AI and HSE Management: The Good, the Bad and the Accountable — Part 6 of 8
Summary
- There is no GCC equivalent of the EU AI Act. Unlike data protection, where most GCC states have adopted GDPR-style laws, AI expectations are arriving sector by sector and zone by zone.
Where regulators have spoken, the message is consistent: using AI does not remove the organisation’s own governance responsibilities, even where vendors, consultants or contractors also have responsibilities.
Financial regulators have produced some of the region’s most detailed AI governance requirements and guidance. Their principles translate readily into HSE and environmental compliance.
An organisation may have no AI-specific HSE regulation to follow. It cannot assume its AI-assisted HSE work is unregulated.
In the last post I argued that using AI does not remove an organisation’s existing HSE and environmental duties, even where a vendor, consultant or contractor also has responsibilities. Those occupational safety and health obligations already apply across the GCC, regardless of whether AI is used. The natural next question is how regulators expect organisations to govern AI while discharging that duty.
Many leaders in the region assume the answer is “not much yet”, because there is no AI law. That assumption is half right. There is no single AI law in the GCC. But there is a growing body of AI-related requirements and guidance, and read side by side, they say remarkably similar things.
Three layers, not one
It helps to separate three layers of requirements and governance, because they have very different status.
Layer 1: Existing statutory and regulatory HSE and environmental duties. Employer safety duties under labour law and its implementing regulations, environmental permits and their conditions, statutory reporting and applicable codes. These already apply to any decision made with the help of AI.
Layer 2: AI-specific laws, regulations and guidance. Data protection laws as they apply to AI, free-zone regulations, financial-sector AI requirements and guidance, and future sector-specific instruments. Some are binding; some are guidance.
Layer 3: corporate and contractual governance. Group AI policies, internal controls, audit protocols, client and contract requirements, and voluntary standards such as ISO/IEC 42001.
Most of the public discussion is about Layer 2. For an HSE function, Layer 1 is where the real exposure sits, and Layer 3 is often where the first concrete AI requirements arrive.
No AI Act, but plenty of requirements
For readers less familiar with it, the EU AI Act is the world’s first comprehensive, cross-sector AI law. It takes a risk-based approach: a few practices are banned, “high-risk” uses, such as AI in machinery safety components or in managing workers, must meet strict requirements, and most everyday AI faces few new rules. Its obligations are being phased in to 2028.
The contrast with data protection is instructive. Every GCC state except Kuwait now has a comprehensive personal data protection law that shares many concepts with the EU’s General Data Protection Regulation (GDPR), the EU’s 2018 law governing how personal data is collected, used and transferred. The UAE’s DIFC and ADGM free zones have their own regimes. On AI, the region has taken a different path: no horizontal law, but a growing set of sector and free-zone requirements. Data protection laws are one important source of binding obligations where AI processes personal data, alongside applicable sector, cybersecurity and other legal requirements.
Beyond data protection, AI is governed through a mix of regulation and guidance, and the difference between them matters.
In the UAE, the UAE Charter for the Development and Use of Artificial Intelligence, issued in 2024, sets out principles including transparency, accountability and human oversight, but it is guidance, not law. The Dubai International Financial Centre has gone further. Its Regulation 10, issued in 2023, governs the processing of personal data through autonomous and semi-autonomous systems, with requirements for notices and records and, where the regulation’s high-risk conditions are met, the appointment of an Autonomous Systems Officer. The DIFC consulted on amendments to refine Regulation 10 and clarify the Officer’s role in mid-2026; until those amendments are enacted, the 2023 text remains the operative position.
In Saudi Arabia, the National Cybersecurity Authority’s controls apply to organisations within their scope, including the AI systems those organisations run. The Saudi Data and AI Authority has published AI Ethics Principles, generative AI guidelines and an AI Adoption Framework. These are not binding, but they set clear expectations around accountability, transparency and human oversight.
The financial regulators are writing the template
Some of the region’s most developed sector-specific AI governance requirements have come from central banks.
