Oman Has an AI Policy. What Does It Ask of You?

Oman's AI policy covers any business that uses AI with customers, not just the companies that build it. So if an AI agent answers calls or WhatsApp messages for your hotel, clinic or dealership, the question is simple: when it gets something wrong at 11pm, who answers for it, and can you show what it said? Most service teams can't answer that yet.

A quiet week, and a fair question

This Monday's scan covered the ministries, the Telecommunications Regulatory Authority and the main Omani news outlets. None of them announced a new rule for customer-facing businesses in the past ten days. So the Pulse takes up a question operations leads keep asking as they switch on AI for the tourist season and the National Day rush: Oman has an AI policy, so what does it actually ask of a business like mine?

What the AI policy actually is

The Ministry of Transport, Communications and Information Technology (MTCIT) issued the General Policy for the Safe and Ethical Use of Artificial Intelligence Systems. It is dated April 2025 and was announced in May 2025, and the ministry's own library calls it the National AI Policy 2025. It covers the whole life of an AI system, from building it to running it every day.

Here is the part owners miss. It applies to public and private organisations that build or use AI. A polyclinic that subscribes to an AI call agent counts as a user. So does a hotel whose WhatsApp replies come from a bot. The ministry says the policy rests on these principles:

• Transparency, so people understand when and how AI is used
• Fairness and reducing bias
• Accountability, so a person or organisation owns the outcome
• Inclusiveness and respect for privacy
• Human oversight of sensitive decisions
• Managing the risk that data or AI answers are misused

It also asks organisations to check performance regularly, document how decisions are made, and hand over compliance reports when a regulator asks for them. Legal commentary notes the policy has no fines of its own. That does not mean there are no consequences, as you will see.

Buying an AI agent from a vendor does not pass your responsibility to the vendor: customers and regulators still hold the business that put it on the line to account.

The 11pm call nobody could explain

Here is a composite example. Badriya runs the call desk at a three-branch polyclinic group in Muscat. In October her team switched on an AI agent to take calls after the desk closes at 10pm. One night a caller asked, half in Omani Arabic and half in English, "Tqbaloon my insurance card wala la?" The agent said yes. That was wrong: the insurer had left the clinic's panel in September.

The patient came in the next morning, was asked to pay cash, and complained. Badriya's director asked three questions she could not answer. Did the caller know she was talking to an AI? Where is the record of what it said? Whose job was it to keep its information up to date? Each question matches one of the policy's principles. How Badriya closed those gaps comes later.

The policy's asks, translated for a service desk

The law with teeth sits underneath

The policy may be soft, but it tells you to follow the data protection rules, and those are not soft at all. The Personal Data Protection Law became fully enforceable when its grace period ended on 5 February 2026. Before you process someone's data, the law says you must tell them who you are, why you are collecting it and what their rights are. The processing itself must be open and honest.

Every AI call involves personal data: a voice, a phone number, and often a health or insurance detail. A customer who thinks their data was misused can complain to MTCIT within 30 days of finding out. The ministry then contacts you, gives you 14 days to respond, and decides within 60. If your AI agent is a black box, 14 days will not feel like much time. And when a vendor processes the data for you, the law treats the vendor as acting on your behalf, so civil and administrative responsibility stays with you.

What proper oversight costs per month

Owners often assume compliance means hiring a consultant. For a business that already runs a call desk, most of it is staff time. Below is a composite sum for a polyclinic group whose AI agent handles 3,000 calls a month. Put in your own numbers.

For about OMR 100 a month, Badriya could answer every question her director asked. Weigh that against one lost patient, one argument over a cash payment, or two weeks spent piecing a call together from memory.

How Badriya closed the gaps

Badriya did not switch the AI off. She fixed the gaps in two weeks:

1. A new greeting in Arabic and English. It tells callers they are speaking to the clinic's AI assistant, that the call is recorded to handle their request, and that they can ask for a person at any time.
2. A one-page AI register. It lists what the agent may answer, what it must never decide (insurance approvals, clinical advice) and who owns each fact. The insurance panel list now has a named owner, who updates it the day it changes.
3. Clear handover triggers. Calls about insurance, billing disputes or symptoms, and any upset caller, go to staff. When the desk is closed, they go to a callback list for the morning.
4. A weekly review of 15 sample transcripts, logged in a simple sheet: what was wrong, and what was changed.
5. A retention rule agreed with her data protection officer: recordings and transcripts are kept for a set period, then deleted.

The patient got an apology and the difference refunded. When the director next asked to see a call, Badriya pulled it up in ten minutes, not ten days.

What this means for you

If a customer can reach AI anywhere in your business, you are a user under the AI policy and responsible for that data under the data protection law. You do not need a new department. You need to answer four questions on any day: Did the customer know? Who owns what the AI says? Where is the record? When does a person step in?

Start with your busiest channel. During the tourist season and the run-up to National Day, that is often the line taking calls after your desk closes. Ask your vendor where transcripts are stored, whether data stays in Oman, and how fast you can pull up one conversation. The consent and recording rules for calls are collected in one place in our Oman AI calling guide.

The bottom line

Oman's AI policy does not ask you to stop using AI. It asks you to own it: tell customers, keep records, let a person step in, and look after their data. Do that, and the 11pm call becomes a ten-minute check instead of two weeks of guesswork.