Bahrain’s General Policy for the Use of AI: what government suppliers align to

Bahrain’s General Policy for the Use of Artificial Intelligence runs to thirteen pages in English, and it is easy to underestimate. Version 1.0 is dated 20 May 2025, the day the Ministerial Committee for Information and Communication Technology (MCICT) approved it, and iGA launched it publicly on 27 July 2025, together with Bahrain’s adoption of the GCC’s AI ethics manual [1, 3]. iGA publishes it in English and in Arabic, both as version 1.0 of the same date [1, 2].

Its scope is one sentence: it applies to all government entities in the Kingdom of Bahrain [1]. From 20 May 2025, the activation clause says, every government entity must comply with its rules, requirements and guiding principles [1]. The roles split three ways. MCICT sets the strategic direction and approved the policy; the ICT Governance Committee (ICTGC) approves updates and decides requests for exemptions or exceptions; iGA manages and promotes the policy and supervises its implementation [1]. In October 2025 iGA said a new Innovation and Advanced Technologies Directorate now develops its emerging technology policy and supports entities adopting AI [8].

What it is not matters as much. It is a government policy, not a law, and nothing in it places a duty directly on a company. A supplier meets it second-hand, through the entity it sells to, and that entity has signed up to principles it can only show it meets with the supplier’s help. That is the practical reason to read it: every principle turns into a question in a tender, a pilot review or an audit.

A binding AI law may follow. The AI readiness report iGA published on 12 November 2025 describes a draft AI law under parliamentary review, with a dedicated AI unit, licensing for developing and deploying AI, prohibited uses and penalties [7]. I have not treated it as law on this page. Check where it stands before you plan around it.

The policy lists eleven principles [1]. Read from the supplier’s side of the table, each one is a question the buying entity needs answered, and the answer that holds up in a review is an artefact rather than an assurance.

The first column paraphrases the policy [1]. The second and third are my reading of what a buyer will do with it, and this page is not legal advice.

Two rows carry most of the weight. Human decision-making is the first principle, and the second pillar repeats it: responsibility rests with people, not machines, and a negative outcome is a human decision [1]. That rules out a design where the model acts on a citizen’s case and a person reviews a sample afterwards. What fits is a set of gates that stop the model acting alone on anything that touches someone’s rights. Transparency is the other. A system that cannot say which document and which rule produced an answer will struggle in a government review, however accurate it is.

The first pillar, commitment to policies and legislation, is where a supplier’s legal exposure sits. It names seven instruments and asks government entities to comply and align with each one [1].

Each item is as the policy describes it [1], and the manual is in the launch notice too [3]. The one I would put first for any AI project is Law No. 16 of 2014, because it is the one a technical team is least likely to have read. An AI assistant that indexes a ministry’s shared drive will meet classified documents sooner or later. The classification of every source has to travel with it into the index, and the system must never show a user a passage from a document they could not open themselves.

The Personal Data Protection Law needs its own reading for any system that makes or supports decisions about people. Its transfer provisions also decide whether a model hosted outside Bahrain may see personal data at all, which is a question for your counsel before it is a question for your architects.

The second pillar, on using and adopting AI, sets five rules for government entities [1].

For a supplier, the second rule is the one that changes a timeline. A government entity cannot adopt an AI solution on its own; coordination with iGA is written in as a must [1]. Put that step in the plan, and expect iGA’s questions to follow the principles above.

The third rule points to a document I could not find. The National Enterprise Architecture site, where Bahrain publishes its government ICT policies and standards, listed two AI documents when I checked, the policy and the GCC ethics manual, and no AI standard [6]. Ask the entity for iGA’s current criteria and procedure for AI initiatives before you write a proposal, because that is the checklist the project will be read against.

The pillar’s objectives also ask for specific criteria to evaluate and identify which projects can benefit from AI [1]. Scoring every candidate the same way, with a risk rating for each proposed use case, is a reasonable way to show that before iGA asks. The third and fourth pillars ask entities to train their staff and to cooperate, including exchanging experiences, algorithms, infrastructure and security standards between entities where possible [1]. Expect training in the scope, and settle who owns what early, because the work may be shared.

The policy adopts the Guiding Manual on the Ethics of Artificial Intelligence Use in GCC Member States, version 1.0 of November 2023, issued by the GCC Ministerial Committee for eGovernment [3, 4]. The manual sets four values and seven principles, and where the Bahraini policy states a principle, the manual often says what putting it into practice looks like [4]. The overlap is close: the policy’s principles on human decision-making, safety, fairness, privacy, transparency, accountability and integrity track the manual’s seven, and the policy adds reliability, investment, innovation and intellectual property [1, 4].

These are the manual’s recommendations a supplier can build to [4].

The manual is guidance. Its final provisions say it replaces none of a state’s duties or rights, and it asks member states to give its values effect through their own legislation, regulations and guidelines [4]. Bahrain has done that through the policy. My reading is that the list above is the most practical definition either document gives of what the principles mean once a system ships, and I would build to it rather than to the principles alone.

Bahrain’s Cloud First Policy, version 1.0 of 24 April 2017, predates the AI policy by eight years and still frames how government systems are hosted [5]. Government entities are required to use cloud services for new ICT services and when replacing existing ones, unless another approach meets a special requirement, costs less over its lifetime and gives at least the same security assurance [5].

Its position on residency is the reverse of what many Gulf buyers assume. The policy says the benefits of cloud are best realised when no data residency restrictions are placed on data, and that entities concerned about foreign access to government data should choose vendors with the right security standards and controls [5]. That is not a licence to send anything anywhere. The same policy ties protection to data classification, and the AI policy adds the state information law, the personal data law’s transfer provisions and the decree on cloud services [1, 5]. My summary is that Bahrain decides location by classification and by law, data class by data class, rather than by one residency rule.

Cloud providers serving government are expected to meet international security standards and hold the certifications that go with them, and each entity needs a backup plan, which should keep a copy of its data in a second location across two regions [5]. For an AI system the region question has a second half, because a cloud region in Bahrain does not mean the model runs there. What each vendor runs in its Gulf regions is covered model by model in the residency guide, and it is the question to put to any vendor before a proposal promises processing in the Kingdom.

This is the pack I would have ready before a first meeting with a Bahraini government entity. It is built from the policy and the manual [1, 4]; it is not a list iGA publishes.

The strongest version of each item comes out of the system itself, as logs, test runs and configuration. A document describing controls the system does not enforce is the first thing an audit under the second pillar will find. An entity that wants its own internal rules under the national policy can start from an AI policy written as clauses a system can enforce, so each principle maps to a control someone can test.

The evidence pack above is what we build as AI governance implementation: the decision gates, the logs, the evaluation and bias tests and the audit trail sit inside the system, so a government entity can show iGA and its auditors what the system does rather than what a document says it does. Where an entity is still at the second pillar’s first step, deciding which initiatives are worth doing, the AI Opportunity & Feasibility Sprint scores and sizes the candidates before anything is procured. 1AYM has built Arabic-language AI, including bilingual Arabic and English search and Arabic document OCR, which matters when an entity’s records and forms are in Arabic.

We work with clients across the UK, the US and the Gulf, and we have an entity in the UAE. Our closest published work in the region is the production estate of a government-accredited EdTech in the Middle East, whose database we replatformed into Google Cloud’s Doha region, me-central1, to meet Gulf data-residency requirements. Once a scope is signed, a fixed-scope build can start within a day, and if you already have a scoped job, we can resource it on contract from the collective of associates who work with us, held to the same standard. If you are preparing a bid or a pilot for a Bahraini government entity, book a call from the end of this page or email us.