Guide · AI guardrails in the UAE and the GCC

LLM guardrails for banks, telecoms and government in the GCC

Banks, telecoms and public services in the Gulf are putting AI assistants and agents in front of customers and staff, in Arabic and English. This guide covers what an LLM guardrail adds for a regulated team in the UAE and the wider GCC: where it runs, what the regulators care about, how it connects, and how to roll it out without risk.

Guardrino is in development and offered through watch-only pilots: it records what it would have done on your traffic and blocks nothing until you decide.

Request a pilot

Why regulated teams in the Gulf need AI guardrails

An assistant that reads account data, a telecom bot that can swap a SIM or change a plan, a government service that answers in Arabic: each one takes instructions in plain language from people the organisation does not control. OWASP ranks prompt injection as the top risk for LLM applications, and lists indirect injection, through web pages and documents the model reads, alongside direct attacks (OWASP LLM01).

Three things make the Gulf different. Customers write in Gulf dialect, Arabizi and English, often in the same message, which many guards built for English do not read well (see Arabic LLM guardrails). Regulators expect AI to be governed like any other risk, with human oversight and records. And data-protection laws in the UAE and Saudi Arabia set rules on how personal data is secured and when it may leave the country.

AI guardrails in the UAE and the GCC therefore need to do two jobs: stop attacks in the languages customers really use, and give the security and risk teams the evidence they need to show how the AI is controlled.

Where Guardrino runs, and where your data goes

Guardrino Sovereign: installed inside your network, including air-gapped environments. Models, logs and the console run on your infrastructure. With Guardrino Sovereign, the messages Guardrino checks stay in your country, on your servers.
Guardrino Cloud: a managed gateway in a cloud region in your country, or the nearest one available. This hosted option is planned; pilots today run inside your environment.
Your AI model: Guardrino forwards checked messages to whichever model you configure, a local model or a provider abroad. Where that model runs, and what your contract with its provider says, is your decision and outside Guardrino’s control.

Personal-data masking helps here: Emirates ID, iqama numbers, IBANs, local phone numbers and secrets such as API keys are replaced before a message reaches the model or the logs, so what leaves your network is the masked form. It is built for data-residency requirements; it does not decide for you whether a transfer is allowed.

What GCC regulators care about, and where a guardrail fits

None of the texts below names a product, and a guardrail does not, on its own, satisfy any of them. What a guardrail can do is give your team a concrete, logged control to describe, test and show when it documents how its AI apps are protected. Read the texts themselves and ask your legal and risk teams; this is a short orientation, not legal advice.

Summaries of public texts, linked in the sources below. A guardrail is one control among many and does not establish conformity with any of them.
Authority or law	What it focuses on	How a guardrail can help you document your controls
CBUAE, Central Bank of the UAE	A guidance note for licensed financial institutions on consumer protection and the responsible use of AI and machine learning: governance and accountability, fairness, transparency, human oversight, and data management and privacy.	An audit log of every AI decision, watch-only mode before blocking, a review queue where people decide on unclear cases, and masking of customer data before it reaches a model.
SAMA, Saudi Central Bank	The Cyber Security Framework for financial institutions it regulates: a common approach to cyber security, a target maturity level for controls, and proper management of cyber risk.	A defined control for one new risk, prompt attacks on AI apps, with policies as code, versioned rules and exportable logs for your security operations.
QCB, Qatar Central Bank	An AI guideline for licensed entities covering governance, risk management, outsourcing, human oversight and approvals for higher-risk AI systems.	Records of what the AI received and what was blocked or allowed, and human control over when blocking is switched on.
NCA, Saudi National Cybersecurity Authority	The Essential Cybersecurity Controls (ECC-2:2024) for government bodies and operators of critical national infrastructure, including data and information protection, event logs and monitoring, web application security, and third-party and cloud cybersecurity.	Security events from the AI layer sent to your SIEM, data masking by classification, and an on-premises option for teams that keep systems in-house.
PDPL: UAE Federal Decree-Law No. 45 of 2021, and the Saudi Personal Data Protection Law	Security and confidentiality of personal data, conditions for cross-border transfers, and breach notification (the Saudi regulator is SDAIA). DIFC and ADGM in the UAE have their own data-protection rules.	Masking of personal data before it reaches the model or logs, a choice of where the check runs, and a record of what personal data was seen and masked.

NIST’s generative AI profile is also useful as a common language for risk teams: it describes direct and indirect prompt injection as an information-security risk generative AI adds (NIST AI 600-1). OWASP’s system-prompt leakage entry adds a point every regulated team should take on board: the system prompt is not a security control, and secrets, roles and permission structures do not belong in it (OWASP LLM07).

