Egypt regulates AI without an AI law

Egypt has no standalone law regulating artificial intelligence. The use of personal data in training, developing or operating AI systems is governed by the Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, issued in November 2025. Full enforcement is expected by October 2026, at the end of the one-year transitional period. That is a stronger position than it sounds, and companies frequently read the absence of an AI statute as the absence of AI regulation. In Egypt that reading has a deadline attached. Almost every commercially interesting AI system in Egypt is trained on or operates over personal data — customer records for a fintech, patient data for a health platform, user behaviour for an e-commerce recommender. All of that sits squarely inside a data protection regime that is about to become enforceable. The obligations that follow are the familiar ones: a lawful basis for processing, purpose limitation, data subject rights, and a licensing requirement before certain processing can occur. Applied to model training they are demanding, because training is difficult to reconcile with purpose limitation and because model outputs complicate deletion rights. Law 151 was passed in 2020 and became operable in late 2025. The interval was the Executive Regulations, and without them the law had principles but no procedures — no forms, no thresholds, no allocation of responsibility between authorities. The Regulations supplied that machinery and established a data protection centre. From October the regime has both a rule and a body to apply it. For companies processing Egyptian personal data — essentially every fintech among the country's 177-plus, every health platform and every e-commerce operator serving a market above 100 million people — the transitional window is nearly closed. A draft Artificial Intelligence Law is expected to move through parliament, which would shift Egypt from voluntary ethical guidance to binding AI-specific requirements. Until it passes, the PDPL is the entire AI rulebook, and the practical advice is the same as in the UAE and Saudi Arabia: read the data protection law. All three of the region's largest markets have converged on the same architecture — data protection doing the work, AI frameworks layered on top, no dedicated statute in force.