Egypt’s Draft AI Law Is Before Parliament. The Bigger Question Is Who Will Control the Risks and the Opportunities

Egypt’s AI policy is entering a consequential phase. The government has established a national strategy, issued a responsible-AI charter, published a detailed governance framework and begun preparing dedicated legislation with Parliament’s Communications and Information Technology Committee.

The distinction between these developments matters. According to the Legal 500’s Egypt AI guide, no binding, AI-specific statute is currently in force, while the draft AI law is on Parliament’s agenda. Separately, the Guide to Egypt’s National AI Governance Framework, Edition 2.0, was approved for publication in March 2026 under the National Council for Artificial Intelligence, Quantum Computing and Emerging Technologies.

The framework is therefore a blueprint for governance, not proof that every proposed obligation is already enforceable. The precise contents and status of the parliamentary bill must be distinguished from the principles and procedures described in the published guide.

This is more than a technical distinction. Businesses need to know whether a requirement is already a legal obligation, an existing sector-specific rule, a non-binding governance expectation or a future provision that may appear in legislation.

Egypt is attempting to move between these categories: from broad commitments to responsible AI towards a system that can classify applications, assign responsibilities, assess risks and supervise deployment.

The country’s policy challenge is twofold. It wants AI to support productivity, public services, research and domestic technology development. At the same time, it wants safeguards against systems that could threaten safety, fundamental rights, privacy or national interests.

The central question is whether Egypt can make these objectives reinforce one another—or whether compliance costs, regulatory uncertainty and fragmented oversight could make responsible adoption harder for the organisations the country wants to encourage.

Until a dedicated AI statute is enacted, AI-related activity in Egypt is governed by a combination of general legislation, sector-specific requirements and non-binding AI governance instruments.

The most important existing legal instruments include:

• Personal Data Protection Law No. 151 of 2020, alongside its Executive Regulations issued under Ministerial Decree No. 816 of 2025.

• Anti-Cyber and Information Technology Crimes Law No. 175 of 2018, which addresses matters including unauthorised access and cybersecurity-related offences.

• Intellectual Property Protection Law No. 82 of 2002, relevant to copyright, patents and questions about AI-generated or AI-assisted work.

• Consumer Protection Law No. 181 of 2018, relevant to misleading claims, consumer rights and AI-enabled commercial services.

• Labour Law No. 14 of 2025, relevant to AI-assisted recruitment, employee assessment and workplace decisions.

• Central Bank and Banking System Law No. 194 of 2020, alongside financial-sector rules governing regulated institutions.

• Non-Banking Financial Technology Law No. 5 of 2022 and related Financial Regulatory Authority requirements.

• Unified Insurance Law No. 155 of 2024, which provides part of the regulatory context for digital insurance and AI-enabled services.

These laws were not all designed specifically for artificial intelligence. Their application depends on what a system does, which data it processes, the sector in which it operates and the consequences of its decisions.

A hiring algorithm, for example, can raise employment-discrimination and personal-data questions. An AI credit-scoring tool can involve data protection, financial-sector supervision and consumer interests. A generative model trained on protected content can raise copyright questions even if the model itself is not classified as high-risk under the new framework.

The result is a legal landscape in which AI-related responsibilities already exist, but are distributed across different regimes.

The 2023 Egyptian Charter for Responsible Artificial Intelligence provides an additional reference point. Legal 500 describes it as a non-binding instrument containing 13 general guidelines for AI participants and 16 executive guidelines for organisations developing, deploying or managing AI systems. Its themes include human-centricity, transparency, fairness, accountability and security.

The charter can shape responsible practice, but a voluntary or non-binding principle is not equivalent to a statutory duty backed by a defined enforcement mechanism.

That is the gap the proposed AI law is expected to address: not necessarily by replacing every existing law, but by establishing AI-specific definitions, institutional responsibilities and a more structured approach to risk.

Egypt’s March 2026 governance guide describes a system built around risk classification, institutional coordination and obligations proportionate to potential harm.

