Does the EU AI Act Apply to Your MENA or Gulf Company? (2026 Scope Guide)

Yes, it can. The EU AI Act applies to companies outside Europe when they offer an AI system on the EU market or when the output of their AI is used inside the EU. You do not need an EU office or server to be covered.

The two triggers that put a MENA or Gulf company in scope

The Act reaches beyond Europe’s borders. You are in scope if either of these is true:

• You place an AI system on the EU market: you sell, license or otherwise make it available to users or businesses in the EU.
• Its output is used in the EU: the system runs in the UAE, Saudi Arabia, Egypt or Morocco, but its results (scores, recommendations, generated content, decisions) are used by people or companies inside the EU.

In practice, a Gulf software company with European customers, a North African agency delivering AI-generated work to EU clients, or a lender whose model scores EU applicants can all be caught.

Which risk tier are you in?

Obligations depend on what your AI does, not on the size of your company:

• Prohibited: practices such as social scoring and manipulative systems.
• High risk: AI used in hiring, credit and insurance, education, essential services, biometrics and critical infrastructure. This tier requires risk management, data governance, human oversight, technical documentation and a conformity assessment.
• Limited risk: chatbots, AI-generated content and deepfakes must be clearly disclosed to the people who see them.
• Minimal risk: most other AI, such as spam filters, with no new obligations.

Most companies we meet use AI in the limited or minimal tiers, with one or two systems worth a closer look.

What is the timeline?

The Act is being applied in stages. The bans on prohibited practices and the rules for general-purpose AI models already apply. Most remaining obligations, including the high-risk requirements, are scheduled to apply from August 2026. The EU has also discussed adjusting parts of the timetable, so check the current dates with your adviser before you plan around them.

Penalties scale with global annual turnover and are highest for prohibited practices. Fines are the end of the road; the more common cost is a European client who asks for your compliance file before signing and you do not have one.

Three typical situations in MENA and the Gulf

A software company in Dubai with European customers. Its product includes an AI feature that recommends actions to users in France and Germany. The feature is on the EU market, so the Act applies. If the feature only suggests and a person decides, it is probably limited or minimal risk; the main duties are transparency and good documentation.

A Moroccan agency producing AI-assisted content for EU clients. The output is used in the EU. Generated content that could be mistaken for human-made material should be disclosed, and the agency should be able to show how it checks what it delivers.

A lender or recruiter screening EU applicants with a model. Credit scoring and hiring are high-risk uses. This is where the heavy obligations sit: risk management, human oversight, documentation and a conformity assessment before use.

Why acting early pays off

The work behind compliance is mostly good practice: knowing which AI you use, who checks it and where data goes. Companies that do it early answer client questionnaires quickly, win tenders that ask for it, and avoid rebuilding systems later. Companies that wait tend to discover the gaps in the middle of a sale.

It also helps outside Europe. Regulators in the Gulf and North Africa are publishing their own AI and data rules, and many follow similar ideas: know your systems, keep a person in charge of important decisions, be open with the people affected. A clean inventory and clear documentation serve all of them at once.

Finally, it protects the product. Teams that document how their AI is checked usually find weak spots early: a model nobody re-tested after an update, a chatbot that answers outside its brief, a data source nobody can explain. Fixing those is cheaper before a client finds them.

What a MENA or Gulf company should do now

• List your AI. Every system and model you build, use or resell, and where its output lands.
• Classify each one against the risk tiers to see what actually applies.
• Map the gaps for anything high-risk or client-facing: human oversight, documentation, data governance, transparency notices.
• Name an owner and a date for each gap.
• Keep the file current. Clients and regulators ask for evidence, not intentions.

How OWL & GOATS helps

We run an EU AI Act readiness assessment for EU and MENA companies: an inventory of your AI, a risk classification, a gap analysis and the documentation you need, written in plain language and reviewed by a founder. Our AEGIS specialist prepares the first draft; a person checks every conclusion. We are not a law firm: for a legal opinion, we work alongside your lawyer.

You can start with the free AI readiness audit to see where you stand, or ask for a fixed quote for the full assessment. A founder replies within one business day. We work in English, French and Arabic, which matters when your teams, clients and regulators do not share one language.

What you receive is practical: a list of your AI systems with their risk tier, the gaps that matter for each one, the notices and documents to put in place, and a short plan with owners. It is written so your team can maintain it after we leave.

Read next

• Fixed-Price EU AI Act Readiness Assessment
• Ready for Europe’s new rules
• Free AI Readiness Audit
• Systems & Operations

Questions