture can flow under safeguards. The Chapter 9 Cross-Border AI Architecture Patterns operationalize the divergence through the Sovereign Silos, Federated, and Regional Hub patterns the multi-jurisdictional institution selects from.

The matrix is not the discipline. The matrix is the dimensional map the discipline operates against. The institution that mistakes the matrix for the discipline produces compliance documentation without the operational substrate the supervisor inspects through the documentation. The institution that operates the discipline against the matrix produces the operational substrate the documentation traces and the supervisor recognizes.

Global Regulatory Regimes Comparison

The global regimes are the extraterritorial reality MENA institutions operating internationally inhabit. The matrix maps five regimes across ten dimensions.

The global regimes are not optional for MENA institutions serving international markets. The EU AI Act reaches MENA institutions whose AI system output is used in the EU. PIPL reaches MENA institutions processing Chinese personal information. American sectoral discipline reaches MENA institutions with US-listed exposure. The extraterritorial reality is the current operational condition the institutions operating across the perimeters inhabit.

Where most observers see five distinct global regimes, I see one convergence vocabulary the international standards layer (ISO/IEC 42001, OECD, UNESCO) increasingly codifies and the regional regimes increasingly translate. The institution that built MESA discipline against the convergence vocabulary operates across the regimes through the structural commonality. The institution that built compliance against the regimes one at a time operates against the divergence at each perimeter and accumulates the operational overhead the convergence would have absorbed.

Penalty Schedules by Jurisdiction and Violation Type

Penalty is not punishment. It is the cost calibration the supervisory framework applies to the gap between the discipline the institution declared and the discipline the operational substrate produced.

The penalty schedules support the materiality analysis the institutions operating across the regulatory landscape conduct. The schedules are inputs to the risk-tolerance calibration the Chapter 14 Vendor Risk Lifecycle specifies, the financial-impact dimension the Chapter 12 Governance Office Blueprint incorporates, and the cost-of-non-compliance analysis the Chapter 11 MRM Stack supports.

A.3.1 UAE Penalty Schedule

A.3.2 Saudi Arabia Penalty Schedule

A.3.3 Qatar Penalty Schedule

A.3.4 Bahrain Penalty Schedule

A.3.5 Kuwait Penalty Schedule

A.3.6 Oman, Egypt, Jordan Penalty Schedules

A.3.7 Global Regime Penalty Comparison

The penalty schedules are inputs, not endpoints. The institution that operates against the penalty schedule rather than against the discipline the schedule indexes will discover that the schedule moved while the discipline did not. The discipline operating against the substrate the schedule indexes survives the schedule revisions the regulatory evolution will continue to produce.

AI Use Case to Regulatory Regime Cross-Reference Matrix

The use case is the operational unit the discipline applies to. The matrix supports the use-case approval discipline Chapter 11 specifies through the MRM Stack and the Tier 1, Tier 2, Tier 3 classification the Governance Office Blueprint Chapter 12 operationalizes.

The matrix is the operational vocabulary for the use-case approval committee. The institution operates against the matrix to identify the applicable regulatory regimes per use case, then operationalizes the discipline the regimes require through the MRM Stack the Chapter 11 specifies and the Governance Office Blueprint the Chapter 12 operationalizes.

Four use-case classifications deserve specific operational note. The first classification is the Tier 1 high-stakes consumer-facing AI (credit scoring, insurance underwriting, healthcare diagnostic, HR resume screening, biometric identification, educational scoring). These use cases attract the strictest convergent obligations across MENA, EU, and US regimes. The discipline calibrated to EU AI Act Annex III high-risk obligations the Chapter 2 specifies satisfies most other regimes by transitivity. The second classification is the algorithmic trading and securities-adjacent AI. These use cases attract sectoral securities-regulator obligations across SCA, CMA Saudi Arabia, QFMA, CMA Kuwait, FRA Egypt, and SEC. The discipline calibrated to SR 11-7 model risk management satisfies most regimes structurally. The third classification is the Sharia-AI overlay for Islamic finance products. These use cases attract the AAOIFI and IFSB standards in addition to the conventional regimes. The Chapter 7 Sharia AI Governance specifies the discipline. The fourth classification is the generative AI for content production and the customer-service chatbot use cases. These use cases attract transparency obligations under EU AI Act limited-risk provisions, SDAIA Generative AI Guidelines, and China Generative AI Measures (if China-facing). The discipline calibrated to disclosure and content-moderation obligations the Chapter 17 Agentic AI Integration specifies satisfies the convergent transparency requirement.

The matrix is the input. The use-case approval committee is the operational discipline. The Tier classification (Tier 1, Tier 2, Tier 3) the Governance Office Blueprint Chapter 12 operationalizes is the structural output the matrix produces. The institution that operates the matrix without the committee produces classification without discipline. The institution that operates the committee without the matrix produces discipline without dimensional grounding. Both are required, integrated through the operational cadence the Chapter 12 specifies.

Regulatory Authority Catalogue

The supervisory dialogue is conducted with named authorities. The catalogue specifies the authorities by jurisdiction with the supervisory style the institution operationalizes engagement against.

The authorities catalogue is the supervisory-engagement map. The institution that has cultivated relationships with the relevant authorities operates within the supervisory dialogue. The institution that has not operates against the supervisory inquiry when it arrives without the relationship the dialogue would have produced.

Regulatory Timeline (2018 through 2027)

The regulatory landscape is not static. The timeline indexes the key dates and milestones across the 2018 through 2027 horizon the institutions operating across the regulatory evolution must plan against.

The timeline is the strategic-planning input. The institution that has built discipline against the timeline operates ahead of the regulatory evolution. The institution that has not operates against each new milestone as a surprise the operational substrate is not prepared for.

Operational Notes on Table Maintenance

The tables are not finished documents. They are the operational substrate the institutional discipline must maintain through the supervisory cycles.

The discipline operates through four practices.

The first practice is quarterly review by the Governance Office Chapter 12 specifies. The review examines each table for regulatory changes, supervisory guidance, enforcement developments, and milestone advancement. The review output is a table-revision log the discipline operates against.

The second practice is supervisory-engagement integration. The relationships the Section A.5 catalogue indexes are the source of regulatory intelligence the tables capture. The supervisory dialogue is not an isolated function. It is the input the table-maintenance discipline depends on.

The third practice is cross-jurisdictional reconciliation. The institutions operating across multiple jurisdictions reconcile the table entries against the operational discipline applied per jurisdiction. The reconciliation surfaces the discipline asymmetries the multi-jurisdictional architecture must accommodate.

The fourth practice is the operational vocabulary calibration. The terms the tables use must match the terms the supervisory dialogue uses. The calibration is conducted by the operational compliance function and validated through the supervisory engagement.

Where most observers see reference tables, I see the operational vocabulary the institutional discipline depends on for the supervisory dialogue.

Stillness is not inactivity. It is the calibration that exposes the gap between the regulatory landscape the institution last documented and the regulatory landscape the supervisory dialogue currently inhabits. The institutions that have built table-maintenance discipline operate within the regulatory reality the supervisor inhabits. The institutions that have not operate against the regulatory landscape the deck described before the supervisory landscape moved.