Introduction

Artificial intelligence is increasingly being incorporated into energy operations, including electricity-grid management, petroleum exploration, refinery optimization, predictive maintenance, industrial control, cybersecurity and energy-demand forecasting. In Kuwait, the use of foreign-developed or foreign-controlled AI systems in critical energy infrastructure raises questions concerning national security, data sovereignty, cybersecurity, operational safety and protection of strategic petroleum resources.

Kuwait does not presently have a single comprehensive statute specifically titled as a law restricting foreign AI in critical energy operations. Instead, such restrictions would need to be developed through the existing legal framework governing natural resources, cybersecurity, foreign investment, critical infrastructure, government procurement, data protection, petroleum operations and national security.

Constitutional foundation

Article 21 of the Constitution provides that Kuwait's natural wealth and resources are the property of the State. This principle is significant where AI systems are used to control or optimize strategic petroleum and energy infrastructure.

Article 20 concerns the national economy and development, while Article 50 establishes the constitutional framework for governmental functions. These provisions support State responsibility for protecting strategic resources and ensuring that their management remains subject to lawful governmental authority.

Accordingly, foreign participation in an AI system operating critical energy infrastructure cannot automatically be treated as an ordinary commercial technology arrangement.

Critical energy operations

Critical energy operations can include:

Oil and gas production systems.

Refineries and petrochemical facilities.

Electricity-generation plants.

Transmission and distribution networks.

Natural-gas pipelines.

Petroleum pipelines.

Fuel-storage facilities.

Export terminals.

Industrial-control systems.

Energy-sector cybersecurity platforms.

An AI system that merely analyzes publicly available information presents a different risk from an AI system capable of directly influencing industrial-control equipment.

Meaning of foreign AI

A foreign AI system may involve different forms of foreign participation. For example, the underlying model may be developed abroad, the cloud infrastructure may be located outside Kuwait, the vendor may be foreign-owned, or foreign personnel may have administrative access to the system.

Therefore, regulation should distinguish between:

Foreign ownership of the AI provider.

Foreign hosting of energy data.

Foreign remote access.

Foreign control of operational systems.

Foreign software supply-chain dependencies.

Each creates a different legal and security risk.

Cybersecurity framework

Kuwait's Cybercrime Law No. 63 of 2015 provides a general framework concerning cyber-related offences. However, cybersecurity protection of critical energy infrastructure requires broader operational controls than criminal prohibitions alone.

A critical-energy AI framework could require:

Security assessments before deployment.

Access controls.

Network segregation.

Continuous monitoring.

Incident reporting.

Backup and recovery systems.

Human authorization for critical decisions.

Security testing of AI software.

AI systems connected to operational technology should receive stricter controls than systems used only for administrative purposes.

Data sovereignty

AI systems require large quantities of operational data. Energy data can include information concerning production levels, reservoir conditions, electricity demand, infrastructure configuration and industrial processes.

Where sensitive energy information is transferred to foreign cloud systems, questions can arise concerning confidentiality, national security and foreign legal access.

A regulatory framework could therefore require sensitive operational data to remain within Kuwait or within specifically authorized environments.

Foreign investment considerations

The Foreign Direct Investment Law No. 116 of 2013 provides a framework for foreign investment subject to applicable requirements.

Foreign investment in energy-related AI technology may provide technical expertise and capital. However, where the technology is integrated into critical infrastructure, investment approval can reasonably include security-related conditions.

Possible conditions could concern:

Ownership and control.

Data location.

Remote access.

Cybersecurity standards.

Personnel access.

Technology transfer.

Business continuity.

Government inspection rights.

Public-private partnerships and procurement

The Public-Private Partnership Law No. 116 of 2014 may become relevant where AI infrastructure forms part of a qualifying public project.

Government procurement contracts can also impose security conditions on foreign technology suppliers.

Contracts should clearly address:

Source-code or model-access arrangements where appropriate.

Data ownership.

Cybersecurity responsibilities.

Audit rights.

Software updates.

Incident notification.

Vendor termination.

Exit and migration arrangements.

A critical energy operator should avoid becoming permanently dependent upon a foreign vendor where replacement would be technically impractical.

Human oversight

A particularly important legal principle is that AI should not necessarily receive unrestricted authority over safety-critical energy operations.