Single sign-on and roles

Single sign-on for the Guardrino console is Built and tested, not yet released. It uses OpenID Connect, the standard behind Okta, Ping Identity, OneLogin, Keycloak and Microsoft Entra ID, and UAE PASS, the UAE national digital identity, through OAuth 2.0. Viewer, operator, policy admin and auditor roles come from your directory groups, and MFA from your provider. Every admin action records who did it.

How Guardrino connects to your stack

Four ways in, so you can start with the one your team already uses. The developer guides give the details for each.

Inspect API: your app sends a message to Guardrino and gets a verdict back, then decides what to do. The lightest way to start.
OpenAI-compatible proxy: point your app at Guardrino instead of the model provider. It checks the prompt, forwards it, and checks the answer while it streams back.
LiteLLM plugin: if you already route models through LiteLLM, the open-source `guardrino-litellm` plugin adds the check there (GitHub).
MCP security proxy: for agents that use tools through the Model Context Protocol, Guardrino sits between the agent and its tool servers and checks what goes through. Finer per-tool controls for agents are planned.

Watch-only, then enforce

Every rollout starts in watch-only mode: Guardrino reads the real traffic, records what it would have masked, warned about or blocked, and changes nothing for your users. Your team reviews the findings, tunes thresholds per app, and switches blocking on app by app when the evidence supports it. A new rule or model version can run in shadow mode next to the live one before it decides anything. The admin console keeps policies as code, with tests and versions, and exports events to your SIEM.

How long the check takes, and how the model behind it compares on Arabic, is in the Guardrino-t7 v7 report: every model timed on the same machine, with the method and its limits.

By sector

Each use-case page lists public incidents, the techniques behind them, where Guardrino helps and what stays your job:

Banking: assistants and agents that can see accounts or start a payment.
Telecoms: bots that change plans, SIMs and account details.
Booking and travel: agents that book, change and refund.
Client-facing AI assistants: any assistant that speaks to the public, including government services.

For the attacks themselves, in dialect, Arabizi and hidden text, read Arabic prompt injection.

What a guardrail does not do for a regulated team

It does not satisfy any regulation on its own. It is one documented control your team can describe and test.
It does not catch every attack, and it sometimes blocks a safe message. You set the trade-off, per app.
It does not fix answers your model makes up, authorise payments or replace fraud controls.
It only sees what is routed through it.
It does not decide where your AI model runs. That stays your choice and your contract.
A vendor’s test is not your test. Ours, with its full method and data, is our own and favours our model; a pilot measures yours.

Questions about LLM guardrails in the GCC

Does our data leave the country?

Guardrino runs on your own servers (Guardrino Sovereign) or in a cloud region in your country, or the nearest one available (Guardrino Cloud). The check itself never sends your messages anywhere else. Where your AI model runs is your choice, and if that model is abroad, the messages you send it go abroad. Masking can remove personal data before they do.

Is Guardrino Cloud available?

Not yet. The hosted option is planned. Pilots today run inside your own environment.

Does using Guardrino satisfy CBUAE, SAMA, QCB, NCA or PDPL rules?

No product can promise that, and we do not. A guardrail gives your team a logged, testable control for prompt attacks and data exposure in AI apps, which you can describe when you document your controls. Whether your overall setup satisfies a regulator is for your legal and risk teams and the regulator to judge.

Can our staff sign in with our identity provider or UAE PASS?

Single sign-on is Built and tested, not yet released: OpenID Connect for Okta, Ping Identity, OneLogin, Keycloak and Microsoft Entra ID, and UAE PASS through OAuth 2.0, with roles from your directory groups.

Which AI models does it work with?

Any model your apps call through an OpenAI-compatible API, through LiteLLM, or through MCP for agents, hosted or your own. You can change provider without changing your guard.

What does a pilot involve?

About eight weeks in watch-only mode on one assistant: install in your environment, weekly reviews of what Guardrino saw, and a findings report with attacks by kind and dialect, false blocks and recommended settings. Nothing is blocked during the pilot.

Do you have customers in the region?

Guardrino is in development and offered through watch-only pilots. We do not claim customers or deployments.

Start with a 60-day watch-only pilot.

Guardrino watches one of your assistants on its real traffic, in your environment, and you get a findings report your security and risk teams can use. It blocks nothing until you decide. Join the pilot or read Guardrino for your company.

Request a pilot · Guardrino