Digital, AI & Cybersecurity in Bahrain: independent market-entry study

• Bahrain combines a subscription-dense telecom market, a centralised digital-government estate, a domestic cloud region and a concentrated regulated-buyer base. These features reduce some infrastructure friction but do not prove demand for a particular software, AI or cyber product.
• TRA records 2.59 million broadband subscriptions and 2.38 million mobile subscriptions in Q2 2025. Penetration exceeds population because subscriptions are counted, not unique people or enterprise accounts; neither figure is a proxy for technology budgets or obtainable customers.
• iGA reported more than 900 government e-services across the National Portal and MyGov in April 2026. This establishes service-estate breadth, not an open integration catalogue, procurement budget or entitlement for an external vendor.
• The 2025 National Digital Economy Strategy contains 49 initiatives to 2030. iGA reported six of nine first-phase initiatives complete in October 2025; targets and completion statements must remain separate from funded procurements and supplier access.
• Bahrain iGA reported a 93.6% composite result in the World Bank Group’s 2025 GovTech Maturity Index, including 98.3% for digital citizen engagement. The underlying World Bank methodology measures four public-sector maturity areas through 48 indicators and expressly says the GTMI is not intended to rank readiness or performance. Horizon therefore treats the figures as institutional-context evidence, not as a league table, technology budget or supplier opportunity.

• Manama, Seef and Bahrain Bay: concentration of government, financial services, professional buyers, telecom operators and enterprise decision makers. A headquarters address does not identify the operational system owner or procurement route.
• AWS Middle East (Bahrain) Region and domestic data-centre ecosystem: relevant to hosting, latency and resilience architecture, but a local region does not by itself satisfy PDPA, CBB, CNI, buyer-classification or contractual controls.
• National digital-government channels: Bahrain.bh, MyGov and eKey support shared citizen and business journeys. Integration requires an eligible service, government sponsor, identity and data approvals, architecture review and an awarded delivery route.
• Critical national infrastructure estates: finance, government, ICT, healthcare, energy, critical industry and transport have sector-specific cyber controls and accountable asset owners; the controls and buying routes are not interchangeable.

• Information and communications recorded 12.3% real growth in 2024 in the iGA national-accounts release. This is whole-activity growth and cannot be converted into software spend, AI revenue or a cybersecurity market size.
• The July 2025 national AI policy sets four pillars—legal compliance, AI adoption and use, awareness and education, and cooperation—and applies principally to government entities. It is a governance framework, not a general AI licence or procurement notice.
• The 2025–2028 cybersecurity strategy has five pillars, while the NCSC baseline contains seven control domains covering governance, training, defence, logging and incidents, third-party and cloud, OT and IoT, and audit. Applicability still depends on entity and sector status.
• The 2024 ID, population and civil-record estate processed more than 900,000 transactions, 95% through digital channels. The statistic evidences digital operating scale; it does not disclose vendor spend, system architecture or an available contract.
• iGA reported that more than 800 employees from 75 government and semi-government entities completed a three-year cloud-computing training programme spanning 2022–2024. The record indicates distributed public-sector cloud capability and a Microsoft institutional agreement; it does not identify an open training requirement, cloud migration workload or procurement route.

• iGA and the responsible ministry or authority: policy, shared-platform, identity, data, architecture and service ownership for government workloads; identify the sponsoring entity and the formal sourcing route separately.
• TRA and licensed telecom operators: regulatory and operating owners for connectivity and telecom services. A cloud, managed-service or communications feature may require activity and licence classification before a commercial proposal is executable.
• NCSC and critical-national-infrastructure entities: national or sector cyber control perimeter, risk, assurance and incident expectations. The purchasing entity remains responsible for its own tender, architecture, security and acceptance decision.
• CBB licensees: bank, insurer, payment and financial-market buyers subject to current Rulebook, outsourcing, cloud, cyber and operational-resilience controls. The customer’s licence does not automatically cover the vendor or the proposed activity.
• Private enterprise and data controller: owner of the business case, lawful processing, integration, supplier risk, security acceptance and production economics for a non-government workload.

