Reflections from The Managing Partner

Legislators and regulators across the MENA region are taking steps to both support technological transformation and manage its emerging risks.

Artificial intelligence, which was once treated with skepticism, has become a core component of day-to-day business operations. This is largely thanks to governmental initiatives enabling its further development and adoption. In the KSA, for example, a new Copyright Protection Law recently came into effect that allows copyrighted works to be used to improve AI products and algorithms.

But with great technological advancements come greater opportunities for them to be exploited by cybercriminals for illicit gain. AI-driven digital fraud, including deepfake impersonation, is being used to exploit security gaps in centralised digital systems designed to enable smooth customer experiences and seamless record management. It is also being used to take advantage of AI governance weaknesses within businesses.

Recent IBM analysis found that, among the 602 organisations worldwide impacted by data breaches between March 2025 and February 2026, one in four were caused by AI-enabled attacks — a 56% increase on the previous year. Most of the attacks comprised deepfake impersonation and AI-enabled malware. The most targeted entities were in critical infrastructure sectors, particularly financial services and energy organisations. Importantly, 68% of the breached organisations lacked AI governance to manage AI risks or detect employee use of unapproved ‘shadow AI’ tools, which for many resulted in lost or compromised data. The Middle East recorded the second-highest average cost of a data breach worldwide, at USD 8 million.

KSA enforcement authorities have taken a strong stand against digital fraud, with several noteworthy recent cases. KSA regulators have also introduced minimum cybersecurity requirements for private-sector organisations to reduce risks from internal and external threats. Meanwhile, Dubai’s Court of Cassation recently demonstrated that employee digital theft of confidential company data can result in significant criminal penalties.

In the event of a data protection incident, transnational organisations will need to carefully navigate the differing notification requirements across the MENA region; there is no consistent 72-hour rule for reporting personal data breaches. Particularly noteworthy is Oman’s recent update to its Personal Data Protection Law that is now extraterritorial in scope, similar to the EU’s General Data Protection Regulation. The UAE also recently updated its National Cloud Security Policy, which contains comprehensive data localisation and sovereignty requirements for certain cloud-service providers.

As always, specialist legal advice on the nuances of each jurisdiction’s requirements and regulatory approaches is essential to ensure full compliance and address any unintended gaps in your organisation’s defences. Please do not hesitate to get in touch with our team for a chat on how we can best support your business.

Jody Waugh
Managing Partner