Its approach is explicitly designed to avoid applying identical requirements to every AI application. Instead, systems are classified according to their context and potential impact.

The framework identifies four factors for assessing risk:

1. Scale: how many people could be affected.

2. Scope: whether affected people include vulnerable groups, such as children or patients.

3. Irreversibility: whether the resulting harm can realistically be undone.

4. Probability: how likely an adverse impact is to occur.

This is a significant design choice. It directs attention away from AI technology in isolation and towards the consequences of a particular deployment.

A model that helps a company organise inventory is not equivalent to a system that influences access to healthcare, employment or essential services. Even the same underlying technology can have very different implications depending on its purpose and how much authority an organisation gives it.

The guide proposes four risk tiers.

The guide gives examples of potentially prohibited practices such as social profiling, exploitation of children and manipulative behavioural interference. It identifies critical infrastructure and biometrics as areas requiring high-risk controls, while chatbots and deepfakes feature among limited-risk examples where disclosure and labelling may be important.

These examples should be read as part of the published governance framework, not as a substitute for the detailed classification rules and any binding legislation that may follow. The guide itself anticipates additional guidelines to explain classification methodology and thresholds.

That point is particularly important for companies developing general-purpose AI. A tool cannot always be assigned a permanent risk category simply because of its technical design. The people affected, the decisions it influences and the setting in which it is used can change its risk profile.

A general-purpose model used to summarise public documents may present one set of concerns. The same model integrated into a sensitive screening or decision-making process could raise substantially different questions.

The practical significance of Egypt’s proposal is that risk is intended to follow the use and impact of the system, not just the label attached to the technology.

The framework’s most demanding proposed controls concern Tier 2, or high-risk, systems.

It calls for a dual-check compliance model that combines assessments before deployment with continuing assessment after deployment. The guide places these requirements within a lifecycle approach, extending from design through operation and eventual decommissioning.

The pre-deployment process is intended to test whether a system is sufficiently safe and compliant before it reaches users. The framework refers to impact assessment and technical evaluation, verification and validation, commonly abbreviated as TEVV.

In practice, such a system could require an organisation to answer several questions before release:

• What decision or service will the AI system influence?

• Who could be harmed if it produces an inaccurate, discriminatory or insecure result?

• What evidence supports the model’s claimed performance?

• Are the training and evaluation datasets appropriate for the population and context?

• Can a person review, challenge or override an adverse decision?

• What safeguards are available if the system fails or begins producing unreliable results?

The second part of the model is equally important. A system that passes testing at launch may behave differently when its data, users, operating conditions or model components change. Performance can deteriorate, previously unseen patterns can emerge and security weaknesses can be discovered after deployment.

Ongoing assessment can help identify those changes before they lead to widespread harm.

For businesses, the proposed approach could move AI governance beyond a policy document signed at the start of a project. It points towards a record of testing, documented responsibilities, monitoring, risk management and evidence that the organisation continues to supervise the system.

However, the published guide does not by itself establish all the detailed thresholds, sector-specific testing standards or legal consequences that would apply to every high-risk deployment. Those details will matter to whether organisations can implement the model consistently.

The commercial question is not simply whether a company must test its AI. It is what it must demonstrate, to whom, under which standard and at what point in the system’s lifecycle.

Without clear answers, organisations may struggle to estimate compliance costs or compare the requirements for different applications. With predictable standards, the same process could help businesses identify problems earlier, reassure customers and make AI procurement more disciplined.

Egypt’s framework distinguishes between limited-risk generative applications and more powerful general-purpose AI systems.

For limited-risk applications, it points towards transparency measures such as disclosing that a user is interacting with AI and labelling or watermarking AI-generated content where applicable.

These measures address a basic problem: people may not know whether they are speaking to a human, viewing authentic material or interacting with a system that generates synthetic content.

Disclosure can help, but it does not automatically make an AI system accurate, safe or fair. A chatbot can clearly identify itself as AI and still provide misleading information. A labelled synthetic image can still be used in a harmful context. Transparency is therefore one safeguard among several, not a complete risk-management system.

