AI compliance frameworks for the Middle East, the Far East and Australasia

Ops Intel writes AI compliance frameworks for small and medium businesses worldwide. Until now, that meant the UK, the EU, the US and Canada. It now also means three more regions: the Middle East, the Far East and Australasia.

We planned to open these three regions next year. Demand had other ideas. Businesses across the Gulf, Asia and Australasia have been finding our analysis of their AI law in numbers we did not expect — and until now, reading it was all they could do. So we brought the launch forward to September.

Take a recruitment firm in Leeds that places candidates with a client in Dubai, and screens CVs with an AI tool. It has no office in the UAE. But the UAE's federal data law reaches a business outside the country that handles the personal data of people inside it — so that firm is answering to a law it has never read. That is the gap these frameworks close.

The Middle East

The Gulf is usually described as having no AI law. For the Dubai International Financial Centre that is simply wrong. Regulation 10 of the DIFC Data Protection Regulations governs personal data processed through autonomous and semi-autonomous systems, and it binds the business using the system — whether or not it built the tool.

Across the wider UAE there is no single AI statute, but the federal data protection law reaches a business outside the UAE that handles the personal data of people inside it. Saudi Arabia's Personal Data Protection Law reaches processing by any party outside the Kingdom. Qatar's central bank imposes hard AI rules — on the banks and insurers it licenses, and nobody else.

See what applies in the Middle East

The Far East

South Korea is the one that legislated properly. Its AI Framework Act is in force and reaches conduct outside Korea by the effect it has on the Korean market. Japan passed an AI Act and deliberately left the penalties out. China's generative AI rules are aimed at whoever provides such a service to the public there — but its Personal Information Protection Law reaches businesses outside China that serve people in China, and asks for a representative inside the country. Singapore has no AI statute, and its binding personal data law applies to what your AI does with people's data.

See what applies in the Far East

Australasia

Australia has no AI Act. That is easy to hear as "nothing to do", and it is the opposite: the law you already have — privacy, consumer, anti-discrimination — is the law that governs what your AI does, and the one hard deadline sits in the Privacy Act. It asks a question most firms cannot yet answer: which of your decisions are made by a computer, and what does it use to make them? Small businesses under the turnover threshold are outside it. New Zealand has no AI statute either, and its Privacy Act has no small-business exemption.

See what applies in Australasia

What you get

Each region has its own framework, written for your business and the countries you work in: which of them reach you and on what basis, your AI policy, staff guidelines, and the documents each law expects you to hold. It renews yearly, with legal updates included.

Not sure whether any of it applies to you? The free AI risk checker answers for all three regions: https://www.opsintel.io/ai-risk-checker/