UAE And GCC Cryptography Rules, And One Inventory For Many Regulators

The Gulf states have moved quickly on cryptography and quantum readiness. The UAE has a national encryption policy with a post-quantum section, and Saudi Arabia’s central bank has set dated quantum requirements for the financial institutions it supervises. Many organisations in the region also answer to PCI DSS, and some to DORA through EU operations or customers.

This article covers the cryptography and quantum rules in the UAE and Saudi Arabia as of October 2026. It then closes the section with a practical question: how one well-built cryptographic inventory can serve several regulators at once. For the wider regulatory picture in each country, see Regulations Across Regions.

The UAE National Encryption Policy

The UAE Cyber Security Council issued the National Encryption Policy, version 1.0, dated September 2025.¹ Its approval, together with an executive regulation, was announced on 27 November 2025.² The policy sets encryption controls for data at rest and in motion, and requirements for key management, post-quantum cryptography, implementation and performance monitoring.³

Who it applies to. The policy text applies to federal ministries and authorities and to non-government critical information infrastructure (CII) entities. Where an emirate runs its own CII protection programme, the emirate lead handles applicability, enforcement and monitoring for emirate government entities and non-government CII entities. Where no such programme exists, the policy applies to emirate government entities directly.¹

What the post-quantum section asks. Section 6 aims to prepare entities to protect information not classified as open from future quantum threats. Entities must:¹

• keep a list of every system and application that relies on public-key cryptography;
• test new post-quantum standards in a lab before using them in production;
• create a transition plan that analyses dependencies affecting the order of migration, retires technology that will become unsupported and validates new products;
• adopt purchasing policies for post-quantum cryptography, which should cover new service levels and vendor surveys;
• alert IT departments and vendors to the coming transition, and train staff.

How compliance is checked. The policy says its requirements are built into the UAE Information Assurance Standard, and that entities are expected to report compliance through the National Cyber Index Platform.¹ The policy text reviewed for this article does not set a migration deadline.

How the standard carries it. In the UAE Information Assurance Standard, version 2.1, dated November 2025, the matching control is T3.4.4. Unlike the standard’s other cryptography controls, it applies according to each entity’s risk assessment rather than in every case. Its sub-controls cover the public-key inventory, lab testing and staff training, and as with any risk-based control an entity may skip or vary a sub-control with documented justification and accepted risk. The transition and adoption plans appear only as implementation guidance.⁴ Separately, the National IoT Security Policy, version 2.0, requires IoT consumers in its scope to take a risk-based approach to encryption that protects communications against classic and quantum threats.⁵

In May 2026 the Cyber Security Council announced a partnership with QuantumGate on a national Crypto Discovery Tool, built to requirements set by the UAE National Cryptography Center. It is designed to discover, inventory and monitor cryptographic assets across critical national infrastructure, as part of the national post-quantum migration programme.⁶ This is an announcement about national tooling rather than a new obligation.

Saudi Arabia: SAMA And The NCA

SAMA’s circular 482021280 of 27 August 2026 requires supervised financial institutions to make their procedures for identifying and classifying all cryptographic assets accurate and comprehensive by the end of Q4 2026, and to complete an enterprise-level quantum risk assessment with action plans by the end of Q1 2027.⁸ It also makes quantum risk a standing item for board-level committees. The previous article in this section covers it in more detail.

The National Cybersecurity Authority’s National Cryptographic Standards, NCS-1:2020, issued in July 2020, set minimum cryptographic requirements in the Kingdom. Their section on post-quantum cryptography noted that international standards were not yet available and that post-quantum algorithms would be considered in later versions.⁹ NIST has since published its main post-quantum standards, FIPS 203, 204 and 205, which US federal guidance now points agencies to, so organisations in scope should watch for a revised edition.¹⁰

One Inventory, Many Regulators

A firm in Dubai or Riyadh that processes card payments and serves EU clients may face PCI DSS, DORA, SAMA and the UAE policy at once. Each asks for something slightly different, but the underlying data overlaps heavily. Building one inventory with the right fields, and producing different views from it, is far cheaper than answering each framework separately.

The table maps common inventory fields to six frameworks covered in this section. Named means the instrument asks for that information directly. Supports means the field is evidence you would use to meet a broader requirement in that instrument.

Sources for the columns: PCI DSS,¹¹ the DORA technical standards,¹² SAMA,⁸ the UAE policy,¹ MAS¹³ and OMB M-26-15.¹⁰

Three lessons stand out from the mapping. First, the inventory has to go beyond what any single framework asks for. A PCI-only list of cipher suites misses the keys and certificates DORA names, and a DORA certificate register misses the algorithm detail MAS describes. Second, location and ownership fields do most of the work, because every framework needs to know where cryptography is and who can change it. Third, the review date matters everywhere. Each framework expects the inventory to stay current, whether that means a 12-month PCI DSS cycle, an up-to-date DORA register or SAMA’s dated deadlines.