The UAE has the broadest access to US AI chips anywhere in the Gulf, and it runs out on 6 April 2027. A rule Washington published in July lets G42 and Core42, the country’s two flagship AI compute companies, buy advanced US chips without an export license until that date, unless the Bureau of Industry and Security (BIS) says otherwise. If the two haven’t become US companies by then, they’ll need to apply through BIS’s advisory-opinion process. The rule doesn’t say what becoming a US company involves.

Abu Dhabi is more likely to hold on to that status than restructure for it, June Park, a political economist and senior research affiliate at the Centre for Digital Law at Singapore Management University, tells EnterpriseAM. The rule leaves open whether G42 and Core42 would need to move their headquarters to the US, sit under a US parent, or change their shareholding, she says, and that “gray area will continue to exist as long as the US sees commercial interest without evidence of risk.”

Why it matters: The deadline is the nearest test of how much of its AI build-out the Gulf controls. Global tech firms have come for the region’s cheap energy and available land, and its sovereign funds have invested in partnership with others instead of competing head-on with US and Chinese tech giants, according to a Deloitte report (pdf). The chips are American and licensed, and so is much of the software running on them, from OpenAI, Microsoft, and Oracle. Even so, the Gulf is “steadily inching toward AI sovereignty,” Mohammed Soliman, a senior fellow at the Middle East Institute and a director at McLarty Associates, tells EnterpriseAM.

The war has added a second test: whether the infrastructure holds when it’s hit. Two of Amazon Web Services’ (AWS) UAE facilities were struck in March, damaging two of its data center zones there. In September, AWS said it can’t restore access to resources and data that were held only in one of its UAE zones.

The third test is whether the Gulf builds all of this as one system. Each Gulf state is building its own AI infrastructure, and the region “will need to consider these investments as a shared regional project,” Yasir Atalan, deputy director at CSIS Futures Lab, tells EnterpriseAM.

Tied to America, by design

July’s rule went well beyond any earlier approval: It moved the UAE into Country Group A:5, alongside close US allies, and cleared G42 and Core42 for licensefree chips in both of the US’s advanced-computing categories. It gave eight US companies, including Microsoft, OpenAI, Oracle, Amazon, and xAI, licensefree status for their UAE builds, and said BIS intends to “favorably review” chip license applications from MGX, Abu Dhabi’s AI investment fund. Almost all of that access runs back to one supplier.

Almost all of that access runs back to Nvidia, and most of what’s built on top of it is American too. No rival yet matches Nvidia’s Blackwell chips for training, and AMD and Qualcomm chips need the same US approvals anyway. Stargate UAE is being built with OpenAI, Oracle, Nvidia, Cisco, and SoftBank. MGX has also backed OpenAI, Anthropic, and xAI, and Core42 is building compute on US soil. It secured USD 550 mn in HSBC financing in June and is taking its Lake Mariner site in New York to 60 MW from 18 MW, after signing a 20 MW lease in Minneapolis in May.

The ties run through equity as well as infrastructure, though how much Gulf investors own is unclear. Anthropic’s S-1, filed on 26 October, doesn’t say: none holds the 5% needed to force disclosure, and the filing mentions the Gulf only in noting, where securities can be marketed. MGX, which co-led Anthropic’s USD 30 bn Series G in February, and Qatar’s QIA are among the known backers, alongside vehicles linked to Mubadala and IHC. Existing investors expect a valuation of USD 1.5-1.75 tn, below the USD 2 tn-plus discussed in August.

Building into America’s compute footprint is how the Gulf gains autonomy over time, Soliman argues. Gulf AI is “a long-term proposition precisely because the region is deliberately positioning itself as an integral part of America’s global compute footprint to serve regions far beyond the reach of American onshore compute,” he says. He sees sovereignty as “a spectrum of growing autonomy that no single external power can fully gatekeep,” driven by “open-source models, unmatched energy abundance, and disciplined capital allocation.”

The closeness has drawn attention in Washington: Abu Dhabi’s Aryam Investment 1 bought a 49% stake in World Liberty Financial, the Trump family’s crypto venture, in a USD 500 mn transaction. Democratic lawmakers have questioned whether that shaped chip approvals and say they will investigate if they gain Congress in next week’s midterms. Soliman doesn’t expect it to change course, pointing to “a genuine lock-in effect between American hyperscalers and the Gulf.” “Political conversations may shift if Democrats take the House, but a full 180-degree reversal on US-Gulf AI cooperation is hard for me to envision,” he says.

KSA holds a license, UAE holds status

Riyadh started level with Abu Dhabi and now holds narrower access. Abu Dhabi spread its AI effort across a university, a research lab, and MGX, while Riyadh’s runs through the PIF-backed Humain. Last year, the US approved both G42 and Humain to buy the equivalent of up to 35k Nvidia GB300 chips each. Since then, the UAE has received a standing status under the Export Administration Regulations, while Saudi Arabia holds a license that can be revoked for a specific product or user and “may be ephemeral,” Park says.