The framework also gives special consideration to general-purpose AI, including large language models that can be adapted to many tasks.

Its guide indicates that standard general-purpose models would be subject to transparency-related expectations, including documentation concerning training data and copyright provenance. More powerful systems capable of causing large-scale harm could be reclassified as high-risk in context, triggering stricter scrutiny, including cybersecurity and adversarial testing.

That distinction has consequences for the market.

A company building a model, a company adapting it for a particular service and an organisation deploying it for consequential decisions may not face identical responsibilities. The eventual legislation and implementing rules will need to clarify how duties are allocated across that chain.

This is especially relevant to businesses relying on external model providers. Buying access to an AI service does not necessarily eliminate the deploying company’s own responsibilities for how the system is used, what data it receives or how its outputs influence decisions.

It also creates a practical challenge for local developers: smaller firms may have limited access to testing infrastructure, specialist auditors and high-quality datasets. Requirements that are technically appropriate but expensive to satisfy can become barriers to entry if the regulatory system offers no proportionate pathway for smaller organisations.

Egypt’s proposed risk-based structure may help address that challenge, provided its implementation distinguishes genuinely consequential systems from lower-risk uses without creating uncertainty over classification.

A law is only as effective as the institutions that interpret and enforce it.

Egypt’s framework proposes a coordinated model involving national policy leadership, technical implementation, cybersecurity and telecommunications oversight, data protection and sector-specific supervision.

The principal roles described in the guide include:

• The National Council for Artificial Intelligence, Quantum Computing and Emerging Technologies: the central policy and strategic body.

• The Egyptian Center for Responsible AI (ECRAI): the technical and executive arm intended to operationalise the governance framework.

• The Information Technology Industry Development Agency (ITIDA) and the Software Engineering Competence Center (SECC): technical evaluation, verification, validation and work involving conformity assessment.

• The National Telecom Regulatory Authority (NTRA) and Egypt’s computer emergency readiness team (EG-CERT): relevant telecommunications, connected-device and cybersecurity functions.

• The Personal Data Protection Center (PDPC): personal-data and privacy issues.

• Sectoral regulators: supervision and compliance within their respective industries.

• An advisory committee: intended to represent societal, academic and sectoral interests.

The National Council’s expanded remit was formalised in 2026, according to the Legal 500 guide, which identifies Prime Ministerial Decree No. 207 of 2026 as the instrument restructuring and renaming the council.

This architecture reflects an important reality: AI regulation cannot be confined to a single technical agency. A system used in banking can implicate financial supervision, while a system embedded in connected devices can raise telecommunications and cybersecurity questions. AI processing personal information can bring the data-protection regulator into the picture as well.

Coordination is therefore necessary. But coordination can also become a source of friction if responsibilities overlap or organisations are unsure which authority has the final say.

For a business, the practical questions are straightforward: Who receives a complaint? Who determines a system’s risk category? Who conducts or recognises an audit? Which regulator can require changes or suspend deployment? How are disagreements between agencies resolved?

The guide maps institutional roles, but its publication is not evidence that every component is already operational or that all procedures have been finalised. It also anticipates additional guidance, technical tools and a responsible-AI audit laboratory or regulatory sandbox as part of the implementation roadmap.

The test will be whether the institutional design produces a clear route from principles to decisions, and whether businesses and individuals can understand how to use that route.

Even before a dedicated AI law is enacted, Egypt’s existing data-protection regime is directly relevant to many AI deployments.

Personal data may be involved in training datasets, customer-support chatbots, employee-monitoring tools, credit-scoring systems, medical applications and automated profiling. AI development can therefore trigger obligations under Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.

The Legal 500 guide identifies the PDPL and its implementing regulations as part of the current legal landscape. It also highlights a key interpretive challenge: applying a framework that relies substantially on consent and lawful processing to AI training, which may involve large datasets assembled from multiple sources.

The challenge begins with a basic question: Was the data lawfully collected for the use now being proposed?

Data appearing on a public website is not automatically free of privacy or intellectual-property restrictions. Data collected for one purpose may not be appropriate for another. Information that appears anonymous can also require careful assessment if it can be linked back to identifiable people.

