Two dates matter in Egypt this autumn to any organisation running AI on real data: the end, on 1 November 2026, of the transition period for the executive regulations of the Personal Data Protection Law, and the first national AI governance framework, published in March. This article summarises what the texts actually require, with their sources, and what should be ready in your deployment.

First: the data protection law, and the countdown

The executive regulations of Law No. 151 of 2020 were published in the Official Gazette on 1 November 2025, made publicly available on 25 December 2025, and came with a one-year transitional period. According to CMS’s analysis (Masha Ooijevaar and Ben Gibson, 13 January 2026), enforcement is expected to begin on 1 November 2026, while Adsero (8 January 2026) notes that a strict reading puts the date at 31 October 2026. Either way, compliance is due from the start of November 2026. The main obligations, as the two firms summarise them:

  • A licence from the Personal Data Protection Center for data controllers and processors, usually valid for three years, plus supplementary permits for cross-border transfers, electronic direct marketing and visual surveillance.
  • Transfers outside Egypt, including to cloud environments, need a licence or permit, and are allowed only to the countries named in it. The regulations do not impose data localisation as such, but they make every path out of the country a licensed, documented decision.
  • A record of processing that covers hosting environments and data locations, a data protection officer registered with the Center, and a local representative for foreign entities.
  • Breach notification within 72 hours to the Center, and to affected individuals within three business days after that.

Second: the AI governance framework, and what it asks of systems

On 15 March 2026, Eng. Raafat Hindy, Minister of Communications and Information Technology and chairman of the National Council for Artificial Intelligence, Quantum Computing and Emerging Technologies, approved the Guide to Egypt’s National AI Governance Framework, prepared by the Egyptian Center for Responsible AI. The guide is a public document, and it is meant to inform the drafting of the coming Egyptian AI law. What matters most for organisations that deploy:

  • Four risk tiers. Prohibited systems; high-risk systems, such as critical infrastructure and biometrics, which need two mandatory assessments before deployment (an ethical impact assessment and a technical audit) and monitoring after it; limited-risk systems, which include chatbots and generative AI and must meet transparency requirements such as disclosing machine interaction and labelling generated content; and minimal-risk systems with no additional obligations.
  • Large language models get special treatment. General-purpose models are subject to transparency requirements, including documentation of training and data provenance, and are reclassified as high-risk when used in high-risk cases.
  • “Frugal AI” on a comply-or-explain basis. Developers of high-risk systems must prioritise lightweight models, such as small language models, where technically feasible. Whoever chooses a resource-intensive model must document the technical justification, such as accuracy benchmarks, showing why a frugal alternative was insufficient. The guide says explicitly that prioritising efficient models reduces reliance on expensive hardware.
  • Continuous monitoring and incident reporting. Providers of high-risk systems must monitor accuracy and fairness automatically and report “serious incidents” to the sectoral regulator. The Personal Data Protection Center audits AI systems for data minimisation, purpose limitation and consent.

Third: the infrastructure is catching up with the rules

The guide describes a “sovereign cloud” of national data centres and high-performance computing facilities to host critical government AI workloads. On 10 September 2026, Amwal Al Ghad reported (Aya Anwar) a partnership between Vodafone Business, Elsewedy Electric and Cassava Technologies to build what was described as Egypt’s first sovereign AI data centre: 20 MW in the first three years with a plan to reach 200 MW, a projected USD 1 billion of investment at full capacity, GPU-as-a-Service, and data hosted and processed within Egypt. The option that was theoretical a year ago, running your systems in-country with real compute behind them, is becoming practical.

A practical checklist for compliance from 1 November

  1. Map the data your AI system touches, where it is hosted, and every path that leaves Egypt. If the model, the index or the logs sit in a foreign cloud, that is a transfer that needs a licence.
  2. Classify your system against the four tiers. An internal assistant for staff is not an agent making financial decisions. The tier decides whether you need the impact assessment and the technical audit before launch.
  3. Build transparency into the product. A clear disclosure that the user is talking to a machine, answers that cite their sources, and an immutable log of what the system did.
  4. Prepare your comply-or-explain file. Take fifty real questions from your operations and evaluate the smallest model that could do the job before the largest. If the small one passes, you have saved the hardware and met the rule. If it does not, you have the documented justification the guide asks for.
  5. Name who notifies within 72 hours, who can stop the system, and who reviews serious incidents. These are names, not policies.

Where we stand

These rules describe the way we already build: models, indexes and logs that run on your hardware and inside your country, air-gapped when needed; answers that cite their sources and audit logs that cannot be altered; and an evaluation suite for every deployment before a single user sees it. Frugality is not a regulatory burden for us. It is why we build the 36-month total cost of ownership model with you before you commit. If your deployment is in Egypt, go through the checklist now, not after the Center’s first request.

This article summarises public sources and is not legal advice. Check the official texts and your legal counsel before acting.

Sources

Related pages

Download the one-page checklist: AI and data rules in the Gulf and Egypt, 2026 (PDF), or compare all seven countries on one page.