Defense ties and compliance help explain the gap. The UAE has been a US Major Defense Partner since September 2024, a status only it and India hold, Park says, while Saudi Arabia is a Major Non-NATO Ally, alongside Qatar. On compliance, the July rule notes that BIS keeps an export control officer in the UAE who works with Emirati authorities to stop illicit procurement networks from diverting sensitive US technology. It isn’t clear whether Humain has a similar setup, she says, so compliance in the UAE “may seem more legible to Washington.”

Timing may explain part of it too, though Park says to “take this with a grain of salt.” The UAE’s framework was agreed in May 2025, six months before Saudi Arabia’s AI MoU, and took another 14 months to reach the Federal Register. The July rule doesn’t mention Saudi Arabia, and timing alone wouldn’t close the defense and compliance differences.

China ties don’t clearly separate the two: Both countries have drawn congressional attention over links to China, Park says. On the UAE side, G42 divested from Binance and Huawei, she notes, but there’s no blanket approval across UAE entities, and funds such as Adia and Mubadala still invest in China. On the Saudi side, Huawei Cloud has operated in the Kingdom since September 2023. There’s “no formal public statement” that the US favors one over the other on that basis, she adds.

Data centers are now targets

The war has brought physical security into the chip-access conversation. Whether a facility’s exposure to attack should factor into chip access is “a valid point of argument and debate” among cloud builders and operators, Park says, and Iran’s attacks mean the risk “has now been evidenced.” Iran’s Islamic Revolutionary Guard Corps (IRGC) said it struck an Amazon data center in Bahrain because it “played a key role in providing intelligence to the US military,” and regional researchers now describe data centers as “primary targets” in the conflict.

The region is building anyway, and paying more to protect what it builds. The Middle East’s roughly 1 GW of data center capacity is set to triple, with 2.2 GW under construction and another 12 GW in planning, according to JLL data cited by Forbes. Fencing, gatehouses, and vehicle barriers run USD 5-20 mn, and advanced security can take up to 5% of construction costs, security consultants told Forbes. Soliman sees no reason for the war to stop any of it: “The Gulf is not the first region to build and expand compute infrastructure under fire. Ukraine has shown the world how to do it brilliantly under the constant threat of Russian invasion.”

Out of rocket range

A hardened site still needs a backup somewhere else, and that’s harder for a state than for a hyperscaler, Jesse Marks, CEO of Rihla Research & Advisory, tells EnterpriseAM. When AWS is hit, the services on that facility move to another data center, typically offshore, because a hyperscaler has a global footprint and can shift workloads with relative ease. A state running its own infrastructure for public services or banking can’t do that as easily, and if a facility that isn’t connected to a hyperscaler is damaged, “where do you move your workload?” he asks.

One answer is a “digital embassy,” and the Emiratis have been “at the forefront of the conversation,” Marks says. The idea is to put servers inside an embassy as a micro data center that runs a state’s workloads under its own ownership and laws, with the host country’s consent. Estonia has run a version since 2019, keeping copies of core government databases in a Luxembourg data center that Luxembourg’s officials can’t enter without Estonian approval. No Gulf state has one yet, though there has probably been “some form of negotiation with states to assume what is plausible,” he adds.

The sticking point is asking a host to accept data it can’t see. “It’s a big ask of a country to ask another country, ‘Can I run sensitive workloads on your territory, but you can’t see it, and ultimately it’s not yours?’” Marks says. Whoever controls a data center can in theory see what runs inside it, which he calls the “panopticon effect.” Atalan says the idea works in theory. Non-sensitive data already moves abroad through the cloud, “but not the government data,” he tells EnterpriseAM, and shifting that “will depend on the reciprocity.”

A simpler emergency arrangement is likely to come first, Marks says. He describes “a Five Eyes agreement, but for” countries linked through something like Pax Silica, the US-led network building AI on American technology, focused on keeping the government running. In a crisis, a state would move banking, healthcare, and public services to a trusted partner’s data center, then bring them home once it passes.

Those partners are likely to sit out of range of Iran’s rockets. Offshoring UAE workloads to Saudi Arabia is hard to picture, Marks says, given the political relationship and the fact that Saudi Arabia is also being targeted by Iran. He points instead to partners with stricter rule of law in Europe, Africa, or possibly Central Asia, connected by undersea cables. The UAE feels more urgency because it’s smaller and “the Iranians can hit anywhere in the UAE,” and it “would not surprise me if in the next year or so we saw formal agreements between Gulf countries and their European partners,” he says.

A regional plan is drafted

The blueprint treats the whole AI stack as one piece of critical infrastructure. In a May analysis for the Arab Gulf States Institute, Atalan called for AI campuses, cloud regions, chip clusters, undersea cable landing stations, and power systems to be classified together. The GCC could start with cloud continuity drills and shared data classification rules, he argued, along with “trusted backup capacity in the United States, India, Singapore, Turkey, and selected European markets.”

What’s holding it back is uncertainty over how the war ends. The conflict could carry on as it is or settle into a “short-of-war format,” Atalan says, and “both scenarios are risky for AI investments.” Until the end state is clearer, Gulf countries “will not be able to move with infrastructure investments.” Smaller steps are moving in the meantime: The UAE and Saudi Arabia are both working to treat ICT as critical infrastructure, and Atalan expects AI data centers to get that designation soon.