Understanding the emerging AI laws in Kuwait is critical for any tech company in 2025. As the adoption of Artificial Intelligence accelerates under Vision 2035, the legal landscape can feel like a minefield. While there is no single ‘AI Act’ yet, strict regulations already exist.
At Al-Dostour Law Firm, we advise fintechs, healthcare providers, and software developers on how to innovate without violating existing statutes. The reality is that AI is governed by a patchwork of Data Privacy, Cybercrime, and Civil Liability laws.
If you are deploying AI solutions in Kuwait, this is the essential legal framework you must navigate.
Artificial Intelligence Regulation Kuwait: The 5 Essential Laws
Before deploying any algorithm, your legal team must review compliance with these five statutes:
-
CITRA Resolution No. 26 of 2024 (CITRA Data Privacy Privacy Protection): The governing regulation for how personal data is collected, processed, and stored.
-
Law No. 20 of 2014 (Electronic Transactions): Validates digital contracts and defines “Electronic Agents.”
-
Decree Law No. 67 of 1980 (The Civil Code): Governs liability for damages caused by machines and software.
-
Law No. 63 of 2015 (Cybercrime Law): Criminalizes unauthorized access, deepfakes (forgery), and illicit data scraping.
-
Law No. 22 of 2016 (Copyright Law): Pertains to the ownership of code and AI-generated content.
Key Legal Questions: What the Law Actually Says
We have compiled the most critical questions our corporate clients ask, answered with specific legal citations.
Q1: Can we use Kuwaiti user data to train our AI models?
The Short Answer: Not without explicit, informed consent. You cannot repurpose customer data for “training” if that was not the original stated purpose.
The Legal Citation: Under CITRA Resolution No. 26 of 2024, specifically the provisions regarding Purpose Limitation, data controllers must process personal data only for the specific purpose for which it was collected. Furthermore, the regulation mandates Data Localization for certain sensitive categories (e.g., health or financial records). This means transferring data to a cloud server outside of Kuwait (e.g., to OpenAI servers in the US) without CITRA’s approval or user consent is a violation of the Data Privacy Regulation.
Q2: If our AI makes a mistake (e.g., a robo-advisor loses money), who is liable?
The Short Answer: The company (the operator) is strictly liable. You cannot blame the “black box” algorithm.
The Legal Citation: Kuwaiti law applies the concept of “Guardianship of Things” (Hirasat al-Ashya). Article 243 of the Civil Code (Decree Law No. 67 of 1980) states:
“Everyone responsible for a thing requiring special care to prevent its harm… is liable for the damage caused by that thing, unless they prove the damage was due to an external cause beyond their control.”
In the eyes of the court, an AI system is a “thing” under your control. If it causes harm, the burden of proof is on you to prove it was Force Majeure, not a software bug.
Q3: Is a contract signed by an AI bot (Autonomous Agent) valid?
The Short Answer: Yes. If your AI automatically orders supplies or executes a trade, that contract is legally binding on your company.
The Legal Citation: Article 14 of Law No. 20 of 2014 (Electronic Transactions) specifically validates actions by “Electronic Agents.”
“A contract may be formed by the interaction of automated electronic agents… even if no individual was aware of or reviewed the actions of these agents at the time the contract was formed.”
This protects your counterparties. You cannot void a contract simply because “the bot did it.”
Q4: Are “Deepfakes” or AI Voice Cloning illegal in Kuwait?
The Short Answer: Yes, they are highly criminal if used to deceive or defame.
The Legal Citation: While the term “Deepfake” is not used, the act falls under Law No. 63 of 2015 (Cybercrime Law).
-
Article 3 criminalizes the forgery of electronic documents/media.
-
Article 6 imposes prison sentences for anyone who uses the internet to “defame or slander” others. Creating an AI video that misrepresents a person’s identity violates dignity rights and constitutes electronic forgery.
AI in FinTech & The Central Bank Sandbox
For financial technology companies, the Central Bank of Kuwait (CBK) has established a specific gateway for AI innovation: The Regulatory Sandbox (“Wolooj”).
If you are planning to launch an AI-driven product—such as a Robo-Advisor, Algorithmic Trading Bot, or AI Credit Scoring model—you cannot simply launch and apologize later. You must operate within the CBK’s supervised testing environment.
1. The “Wolooj” Regulatory Sandbox
Established to foster innovation without risking financial stability, the Sandbox allows Fintechs to test AI solutions on a limited number of customers.
-
The AI Requirement: CBK requires “innovative technology.” Your AI must demonstrate a clear benefit (e.g., faster settlements, lower fees) over traditional banking.
-
The Testing Phase: During this period, strict Capital Adequacy and Cybersecurity (Circular No. 2/105/2020) rules apply. You are liable for any financial loss your AI causes to test users.
2. Robo-Advisory & Digital Banks
With the release of the 2022 Digital Banks Guidelines, the CBK officially opened the door for fully digital, AI-first banks.
-
The Trap: While “Robo-Advisory” is permitted, it falls under the Instructions regarding Investment Advisors. The algorithm itself must be audited. If the AI “hallucinates” and recommends a high-risk asset to a conservative investor, the firm is liable for Mis-selling under CMA (Capital Markets Authority) regulations.
Legal Strategy: Do not market your AI as “autonomous.” Legally, position it as a “Decision Support System” where a human compliance officer retains final oversight. This mitigates strict liability risks.
The “Intellectual Property” Trap
A critical warning for local startups: Article 6 of the Copyright Law (No. 22 of 2016) protects works created by “authors.” Current legal consensus in Kuwait (and globally) dictates that an “author” must be a human.
-
Risk: Content generated entirely by AI may not be copyrightable in Kuwait.
-
Strategy: Ensure there is significant human input in your final product to claim ownership.
Comparative Analysis (Kuwait vs. EU)
Many of our corporate clients operate across borders. A critical error is assuming that compliance with the EU AI Act protects you in Kuwait. It does not.
The legal philosophies differ fundamentally. The EU regulates the Process (Risk Assessment), while Kuwait regulates the Outcome (Harm caused).
The EU AI Act vs. Kuwaiti Civil Code
| Feature | EU AI Act (2024) | Kuwait Legal Framework |
| Philosophy | Risk-Based Approach: Obligations depend on whether the AI is “High Risk” (e.g., medical) or “Low Risk” (e.g., spam filters). | Strict Liability: Based on the “Guardianship of Things” (Civil Code Art. 243). If the AI causes harm, the owner is liable, regardless of “Risk Tier.” |
| Liability | Producer Liability: Focuses heavily on the developer and data quality. | Operator Liability: Focuses on the user/company deploying the AI. You cannot blame the software vendor easily. |
| Transparency | Mandatory “Watermarking” for AI content and strict technical documentation. | Consumer Protection: No specific watermarking law yet, but misleading consumers violates the Consumer Protection Law (No. 39 of 2014). |
| Key Risk | Fines: Up to 7% of global turnover for non-compliance. | Damages: Unlimited civil compensation claims from injured parties. |
The Bottom Line:
-
In Europe: You spend money on Compliance (documentation, audits) to avoid fines.
-
In Kuwait: You spend money on Insurance and Oversight to avoid paying damages when the AI fails.
Conclusion: Innovation Requires Compliance
The absence of a single ‘AI Act’ does not mean a lack of oversight. In fact, Artificial Intelligence regulation in Kuwait is often enforced through strict civil liability codes.
At Al-Dostour Law Firm, we help technology companies conduct Algorithm Impact Assessments and draft Terms of Service that protect against AI-specific liabilities.
Ensure your technology is future-proof. Contact our Technology & Media Department for a regulatory audit.
