Building the Operating Model: The Gulf’s Operations-Led Approach to Advanced Air Mobility

As the framework for advanced air mobility (AAM) continues to evolve around the globe, the Gulf Cooperation Council (GCC) states—including Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the United Arab Emirates (UAE) in particular—have taken an operations-led path, allowing regulation, vertiports, air corridors, airspace management, and early commercial deployment to develop alongside one another rather than strictly in sequence.  

HOW THE GCC REGULATORS ARE APPROACHING THE MARKET

The defining feature of the GCC regional approach is the speed of regulatory response rather than the comprehensiveness of any single instrument. Gulf regulators benefit from fast policy networks, and they have used that advantage to integrate multiple authorities at both federal and local levels (including road and transport, air traffic management, and infrastructure and financing) around a workable solution, before building a fully robust regulatory landscape.

The emphasis is on tying the pillars together so that operations can begin, with the rules evolving as the market matures. 

UNITED ARAB EMIRATES: IMPLEMENT FIRST, REGULATE ALONGSIDE

The UAE is the most advanced AAM jurisdiction in the GCC region and is arguably one of the most advanced globally. Its implementation method for AAM is similar to the way it has handled other emerging technologies such as AI and virtual assets: begin operating while developing the regulatory framework in parallel. The logic is to make progress and refine the rules as real experience accumulates, rather than hinder deployment to wait for a complete framework.

The physical buildout is also advanced in the UAE. A vertiport near Dubai International Airport is reported to be substantially complete, with several other hubs in development, and the country is pursuing two parallel models across Abu Dhabi and Dubai, each progressing with its own original equipment manufacturer relationships. The UAE frames AAM specifically as an urban mobility solution (i.e., a response to rapid population growth in its major cities), which sharpens the commercial case and explains the urgency behind reaching operations.

AAM stakeholders also benefit from broad policy support from the UAE, including promotion of public-private partnership: regulators and government entities have been willing to give operators the breathing space to work through challenges unique to the region, from extreme weather to dense and busy airspace, by negotiating positions collaboratively rather than imposing them.

Stakeholders also benefit from sandbox regimes: time-limited exemptions from existing regulations, typically running between one and five years, that let a company treat the UAE as a working laboratory to trial its technology, understand the market, and adapt its operations before fixed rules are finalized.

On commercial readiness, Dubai is close to a first pilot operation. Timelines may slip, but the direction is clear: the UAE intends to be a first mover, and has shown itself to be a quick learner and adaptor.

SAUDI ARABIA: BUILDING THE CITY AROUND THE TECHNOLOGY

Saudi Arabia is solving a different problem. While the UAE is addressing the needs of mature, established urban centers, Saudi Arabia is building those centers, and it has folded urban air mobility into Vision 2030 as one of the tools for developing its smart cities and gigaprojects. AAM features across the Red Sea developments, NEOM, and the buildout of Riyadh as a financial and infrastructure hub, with a clear emphasis on tourism and on positioning Riyadh as a modern global center.

That orientation means progress is, in some respects, more measured: much more of the surrounding framework has to be established from scratch, and several of the relevant projects remain in development. The policymaking itself, however, is far from passive. A recently activated memorandum of understanding between Boeing’s Saudi entity, the civil aviation regulator, and a national university is intended to deliver a broad operational feasibility analysis for the Kingdom, including a framework for airspace management driven by AI models, effectively removing human intervention from airspace deconfliction.

WHY TECHNOLOGY AND CYBERSECURITY HAVE MOVED TO CENTER FOCUS

If the operating model is what distinguishes the Gulf, technology and cybersecurity factors will increasingly determine whether it holds. Two developments have pushed these issues to the front of the regulatory agenda.

The first is the region’s security environment. Recent geopolitical events have prompted a genuine concern that AAM projects could be derailed; in practice, the short-term operational impact has been limited and activity has largely returned to pace, with governments publicly reaffirming their commitment to the sector.

The longer-term consequences, however, are a discernible tightening of expectations and a particular and growing focus on data and cybersecurity. Regional disruption to digital infrastructure has also sharpened official thinking about resilience and contingency: the need for credible backup arrangements for critical data and a recognition that operations, including government functions, can be affected when cloud infrastructure is compromised. For an AAM operator whose aircraft generate continuous flight telemetry, generate mapping and passenger data, and depend on resilient connectivity and positioning, this is not a peripheral concern.

The data dimension is where the Gulf’s posture is evolving fastest and where it most clearly enables market entry. The UAE applies data localisation requirements in areas such as the Internet of Things (IoT), and because that regulation is broadly drafted the authorities in practice take a wide, formalistic view of which data must remain in the country and on what terms it may be transferred abroad.

The recently announced consolidation of data, AI, IoT, and cybersecurity oversight into a single federal authority signals an intent to deploy a more unified regime on foreign technology entrants, with data localisation and intellectual property treated as cornerstone issues.

Enforcement of localisation has historically been lighter than the rules themselves imply, but that is shifting, driven in part by the state’s heightened concern to know what happens to data that leaves the country, including the possibility of its misuse. Saudi Arabia’s privacy and cybersecurity laws differ markedly from the UAE’s and in several respects demand stricter compliance.

OUTLOOK

The UAE and Saudi governments want to actively develop the AAM market, which points to continued investment, more public-private partnerships, and more experimental regulatory structures designed to turn ambitious concepts into practical, revenue-generating operations.

For AAM stakeholders, the guidance that follows is consistent: engage the regulators early and often, build through partnerships and ecosystem participation rather than standalone product approval, think well beyond aircraft certification to infrastructure, energy, connectivity, and data, and treat cybersecurity and data governance as central design questions rather than afterthoughts.

Above all, proposals that align with national strategic objectives—diversification, smart-city development, and resilience—will find the fastest path to operations.