The Qatar Central Bank’s 2024 Artificial Intelligence Guideline requires regulated entities to establish AI governance arrangements, make their boards and senior management accountable for AI outcomes, maintain AI registers and provide human oversight. It also requires the regulator’s approval before an entity launches a new AI system as a provider or materially changes one, and before it signs any high-risk AI purchase, licensing or outsourcing agreement.
The Central Bank of the UAE followed in February 2026 with a guidance note on the responsible use of AI by licensed financial institutions. It is framed as supervisory guidance rather than mandatory rules, but its expectations are direct. Senior management and the board “should be responsible and accountable for AI and ML systems and outcomes”. Institutions “should not employ AI models that they have no control over”, and they remain responsible for AI functions they outsource to third parties. Decisions with significant consequences require “meaningful human oversight and judgement”. And every institution should keep an inventory of its AI models, recording at least each model’s name, purpose and risk rating.
These financial-sector requirements and supervisory expectations were not written specifically for HSE, and do not automatically apply to organisations outside their scope. But the underlying principles can be adapted to HSE operations, and they are more concrete than a general call for “responsible AI”.
What this means on a GCC worksite
Financial-sector principle | Practical HSE application |
Board accountability | Management remains accountable for decisions made using AI-generated HSE advice, even where contractors or software suppliers produce it. |
AI inventory | Record each AI use case and its responsible owner, not just the tool, across risk assessments, incident investigations, legal registers, environmental reporting and inspections. One tool may support several activities with very different risks. |
Risk-based human oversight | Require competent approval before AI-assisted decisions affect lifting, confined-space entry, isolation, hazardous materials or other high-consequence activities. |
Independent monitoring | Periodically sample AI-generated outputs against the actual legal requirements, technical standards and worksite conditions. |
Third-party control | Require access to the legal and technical sources behind material HSE outputs, documented limitations, change controls and appropriate contractual rights, and be able to suspend a tool that proves unsuitable. |
Meaningful human oversight requires more than signing an AI-generated document. The reviewer must have the competence, authority and information needed to challenge its assumptions, identify omissions and reject an unsuitable output. The UAE Central Bank’s guidance makes the same distinction, between humans who approve each decision and humans who monitor a system and can intervene.
Consider a construction contractor using generative AI to prepare risk assessments and method statements. Does the company know which tools are being used? Has it assessed whether they are suitable for safety-critical work? Who verifies the output before approval?
Or consider an industrial operator using AI to maintain its environmental legal register. Who checks that the system has identified the correct federal, emirate-level and permit-specific requirements? What happens when legislation changes? Can the organisation show which legal sources were checked and which obligations were verified?
Now make it concrete. The operator’s AI-assisted register captures the published environmental legislation but omits a site-specific permit condition requiring quarterly emissions monitoring. The team reports satisfactory compliance, because its review checks whether the register’s entries are being met without checking whether the register is complete. The monitoring has not been done, and the omission surfaces only during an external audit.
The lesson is a distinction that matters well beyond AI: checking that listed obligations are satisfied does not establish that all applicable obligations were identified in the first place.
These are not exotic AI governance questions. They are familiar HSE management questions applied to a new technology. The financial regulators’ approach offers a practical starting point: identify the AI in use, assess its risks, assign responsibility, require meaningful human oversight, and keep evidence that the controls actually operated.
Where HSE regulation may go next
It would be premature to predict exactly how GCC HSE and environmental regulators will address AI. Some may issue dedicated guidance. Others may adapt existing management-system, risk-assessment and competence requirements, such as those already set out in Abu Dhabi’s ADOSH-SF. Others again may introduce rules for particular high-risk applications, such as AI used in process control, inspection or safety-critical machinery. The future may well involve all three.
But the financial-sector experience gives a clear indication of the principles likely to matter: accountability, transparency, documented risk assessment, human oversight and control of third-party systems.