• For government work, identify the service owner, current platform, data classification, sponsoring budget holder, architecture and cyber approvers, Tender Board or other lawful sourcing route, pilot authority and production acceptance owner. Bahrain Tender Board publishes current tenders, opening results, awards, prequalified vendors and procurement plans as separate records; use the record matching the opportunity stage.
• Tender Board supplier onboarding is an eight-step portal route: open Supplier Registration, provide the initial company information, receive credentials, sign in, complete the profile and upload the commercial-registration or accepted overseas-company document, submit for approval and retain the approval email. Each Bahrain CR branch requires a separate registration. Portal approval permits account use; it is not prequalification, technical acceptance, tender award or authorisation to perform a regulated activity.
• An overseas supplier can support a rejected-account helpdesk request with an official company document, while the FAQ requires an active licence for a Bahrain CR account. Treat this as evidence that the portal accommodates international suppliers, not as evidence that every tender accepts a foreign bid without local establishment, tender-specific eligibility or a qualified local route.
• For a CBB-regulated buyer, map the exact licence category and current Rulebook module, outsourcing or cloud classification, notification or approval route, audit rights, subcontracting, data location, incident, continuity and exit obligations.
• For telecom-related activity, confirm with TRA whether the feature is an ordinary enterprise technology service, a licensed telecommunications service or a dependency delivered through an existing licensee.
• For private enterprise, require a named workflow, measured baseline, data owner, system owner, integration path, security review, contracting authority, implementation budget and scale decision before treating a pilot as a commercial opportunity.

• Under the PDPA transfer framework, a controller may transfer data directly to jurisdictions listed in Order 42 of 2022 without prior authority authorisation; other routes require the applicable safeguard or permission. Hosting location alone does not determine transfer lawfulness.
• For personal data, record controller and processor roles, purpose and lawful basis, data categories, sensitive-data perimeter, transparency, retention, access, transfers, subcontractors, security, rights handling and breach response before design acceptance.
• For AI, preserve model purpose, training and inference data, human decision authority, performance and error thresholds, bias and rights review, security testing, logging, supplier dependencies, change control and rollback. The national policy does not certify a product.
• For cyber delivery, map the NCSC instrument that actually applies. The public register separates Baseline Cyber Security Controls, policy templates, the Cyber Trust Program, the National Cybersecurity Risk Management Framework, CNI Cybersecurity Controls and the National Cybersecurity Incident Response Plan. A strategy pillar, baseline control, CNI obligation, risk method and incident role are not interchangeable.
• For government cloud, treat Cloud First as a planning and procurement policy, not as automatic approval of a provider, region, workload or architecture. Preserve the buyer’s classification, accreditation and contract evidence.

• Choose one government or regulated-enterprise workflow and obtain the current baseline, failure cost, data classification, system owner and sponsor before proposing AI or automation.
• For cybersecurity, select one named control gap and build the evidence pack the buyer can audit: control mapping, architecture, local support, logs, response SLA, testing, subcontractors, continuity and exit.
• For cloud or managed services, price the complete regulated delivery model—local and cross-border support, security assurance, data transfer, audit, resilience, licensing, integration and exit—not only infrastructure consumption.
• Use Bahrain as a regional proof point only when the product, contract, data architecture and evidence can be re-authorised in the next GCC country; do not assume Bahrain approval transfers.
• For public-sector prospecting, create a dated procurement ledger linking the buying entity, procurement-plan entry or tender notice, tender category, eligibility, document purchase, clarification deadline, closing time, bid bond, evaluation status and award record. Stop the opportunity when no current official record supports its stage.
• For a GovTech proposition, convert the relevant GTMI component into a buyer-level diagnostic rather than a marketing claim: identify the service, current system and transaction baseline, user group, unresolved accessibility or engagement failure, data and identity dependencies, accountable authority, sourcing route and acceptance measure. A national maturity score is context; only this evidence can support a pursuit.