AI developers need to distinguish among personal data, sensitive personal data, protected creative works, licensed datasets and information that can legitimately be used for a particular purpose.

The issue extends beyond training. A deployed model may receive personal information through prompts, retain logs, transmit information to an external provider or generate outputs that reveal details about individuals.

The location of a model or server does not answer every legal question. Organisations also need to understand who processes the data, where it flows, what contractual arrangements apply and whether any cross-border transfer requirements are triggered.

Egypt’s transition towards stronger PDPL enforcement makes this especially relevant. The AI law and data-protection framework will need to work together so that businesses can understand how general privacy obligations apply to AI-specific activities.

If the requirements are clear, they can encourage better data governance and reduce avoidable legal risk. If they are unclear or difficult to apply to common technical arrangements, they may create uncertainty for local startups and international service providers alike

AI systems can affect access to jobs, credit, insurance, public services and other opportunities. When a system makes or influences those decisions, errors can have consequences beyond the technical performance of the model.

Egypt’s existing legal protections and its responsible-AI charter provide a starting point, but Legal 500 notes that there is no AI-specific anti-bias statute in force. The charter calls for fairness, attention to vulnerable groups, periodic checks for bias and the ability of affected people to challenge decisions on intelligible grounds.

The framework’s risk-based model could give these principles a more structured role, especially for high-risk applications. Yet the detail matters.

A general promise of fairness does not tell a developer which metrics to test, what level of disparity requires action, which datasets are sufficiently representative or how competing forms of fairness should be reconciled. Nor does it automatically give an affected individual a clear route to appeal a decision.

Human oversight is another important issue. The charter calls for final decisions to remain human and for designated people to have the authority to modify, suspend or withdraw AI systems. The Legal 500 guide says the forthcoming AI law is expected to introduce mandatory human oversight for high-risk applications.

Meaningful oversight, however, requires more than placing a person somewhere in the process. The reviewer must have enough information, authority and time to identify problems—and must be able to act on that assessment.

If a worker is expected to approve hundreds of automated recommendations without the capacity to examine them, human involvement may become a formality rather than an effective safeguard.

Accountability also becomes complicated when a model’s behaviour is difficult to explain. Developers may control the model architecture, providers may control infrastructure, and deploying organisations may determine how outputs are used. When harm occurs, the relevant facts may be distributed across several parties.

The draft law’s expected liability framework will therefore be important. Legal 500 identifies fault attribution for opaque models as one of Egypt’s key interpretive challenges. The framework will need to make responsibilities sufficiently clear that organisations cannot simply point to a third-party model when a system causes harm.

At the same time, requirements should recognise that different actors have different levels of control. A model developer cannot always foresee every downstream use, while a deploying organisation should not assume that purchasing a system transfers all responsibility to its supplier.

AI development raises two distinct intellectual-property questions: whether protected material can lawfully be used to train models, and whether AI-generated outputs receive legal protection.

Egypt’s Intellectual Property Protection Law No. 82 of 2002 remains relevant to both.

According to the Legal 500 guide, Egyptian copyright law is based on human authorship and the personal creative contribution of an author. Purely machine-generated output is not currently recognised as having an AI author, while work involving meaningful human creative contribution may qualify for protection under existing standards. The guide also notes that no Egyptian court has yet drawn a definitive line between AI-assisted and AI-generated works.

Patent law presents a related issue. The guide states that Egyptian law assumes a natural-person inventor, so AI cannot currently be named as an inventor. AI-assisted inventions may still be patentable where an identifiable human inventive contribution meets the usual requirements.

For businesses, this creates a need to document how creative and technical work is produced. Contracts should also address ownership and permitted uses of AI-generated deliverables rather than assume that every output automatically receives copyright protection.

Training data creates a separate risk. The Legal 500 analysis says Egypt has no dedicated AI data-scraping regime and identifies potential exposure under copyright, privacy and cybercrime law. That makes it important for developers to assess data sources, permissions and access restrictions before using material to train or fine-tune a model.