AI can assist with prediction and optimization, but decisions involving emergency shutdowns, major operational changes or potentially dangerous physical consequences may require authorized human supervision.

A legal framework could therefore classify AI applications according to risk and require human approval for the highest-risk functions.

AI supply-chain security

Foreign AI systems may depend upon external software libraries, cloud services, chips, application-programming interfaces and continuous vendor updates.

This creates supply-chain risks because an external provider could discontinue support, modify the system or experience a cybersecurity incident.

Critical-energy operators should therefore maintain:

Vendor-risk assessments.

Alternative suppliers where practical.

Offline or independent backup systems.

Software-version controls.

Technical documentation.

Exit strategies.

Environmental and safety considerations

AI may influence petroleum production, refinery operations and electricity generation. An inaccurate or malfunctioning AI system could therefore create environmental or safety consequences.

The Environment Protection Law No. 42 of 2014, as amended, provides Kuwait's broader environmental framework.

AI deployment should consequently be evaluated not only for cybersecurity but also for potential environmental and operational consequences.

Comparative case law

Comparative judicial decisions can provide useful principles concerning governmental control of strategic infrastructure.

In PTC India Ltd. v. CERC, (2010) 4 SCC 603, the Indian Supreme Court examined statutory authority within electricity regulation. Although the case is not binding in Kuwait and does not concern AI, it provides comparative guidance on the importance of clearly defined regulatory powers.

In Tata Cellular v. Union of India, (1994) 6 SCC 651, the Court considered judicial review of governmental procurement and administrative decisions. This can provide comparative guidance when governments impose security conditions on technology suppliers.

Energy Watchdog v. CERC, (2017) 14 SCC 80 provides comparative guidance concerning contractual obligations and unforeseen circumstances in energy projects. It is not binding in Kuwait but is relevant when considering vendor contracts and allocation of technology-related risks.

Proportional restrictions

A restriction on foreign AI should be based on the actual risk created by the technology rather than simply its country of origin.

For example, an AI tool used for general administrative work may create substantially less risk than an AI system capable of directly controlling refinery equipment.

A risk-based legal framework could therefore classify AI applications into:

Low-risk: administrative and non-operational applications.

Medium-risk: analytical systems using sensitive energy data.

High-risk: systems connected to operational technology.

Critical-risk: AI capable of directly influencing essential energy infrastructure.

Higher-risk systems could require stronger security controls, government approval and local operational control.

Licensing and regulatory oversight

A future Kuwaiti framework could require authorization before foreign AI systems are deployed in designated critical-energy facilities.

Approval conditions could include:

Technical certification.

Cybersecurity assessment.

Data-residency requirements.

Local human oversight.

Government audit rights.

Incident-reporting duties.

Periodic reassessment.

Immediate suspension powers in serious security circumstances.

This would create a regulatory framework without necessarily prohibiting all foreign AI technology.

Conclusion

Kuwait's existing legal framework does not appear to establish a single comprehensive prohibition on foreign AI in critical energy operations. Instead, restrictions would need to be constructed through constitutional petroleum governance, cybersecurity rules, environmental regulation, foreign-investment controls, procurement requirements and contractual safeguards.

Article 21 of the Constitution is particularly important because it establishes State ownership of Kuwait's natural resources. The Cybercrime Law No. 63 of 2015 provides a cybersecurity-related legal foundation, while the Foreign Direct Investment Law No. 116 of 2013 and Public-Private Partnership Law No. 116 of 2014 provide mechanisms through which conditions can potentially be imposed on foreign participation.

The strongest regulatory approach would be risk-based rather than a blanket prohibition. Foreign AI could potentially be permitted for lower-risk analytical functions while systems capable of directly controlling critical petroleum, electricity or industrial infrastructure could face substantially stronger requirements concerning local control, cybersecurity, data residency, human supervision and government audit.

Comparative decisions such as PTC India, Tata Cellular and Energy Watchdog provide useful principles concerning regulatory authority, procurement and contractual risk, although they are not binding Kuwaiti precedents.

A comprehensive future framework could therefore protect Kuwait's strategic energy infrastructure while still allowing access to beneficial international AI technologies. The central legal objective would be to ensure that foreign technology does not compromise national control, operational safety, cybersecurity, sensitive energy data or continuity of critical energy services.