Digital, AI & Cybersecurity current GCC market status and evidence monitor

Executive summary

Evidence

Findings

• Saudi Arabia’s Digital Government Authority assessed 50 government platforms in its 2025 Digital Experience Maturity Index. The aggregate result was 86.71 percent at the Advanced level, 1.67 percentage points higher than the 2024 cycle; the user-experience perspective reached 88.53 percent. This is a measured public-service maturity indicator, not a count of opportunities or evidence that an assessed platform seeks a new supplier.
• The Saudi index’s leading results include Absher at 93.95 percent, the Zakat, Tax and Customs Authority platform at 93.25 percent, Tawakkalna at 91.89 percent, Etimad at 91.43 percent and Qiwa at 91.06 percent. These scores help calibrate service, availability and integration expectations. They should not be used to rank prospective customers or imply permission to access their systems.
• CST’s first-half 2026 report measured access latency for 19 registered Class C cloud providers across 31 data centres and four telecommunications providers. The best reported result was 12 milliseconds. The metric concerns the tested route and methodology; it does not establish workload capacity, application response, cyber approval, resilience, commercial price or data-location compliance.
• CST’s technology-enterprise registration publishes a five-working-day service target and no fee. Eligibility includes operation in the relevant technology and emerging-technology classifications, a valid office licence and supporting company records. The resulting registration is a business classification and directory route; it is not a product certification, cloud registration, telecom licence, security accreditation or award.
• Saudi NCA’s Cloud Cybersecurity Controls 2:2024 extend the Essential Cybersecurity Controls for both cloud service providers and cloud service tenants and were updated for data-localisation requirements. The controls require an approved responsibility model and cloud-risk treatment, but applicability still depends on the entity, information classification, service model and workload. A provider’s generic control statement cannot substitute for the tenant’s architecture, responsibility matrix and acceptance record.
• SDAIA’s AI Service Provider Accreditation is a product-governance sequence, not a general right to sell AI. The official service requires the entity to be registered on the National Data Governance Platform, appoint an AI officer, add the product and submit the questionnaire and evidence for committee review. The Incentive Badge precedes the accreditation certificate. Neither output proves procurement, sector approval, production safety or fitness for a buyer’s data and decision.
• The underlying private-entity registration requires an active commercial registration and an authorised representative delegated through the Saudi Business Center. It includes assessments for DPO appointment and AI ethics before the National Personal Data Protection Register certificate is issued. Entity registration, controller registration, DPO determination, AI ethics assessment and product accreditation must therefore remain separate records.
• The National Data Governance Platform exposes different services for controller registration, data-product and service-provider registration, privacy impact assessment, personal-data breach notification, regulatory sandbox participation, AI ethics assessment and approval of a data-sharing method. They are not interchangeable badges. A vendor must identify which legal duty or customer requirement each receipt addresses and which remain unresolved for the actual processing chain.
• The platform also provides public verification routes for registration certificates. Verification can confirm the named entity and record, but it does not validate the current product version, model behaviour, training data, hosting architecture, subcontractors, security posture, sector permission or customer deployment. Those elements require their own evidence and change control.
• TDRA’s September 2025 account reports more than 11 million UAE PASS users, more than 15,000 services across more than 350 entities, more than 2.6 billion digital transactions, 600 million logins, 17 million document shares and 96 percent user satisfaction. The platform’s scale indicates a mature national identity and transaction environment. A private supplier still needs an eligible use case, a sponsoring entity, approved integration and a commercial route.
• TDRA’s current Cloud Service Providers initiative is explicitly a voluntary information form intended to improve transparency and regulatory collaboration. The provider logs in with UAE PASS and submits information. Participation must not be represented as a UAE cloud licence, security assessment, data-residency approval, government framework position or permission for a regulated workload.
• Qatar’s Digital Agenda 2030 records approximately 96 percent 5G population coverage and nearly 99 percent fibre coverage. It also sets targets exceeding QAR 40 billion of non-hydrocarbon GDP impact and 26,000 jobs by 2030. Coverage is an infrastructure baseline; the economic numbers are policy targets. Neither should be converted into a software, AI, cloud or cybersecurity market-size claim.
• Qatar’s cloud interoperability and portability regulation applies to cloud services supplied to customers in the State and expressly sits alongside Personal Data Privacy Protection Law No. 13 of 2016. Its existence does not produce one universal hosting answer: highly sensitive data, government classification, regulated sectors and individual buyer controls still require workload-level verification.
• Qatar’s Cloud Policy Framework begins with data classification and shared responsibility. For classified government data it places control of encryption, including how keys are stored and managed, with the information owner. That policy-level allocation does not prove that a proposed provider, key-management design or cross-border architecture has been accepted by the data owner, sector regulator or procuring entity.
• Bahrain’s Law No. 30 of 2018 covers personal-data processing and cross-border transfers, while Central Bank rules add sector-specific outsourcing and cloud controls for licensees. The reviewed CBB module specifies a route that can require submission at least 30 calendar days before commitment or post-notification within five working days after signing, depending on the arrangement. Applicability must be determined from the current rulebook and exact contracting chain.
• Kuwait’s CITRA cloud framework uses four data-classification tiers and allocates duties to both cloud subscribers and providers. Higher-classification and public-sector workloads bring residency, transfer and provider-permission controls. A provider must hold the registration or licence applicable to the actual service and data tier; an international cloud brand, reseller status or permission for a different product does not approve the workload.
• Oman’s current Ministry guidance identifies specified sensitive-data categories that require a processing permit unless an exemption under the amended law applies. The Ministry publishes a maximum 45-day decision period after a complete file and a permit term of up to five years. That permission addresses data processing; it is not a security certificate, government-vendor registration or production acceptance.
• Oman also publishes controller and processor obligations, processing records, transfer-risk assessment and breach handling, including a 72-hour notification duty where the relevant risk condition is met. Its 2026 Cloud First Policy separately directs most government entities to prioritise cloud and contract only with TRA-authorised providers. The privacy permit, provider authorisation, buyer control review and procurement award must not be collapsed into one status.
• Across the four priority markets, infrastructure scale, government maturity, strategic ambition and regulatory frameworks describe different things. They cannot be combined into a single GCC digital-market figure. Commercial evidence starts with a named buyer, workflow, budget, decision owner, lawful data architecture, qualification route and production acceptance plan.
• Government and enterprise service redesign where baseline time, cost, error, backlog, fraud, service quality or risk can be measured before implementation
• Cloud modernisation constrained by workload and data classification, residency, transfer, encryption, key custody, privileged access, logging, portability and exit requirements
• Decision-chain evidence: The business owner defines the workflow, accountable decision, baseline, benefit case, risk tolerance and production acceptance threshold. Record the named institution, accountable role, current need and dated route into the decision.
• Decision-chain evidence: The data owner, privacy, legal and records functions determine purpose, authority, minimisation, retention, transfer, disclosure and data-subject handling. Record the named institution, accountable role, current need and dated route into the decision.
• Evidence gate: A workflow and decision record identifies users, inputs, outputs, human authority, failure modes, baseline and the specific condition the system is intended to improve.
• Evidence gate: A data inventory states source, category, purpose, lawful basis or authority, controller, processor, recipients, location, transfer, retention and deletion.

Method and limits

How this brief was produced

Horizon integrated official sector authorities, multilateral or research sources and the reviewed GCC sector dossier. The brief tracks market structure, commercial signals and evidence gates without inventing a regional market-size number.

Original sources