The Second National AI Strategy includes an AI Patent Granting System initiative. This signals an intention to improve the treatment of AI innovation, but it should not be confused with a completed reform of the country’s copyright or patent rules.

A dedicated AI law could clarify some responsibilities, but it may not resolve every intellectual-property question on its own. Further legal guidance or legislative change may be needed to address authorship, training data and the boundary between human and machine contribution.

National sovereignty, local capacity and the ambition to build an AI industry

Egypt’s framework places national sovereignty alongside human-centricity and trustworthiness. It also describes the state as both an enabler of AI development and a guardian against high-risk applications.

That approach connects regulation with industrial policy.

Egypt’s Second National AI Strategy for 2025–2030 sets out ambitions that include growing the ICT sector’s contribution to GDP, developing a larger AI-skilled workforce, supporting AI companies, building domestic data-centre capacity and developing a national Arabic large language model. The Legal 500 guide identifies targets of 7.7% of GDP for the ICT sector by 2030, 30,000 AI professionals and at least 250 successful AI companies.

These are strategic targets, not achieved outcomes. Their relevance to the draft law is that regulation will be implemented alongside an effort to expand domestic capability.

The framework’s geographic scope is also notable: it says it applies to AI systems that affect the Egyptian market or citizens, including systems developed abroad and supplied by foreign providers. It covers both placing AI on the market and putting it into operational use.

That design could help Egypt address risks from systems developed outside its borders. It also means international providers will need to understand how the framework interacts with their existing compliance arrangements.

The guide’s emphasis on sovereign capabilities and “frugal AI”—systems designed to reduce computational demands—also points towards local capacity-building and reduced dependence on external systems.

There is a potential economic benefit in developing Arabic-language data, local technical expertise and evaluation capacity suited to Egypt’s needs. Better local datasets and more context-aware systems could improve the relevance of AI applications in education, healthcare, public services and commerce.

But sovereignty and global integration are not necessarily opposites. Domestic developers still benefit from international research, cloud services, model providers, investment and cross-border collaboration.

The policy question is how to develop local capability without creating unnecessary barriers to useful technology or making compliance so expensive that only large organisations can participate.

Predictable rules, transparent testing standards, proportionate requirements and accessible technical support can help make local AI development more competitive. Unclear obligations or inconsistent approvals can have the opposite effect.

Egypt’s framework explicitly presents the country as a potential regional anchor for responsible AI, connecting African and Arab markets with the global digital economy.

That ambition gives the draft law significance beyond Egypt’s borders.

African countries are developing AI policies in different legal, economic and institutional contexts. Their approaches may differ in how they classify risk, protect personal data, regulate public-sector uses and support local innovation. A clear, implementable Egyptian framework could become a useful reference for policymakers and businesses operating across regional markets.

But influence depends on implementation, not just publication. A framework that is detailed on paper still needs clear technical standards, trained regulators, functioning complaint procedures, predictable decisions and accessible guidance for organisations of different sizes.

Regional interoperability will also matter. Businesses operating in multiple African jurisdictions need to understand where requirements align and where separate assessments or permissions are necessary. Different rules do not automatically prevent cross-border activity, but poorly coordinated requirements can increase costs and slow adoption.

Egypt’s proposed approach could contribute to regional discussions if it demonstrates how risk-based controls can be applied without abandoning innovation. Whether it becomes a practical reference point will depend on the quality and transparency of implementation.

What businesses should prepare for now

The draft law’s status means organisations should not treat every provision in the March 2026 guide as an already enforceable statutory requirement. They should, however, use the framework to identify risks and prepare for potential changes.

A sensible readiness programme includes the following steps.

Map AI use across the organisation. Identify AI systems developed internally, purchased from vendors, embedded in software or used informally by employees. Include generative AI tools and systems that influence important decisions.

Document each system’s purpose and risk. Record who uses it, who may be affected, what decisions it supports and what harm could result from failure. The framework’s scale, scope, irreversibility and probability factors provide a useful starting point.