• Treating subscription penetration, digital transactions or government e-service counts as unique customers, enterprise spend or accessible demand.
• Presenting the national AI policy, cyber strategy or Cloud First policy as product approval, mandatory purchase or an open tender.
• Assuming a Bahrain cloud region resolves PDPA transfers, CBB outsourcing, CNI controls, buyer data classification or subcontractor risk without a workload-level assessment.
• Running an AI pilot without a named decision owner, lawful data route, human-control model, acceptance threshold, production architecture and funded conversion path.
• Using a regulated customer’s licence as a substitute for vendor activity classification, contractual allocation, security assurance or production authorisation.
• Presenting the eTendering portal’s whole-of-government supplier or tender totals as ICT demand, cybersecurity spend or a forecast of obtainable contracts.
• Treating Tender Board account approval as buyer prequalification or assuming that an overseas-supplier account removes the eligibility, establishment, licence, bid-security or technical conditions of the individual tender.
• Calling the 2025 GTMI result a commercial ranking, readiness guarantee or proof that Bahrain has a larger obtainable technology market. The World Bank describes GTMI as a maturity snapshot and explicitly says it is not intended to rank readiness or performance.

• Which named buyer, workflow, system owner and budget holder support the opportunity?
• What personal, financial, government, CNI or other controlled data enters the service, where does it move and who is accountable at each stage?
• Which CBB, TRA, PDPA, NCSC, government-cloud, sector and procurement controls apply, and what dated evidence proves each is resolved?
• What baseline and acceptance thresholds measure value, accuracy, security, resilience and user impact, and who signs the production decision?
• What local support, subcontractor, incident, audit, continuity, exit and regional re-authorisation costs remain in the downside case?
• Which dated Tender Board procurement-plan, tender, opening, award or prequalification record proves the present commercial stage, and what tender-specific rule governs foreign participation?
• Which of the four GTMI focus areas is genuinely relevant to the proposed intervention, and what buyer-owned operational evidence converts that national context into a specific, funded problem?

• Bahrain uses Sijilat as the integrated commercial-registration and licensing gateway. A commercial registration without licence can establish the legal record, but the business may operate only after all activity licences and external approvals are in place. For Digital, AI & Cybersecurity, the route is not cleared until the competent authority confirms data classification, hosting, cybersecurity, telecom, government-cloud and regulated-client requirements for the proposed architecture.
• Digital, AI & Cybersecurity establishment route to test: Bahraini company registered and licensed through Sijilat. Record the exact activity that covers the proposed offer, the ownership conditions, issuing authority, output and evidence expiry date; a neighbouring activity code is not a substitute.
• Digital, AI & Cybersecurity operating sequence: Select the legal form, activity and ownership basis. Apply for the commercial registration through Sijilat. Treat data classification, hosting, cybersecurity, telecom, government-cloud and regulated-client requirements for the proposed architecture as a separate operating gate, together with any municipal, standards and buyer registration still required after commercial registration.

• Digital, AI & Cybersecurity tax perimeter: The standard VAT rate is 10%, with zero-rated and exempt categories defined by the VAT framework. Model registration, filing, invoicing, withholding and any customs or transaction treatment against the intended entity and revenue flow; recheck every free-zone or incentive assumption before relying on it.
• Digital, AI & Cybersecurity people and work authorisation: The entity must complete Labour Market Regulatory Authority and social-insurance requirements. Use the Labour Market Regulatory Authority for employer registration, work permits and the current foreign-worker process. Map immigration, labour, professional licensing and any controlled-site access to the actual roles the operating model requires.
• Digital, AI & Cybersecurity continuing compliance: A commercial registration without licence does not authorise the activity. Maintain the accounting, beneficial-ownership, renewal, payroll and sector evidence needed for data classification, hosting, cybersecurity, telecom, government-cloud and regulated-client requirements for the proposed architecture; verify the live authority service before filing, signing or paying.

