AI-driven cybersecurity in the gulf states: governance challenges and a proposed GCC-wide ethical framework

Abstract Artificial intelligence (AI) presents substantial opportunities to strengthen national cybersecurity in the Gulf States while raising significant governance challenges related to algorithmic bias, privacy protection, accountability, and potential misuse. This study examines the deployment and governance of AI for cybersecurity in Qatar, Saudi Arabia, and the United Arab Emirates (UAE). It assesses the effectiveness of AI applications in threat detection and response, identifies regulatory gaps relative to international standards, and proposes a regionally tailored governance framework. Guided by Technological Governance Theory, which emphasizes multi-stakeholder collaboration and adaptive policymaking, and the Strategic Alignment Model, which evaluates the coherence between technological initiatives and national security objectives, the research employs a mixed-methods approach. Quantitative analysis draws on aggregated cyber incident data (2018–2025) from GCC cybersecurity agencies, with conservative estimates and sensitivity analyses to account for under-reporting (60–100% completeness range). Qualitative components include thematic analysis of policy documents (e.g., Qatar’s National AI Strategy and the EU AI Act), comparative case studies of facial recognition systems, predictive threat intelligence, and smart policing applications, and 12 semi-structured expert interviews. Results indicate meaningful efficiency gains, such as reduced breach response times and strong domain-specific detection rates, though these are caveated by data limitations and varying audit coverage. The study proposes a novel GCC-wide AI governance framework comprising four integrated layers: regulatory (risk-based classification), technical (explainable AI methods such as SHAP/LIME, federated learning, and differential privacy), oversight (mandatory bias audits, human-in-the-loop requirements, and an independent GCC AI Ethics Council), and capacity-building (workforce development and regional intelligence sharing). This framework differentiates itself from the EU AI Act through enhanced focus on state sovereignty and cultural alignment, and from Singapore’s Model by incorporating stronger enforcement and data localization mechanisms for critical infrastructure. The findings contribute to the literature by offering an operational model that balances security effectiveness with ethical imperatives. The Gulf States are positioned to play a leading role in responsible AI governance, contingent on robust implementation and enforcement.