Review data sources and processing. Establish where training and operational data come from, whether personal or sensitive data is involved, what legal basis applies and whether data is transferred across borders.

Strengthen testing and monitoring. For consequential applications, retain evidence of testing, validation, security review and performance monitoring. Identify what events should trigger reassessment, suspension or withdrawal.

Clarify human responsibility. Assign named owners for deployment decisions, ongoing monitoring, incident escalation and the authority to intervene when a system behaves unexpectedly.

Review contracts with AI vendors. Clarify responsibilities for data handling, security, audit access, model updates, incident reporting, intellectual property and service termination.

Prepare for transparency and complaints. Determine when users should be told they are interacting with AI, how AI-generated material will be labelled where required and how affected people can challenge important outcomes.

Track official implementation guidance. Monitor publication of the draft bill, implementing regulations, detailed risk-classification rules, technical standards and information about the proposed audit and sandbox mechanisms.

Coordinate with existing sector regulators. Financial institutions, insurers, telecommunications businesses and other regulated organisations should assess AI deployments against the rules that already govern their sectors, rather than waiting for a dedicated AI law to address every issue.

These steps are preparation, not a claim that the framework’s proposed controls are already mandatory in every case. The legal position for each organisation will depend on existing law, the sector, the particular system and the final form of any new legislation.

The publication of a national governance framework is a substantive policy step, but it does not settle the key implementation questions.

First, the parliamentary text matters. The Legal 500 guide reports that a draft AI law is on Parliament’s agenda, but the full, authoritative text and its precise legislative stage need to be verified before specific proposed provisions can be described as settled. A bill may change during drafting and parliamentary consideration.

Second, classification needs operational detail. The framework outlines four risk tiers, but organisations will need sufficiently precise criteria and examples to know how their systems should be classified. The guide itself anticipates further risk-classification guidance.

Third, institutional responsibilities must work in practice. The proposed architecture distributes functions among several bodies. Its effectiveness will depend on clear jurisdiction, coordination, access to technical expertise and consistent decisions.

Fourth, technical capacity will affect compliance. Testing and auditing complex AI systems require skilled personnel, tools and credible standards. The proposed audit laboratory and sandbox could help build that capacity, but the guide describes them as part of a future implementation roadmap rather than evidence that all such facilities are already operating.

Fifth, remedies must be clear. Risk classification and technical assessments are not substitutes for a clear process when people are harmed. The eventual legal framework will need to clarify how complaints are handled, what corrective measures authorities can require and how liability is determined.

Finally, innovation policy and enforcement must be aligned. Egypt’s strategy aims to expand local AI capability. The regulatory system will need to distinguish between controls necessary to manage material risks and processes that add cost without providing proportionate protection.

These questions are not reasons to assume the framework will fail. They are the practical issues that will determine whether the proposal becomes an effective governance system rather than a collection of principles.

Egypt is preparing to move beyond a system in which AI governance relies primarily on a national strategy, a non-binding responsible-AI charter and general laws that were not designed specifically for AI.

The March 2026 governance guide provides a more detailed blueprint: four risk tiers, enhanced assessment for high-risk applications, transparency measures for limited-risk systems and an institutional model intended to connect national policy with technical assessment, data protection, cybersecurity and sectoral supervision.

The draft law is the next pivotal step, but its exact provisions and parliamentary status must be kept distinct from the framework already published. Until the legislation and its implementing rules are finalised, businesses should avoid treating the entire proposed architecture as settled law.

The wider economic stakes are clear. Effective governance could help build trust, clarify responsibility and support the development of AI services that respond to Egypt’s needs. Poorly defined or inconsistently implemented rules could increase uncertainty for the same developers and businesses the country wants to attract.

Egypt’s task is therefore not simply to regulate artificial intelligence. It is to establish a system in which innovation, accountability and rights protection can operate together—and in which companies and citizens can understand what the rules require.

The decisive test will not be how ambitious the framework looks on paper. It will be whether Egypt turns its proposed safeguards into clear, proportionate and enforceable practice.