Governance and Policy ManagementISO 42001 in the GCC: Where AI Governance Fits with Your Existing Controls
AI adoption across the GCC is moving faster than many governance programmes can document it. Business teams are deploying generative AI, analytics models, decision systems and third-party AI services while security, privacy, procurement and risk teams try to determine who owns the resulting exposure.
ISO/IEC 42001 gives organisations a management-system structure for governing that activity. Published in 2023, it is designed for organisations that develop, provide or use AI systems. In the GCC, its relevance is growing as regional AI policy places more weight on accountability, privacy, risk management, fairness, transparency and safe use.
The key point is that ISO 42001 should not be treated as a completely separate compliance programme. Organisations with mature ISO 27001, privacy, third-party risk and enterprise risk processes already have part of the foundation. The work is to extend that foundation to AI-specific decisions and evidence.
There Is No Binding AI Statute, but There Are Layers
A 2026 regional review finds no GCC state has a binding horizontal AI statute. Governance runs through data protection, sector supervisors, and guidance.
Jurisdiction | Instrument | Status |
|---|---|---|
DIFC | Regulation 10, on personal data processed by autonomous and semi-autonomous systems, enacted 1 September 2023 | Binding within the DIFC |
UAE federal | AI Charter (2024); CBUAE AI and machine learning guidance note of 23 February 2026 | Non-binding, and supervisory |
Saudi Arabia | SDAIA AI Ethics Principles, Generative AI Guidelines, AI Adoption Framework, and National AI Risk Management Framework (July 2026) | Non-binding guidance, with binding PDPL duties where personal data is used |
Qatar | QCB Artificial Intelligence Guideline, in force 4 September 2024 | Mandatory for QCB-licensed entities |
The table draws on reviews by Nabeel Khan, Modulos, GRC Lens, and Invisom, and several instruments are still moving, so check current texts. GRC Lens notes one ISO 42001 management system can be mapped to SDAIA’s principles and risk framework, the UAE Charter, and the evidence DIFC Regulation 10 certification expects.
What You Already Run, and What Is New
Control area | What an existing program provides | What ISO 42001 adds |
|---|---|---|
Policy and roles | Information security policy, assigned owners | An AI policy, named accountability per AI system |
Risk management | A risk method and register | AI-specific risk and objectives, with ISO 23894 as a companion guide |
Asset inventory | An information asset register | An AI system inventory with the resources each depends on |
Suppliers | Supplier assessments and contracts | Third-party AI and customer relationship controls |
Incidents | Incident handling | AI-specific incident and change handling |
Impact assessment | Privacy or risk assessments | AI system impact assessment covering individuals, groups, and societies |
Data and lifecycle | Data classification and change control | Data provenance, quality, and lifecycle controls for AI |
Transparency and use | Awareness training | Information for interested parties and human oversight of AI use |
Controlstack names supplier relationships, incident management, and asset documentation as the main overlaps, and Surecloud says data lineage, model cards, and impact assessment are net new. Secureslate puts the new work at the AI inventory, impact assessments, data provenance, and lifecycle controls.
Where GCC Requirements Meet ISO 42001
ISO 42001 is an international management-system standard, not a substitute for national regulation. Its value in the GCC comes from giving organisations a consistent governance structure that can sit alongside local expectations.
Saudi Arabia provides a clear example. SDAIA’s AI Ethics Principles address fairness, privacy and security, reliability and safety, transparency and explainability, and accountability. SDAIA has also published an AI Adoption Framework and a National AI Risk Management Framework. In the UAE, the national AI policy position and AI charter emphasise responsible governance, safety and ethical use.
For regional organisations, the practical model is to map these obligations and principles to one operating control set. ISO 42001 can provide the AIMS structure while local rules, sector expectations and organisational policies define additional requirements where needed
Build an AI Control Overlay, Not a Second GRC Programme
A useful implementation starts with your existing control library. Mark each control as reusable, extendable or AI-specific.
Reusable: access management, change management, incident response, policy governance and internal audit may already work with minor scope changes.
Extendable: vendor risk, privacy impact assessment, data classification and risk assessment often need new AI-specific questions and evidence.
AI-specific: model inventory, AI impact assessment, human oversight, model performance monitoring, responsible-use criteria and AI lifecycle records may require new controls.
This approach keeps ownership clear. One control remains one control, even when it supports ISO 27001, ISO 42001 and a regional requirement at the same time.
Complyan already supports this model through its ISO/IEC 42001 compliance workflow and its broader framework library. Requirements can be mapped to existing controls, owners and evidence so teams can see which parts of the AIMS are already covered and where a genuine AI governance gap remains.
Organisations can also use Complyan AI for selected governance workflows while keeping human approval and accountability in the process.
Conclusion
ISO 42001 gives GCC organisations a structured way to govern AI without discarding the security and compliance work already in place. The strongest programmes reuse mature controls where the intent is genuinely shared, extend controls where AI changes the risk, and create new controls only where the technology introduces a distinct governance requirement.
That produces an AIMS that can be operated, evidenced and improved rather than a parallel set of policies maintained only for certification.
Frequently Asked Questions About Vendor Risk Scoring
Is ISO/IEC 42001 mandatory in the GCC?
ISO/IEC 42001 is a voluntary international standard unless a regulator, contract, procurement requirement or internal policy makes certification or alignment necessary. Local AI, privacy and sector requirements still apply independently.
Can ISO 27001 controls be reused for ISO 42001?
Yes, where the control intent and scope genuinely overlap. Governance, access control, supplier management, incident handling, audit and corrective action are common areas for reuse, but AI-specific risks and impact controls still need separate treatment.
Do organisations that only use third-party AI need ISO 42001 controls?
Yes. ISO 42001 applies to organisations that develop, provide or use AI systems. Using a third-party model does not remove the need to govern data, supplier risk, human oversight and the business use case.
What should be included in an AI inventory?
At minimum: system purpose, business owner, provider or model, users, data sources, affected processes, lifecycle stage, risk tier and relevant regulatory or contractual obligations.
How can Complyan support ISO 42001 readiness?
Complyan can manage ISO 42001 requirements alongside existing frameworks, map controls, assign owners, connect evidence, track AI-related risks and support audit readiness from one GRC workspace.