Gulf region

Runtime authority for Gulf sovereign AI.

Across the GCC, AI programs are moving from policy declarations to provable runtime accountability under UAE PDPL, Saudi PDPL, Bahrain PDPL, Qatar PDPL, SAMA's AI guidance, DIFC and ADGM data regulations. KYE Protocol™ is the runtime authority and evidence layer that lets a Gulf organisation prove the chain — from a record sealed at the moment of action, in the customer's own region, under the customer's own keys.

Apply for Gulf pilotCoverage maps

KYE Protocol™ for the Gulf, step by step

Demo data

You learn: What happens at each step. You can: Step through it.

  1. Step 1 of 4

    KYE Protocol™

    UAE / KSA / Bahrain / Qatar data residency

    deploy to the customer's region via Cloudflare's regional services where supported, or BYOC to a sovereign cloud the customer already operates.

  2. Step 2 of 4

    KYE Protocol™

    Customer KMS / HSM

    signing keys never leave the customer's control. KYE™ never accesses private key material.

  3. Step 3 of 4

    KYE Protocol™

    Offline verifier

    CBB, SAMA, QCB, ADGM and DIFC auditors can replay an Evidence Pack™ using only the publisher's JWKS — no vendor dependency in the audit path.

  4. Step 4 of 4

    KYE Protocol™

    Cross-jurisdiction transfer

    signed routing records make GCC cross-border processing transparent to regulators on both sides.

How this widget is built
Demonstrates
KYE Protocol™
Components
  • The steps this page describes
Flow
Each step in order, as the page sets it out. Architecture diagram
Used on

Gulf frameworks · per-jurisdiction

Each GCC member, mapped explicitly.

🇦🇪 United Arab Emirates

Federal Decree-Law No. 45/2021 (PDPL) + UAE AI Office strategy + DIFC Data Protection Law + ADGM Data Protection Regulations 2021.

🇸🇦 Saudi Arabia

PDPL (Royal Decree M/19) + SAMA's AI principles for financial institutions + SDAIA AI Ethics framework.

🇧🇭 Bahrain

PDPL (Law No. 30/2018) + CBB's risk-management guidance for AI in financial services.

🇶🇦 Qatar

PDPPL (Law No. 13/2016) + QCB AI risk-management circulars + Qatar AI National Strategy.

Per-requirement bijection maps for each Gulf jurisdiction are on the framework-coverage roadmap. Apply for the Gulf pilot to access pre-publication coverage detail.

Gulf-sovereign deployment

In-region, customer-keyed, offline-verifiable.

  • UAE / KSA / Bahrain / Qatar data residency — deploy to the customer's region via Cloudflare's regional services where supported, or BYOC to a sovereign cloud the customer already operates.
  • Customer KMS / HSM — signing keys never leave the customer's control. KYE™ never accesses private key material.
  • Offline verifier — CBB, SAMA, QCB, ADGM and DIFC auditors can replay an Evidence Pack™ using only the publisher's JWKS — no vendor dependency in the audit path.
  • Cross-jurisdiction transfer — signed routing records make GCC cross-border processing transparent to regulators on both sides.

Gulf pilot

Shadow mode first. Evidence before enforcement.

Gulf pilots begin in shadow mode — observe the delegated-action chain, produce signed Evidence Packs™, identify authority gaps — without blocking production. Selective Guard promotion follows, one narrow action class at a time, with first-class rollback.

Apply for Gulf pilot

Independent — no government affiliation. KYE Protocol™ is an independent protocol and is not affiliated with, endorsed by, or part of any government, regulator, or official “Sovereign AI” programme. References to regulators and frameworks describe the requirements KYE™ helps you evidence — not any official relationship.

Canonical KYE™ surfaces referenced on this page: Evidence Pack™ · KYE Protocol™.