• Establishment and market-entry controls: Select the activity and establish the commercial registration (Bahrain Ministry of Industry and Commerce); Activate the activity licence and premises approvals (MOIC, municipality and the competent sector regulator). Use the cited official routes below and retain the dated output; an authority listing is not evidence that Digital, AI & Cybersecurity permission has been granted.
• Operating and people controls: Determine VAT and multinational tax obligations (National Bureau for Revenue (NBR)); Register the employer and obtain work permits (Labour Market Regulatory Authority (LMRA) and connected authorities). Use the cited official routes below and retain the dated output; an authority listing is not evidence that Digital, AI & Cybersecurity permission has been granted.
• Verification control: before commitment, open the current Bahrain authority service, confirm that the named output still applies to the exact Digital, AI & Cybersecurity activity and record any sector approval, product registration or buyer qualification that remains unresolved.

• Broadband subscriptions: 2.59m. Reference and status: Q2 2025 · TRA
• Broadband penetration: 163%. Reference and status: Q2 2025 · TRA
• Information and communications growth: +12.3%. Reference and status: 2024 · iGA
• Mobile subscriptions: 2.38m. Reference and status: Q2 2025 · TRA · subscriptions, not unique users

• Bahrain TRA: market indicators — Q2 2025. Evidence role retained in this dossier: Official connectivity evidence
• iGA: Bahrain GDP 2024 — 6 May 2025. Evidence role retained in this dossier: Official sector-growth evidence
• Bahrain National Cyber Security Centre — 3 Sep 2026. Evidence role retained in this dossier: National cybersecurity framework
• Bahrain Personal Data Protection Authority — 3 Sep 2026. Evidence role retained in this dossier: Data-protection requirements
• Bahrain Tender Board: Supplier registration FAQ — 2026-10-28. Evidence role retained in this dossier: Official overseas-document route, active-licence boundary and registration workflow for public procurement.

Market structure

• Government digital platforms and the financial sector are anchor users.
• Telecom operators and cloud infrastructure providers shape technical routes.
• CBB, TRA and data-protection requirements intersect for regulated applications.
• A digital proposition may cross several perimeters: commercial activity in Sijilat, telecommunications under TRA, personal-data obligations under the PDPA, national cyber controls and CBB requirements when a regulated financial function is involved.
• Government and regulated-enterprise procurement follow separate buyer systems. Tender Board registration may enable access but does not establish technical approval, data acceptance, award or permission to perform a regulated activity.

Opportunity lenses

• Cloud, cybersecurity or managed services only for a named regulated buyer and workload, with data location, control gap, approved architecture, incident responsibility, acceptance test and production budget.
• Digital-government or identity integration only for a named workflow, accountable public buyer, lawful data-transfer model, accepted cloud and cyber architecture and procurement route, with a baseline and production acceptance test.
• Financial or enterprise AI only for a named institution with an approved data boundary, accountable model owner, integration baseline, acceptance test and funded operational outcome.
• Cybersecurity or managed-service propositions with a named regulated buyer, current control gap, permitted monitoring model and evidence of local incident-response capability.

Risks and evidence gaps

• High penetration does not prove enterprise willingness to switch.
• The domestic addressable market is limited for generic products.
• Regulatory boundaries differ across target GCC markets.
• A high-connectivity statistic can create a false demand signal when the target workflow, incumbent system, switching cost and procurement budget have not been established.
• Data localisation, cross-border support, privileged access and subcontracted cloud or security operations can change the approval route and delivery economics.
• Portal registration can be completed without proving that the supplier meets a tender’s technical, financial, local-presence, licence, bid-bond or prequalification requirements.

Questions before commitment

• Which buyer and regulated workflow justify entry?
• Where will data be hosted and controlled?
• What regional expansion evidence is required before investment?
• Does any feature trigger CBB, TRA, PDPA or national-cyber requirements, and who has confirmed the resulting control set?
• Which baseline, acceptance test and accountable buyer would convert a pilot into a paid production deployment?
• Which official procurement record is current, what evidence permits an international supplier to bid, and which requirements remain tender-specific after portal registration?