The regulatory pathway remains uncertain. The direction of responsible governance is considerably clearer. An organisation that applies those principles now will be better prepared to respond, whichever regulatory pathway emerges.
What travels with the multinational
For many organisations in the region, AI governance requirements arrive through corporate policy before they appear in local regulation.
A European group may adopt controls shaped by the EU AI Act, which is becoming applicable in stages. Several of its provisions already apply, while its obligations for high-risk systems now apply from 2 December 2027 for specified stand-alone high-risk AI systems, and from 2 August 2028 for AI built into regulated products such as machinery. A British parent company may follow the UK’s principles-based approach. Groups headquartered in the United States or Asia face a different mix of national, state and sector-specific rules.
The approach will be familiar to any GCC HSE manager. Just as multinationals often apply group safety standards that exceed local minimum requirements, they increasingly apply group AI governance standards across all their operations, often shaped by the strictest jurisdiction they are exposed to.
The rules also travel in the other direction. A GCC company that sells AI-enabled products into Europe, operates sites there, or supplies AI-generated output used there may fall within the EU AI Act directly. For HSE, a clear potential case is a manufacturer exporting AI-enabled machinery or PPE into Europe. Where the system meets the Act’s high-risk classification criteria, the relevant obligations apply from August 2028. More often, the Act will arrive through contracts, as European customers pass their own obligations down the supply chain.
ISO/IEC 42001, the international standard for AI management systems, offers one widely recognised framework for doing this consistently. It does not replace applicable legislation in any jurisdiction, but it provides a common framework that organisations can adapt across jurisdictions.
For a regional HSE manager, the practical question may therefore be less about when a local regulator issues AI requirements, and more about whether the organisation can already demonstrate compliance with its own group standards.
The question for leaders
The most important development is not that GCC regulators are beginning to address AI. It is that the principles of responsible AI governance are becoming recognisable across sectors and jurisdictions.
For HSE and environmental leaders, waiting for a specific AI regulation is therefore hard to justify.
If your organisation uses AI to prepare risk assessments, interpret legislation, investigate incidents or verify compliance, can you identify the tools involved? Can you show who reviewed their outputs, which sources were checked, and how a material error would be detected?
The question is no longer simply whether AI is regulated. It is whether your organisation can demonstrate that its use of AI is controlled, accountable and auditable. That is where this series turns next.
Why Redlog Is Building for This Future
At Redlog, we are building compliance intelligence tools on the principles set out in my previous series: curated and expert-validated regulatory content, jurisdiction-specific coverage, source traceability, applicability-aware outputs, and an expert-in-the-loop model that keeps professional accountability where it belongs.
This series adds a further principle. AI should strengthen the professional’s judgement, not stand in for it. Tools that show their sources and flag their uncertainty prompt the professional to check, challenge and decide. That keeps them in the left-hand column.
We are publishing this series because the conversation about AI and accountability in HSE should happen inside the profession. It should be shaped by people who understand regulatory compliance, duty of care, operational risk and the consequences of getting this work wrong.
AI will change HSE practice. That is no longer the question. The question is whether the profession will shape that change with judgement, governance and accountability, or allow it to be shaped elsewhere.
If that is how you think AI should work in HSE compliance, it is the conversation we want to have, starting with our webinar.
This is Part 6 of AI and HSE Management: The Good, the Bad and the Accountable. The previous series, AI and the HSSE Profession: What’s Actually Changing, and all of our prior blog posts are available at www.redlogenv.com/blog.
Webinar – Join us on November 16, 10:00 AM CET/ 11:00 AM UTC+3
Webinar: AI, Accountability and HSE Compliance in MENA — What Every Business Leader Needs to Know
Join us for a discussion with our experts to learn more about where liability sits when AI-assisted compliance work goes wrong, what regulators are starting to expect, and what good governance looks like in practice, and more. Register here
- The GCC Is Writing the Rulebook, One Regulator at a Time - November 3, 2026
- The Signature Is Still Yours - October 26, 2026
- The Leak Nobody Noticed - October 19, 2026