August 2026 ยท Corporate & Commercial Law ยท 12 min read ยท Ahmad Abdulla Ahli Advocates & Legal Consultants
Artificial intelligence is becoming embedded in the UAE's economy, public administration, financial services, healthcare, transportation and digital infrastructure. At the same time, businesses deploying AI must navigate a legal environment that is developing rapidly and operates across several regulatory levels.
Rather than relying on a single, stand-alone AI statute, the UAE's practical AI regulatory framework is currently built from a combination of federal legislation, national AI policies, emirate-level rules, sector-specific regulations and guidance, and the independent legal regimes applicable in financial free zones such as the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM). The UAE's official policy framework places particular emphasis on responsible AI, privacy, safety, transparency, human oversight and accountability.
This means the legal question for a business is usually not simply "Is there a UAE AI law?" The more useful questions are what type of AI system is being developed or used, what data it processes, whether it makes or supports decisions affecting individuals, and in which emirate or free zone the business is operating.
The UAE's AI policy direction is rooted in the UAE Strategy for Artificial Intelligence 2031, which aims to strengthen the country's position as a global leader in AI across strategic sectors and government services. In April 2026, the UAE announced a framework intended to deploy Agentic AI across 50% of federal government sectors, services and operations within two years.
The UAE Charter for the Development and Use of Artificial Intelligence establishes 12 principles for responsible AI development and use, addressing matters including human-machine relationships, safety, algorithmic bias, data privacy, transparency, human oversight, governance and accountability. These principles are significant even where a policy document is not itself equivalent to legislation โ regulatory expectations relating to explainability, privacy, human oversight and risk governance increasingly appear across sector-specific requirements.
Even without a single comprehensive AI Act, several existing UAE laws directly affect the development, training, deployment and commercial use of AI.
Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data is one of the most important. AI systems frequently depend on significant amounts of information relating to customers, employees, patients or users. The law expressly addresses automated processing and profiling, and Article 18 provides a right โ subject to specified exceptions โ to object to decisions resulting from automated processing, particularly where those decisions have a legal impact or otherwise adversely affect the individual. Article 13 grants rights to obtain information concerning decisions made through automated processing, including profiling.
Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes is another important part of the AI compliance environment. Article 52 establishes offences relating to the dissemination of specified categories of false or misleading news, information, rumours or reports โ relevant when considering generative AI applications capable of automatically producing or distributing digital content. Businesses deploying generative AI should consider controls dealing with content moderation, factual verification, deepfakes, impersonation and escalation of potentially unlawful outputs.
Federal Decree-Law No. 38 of 2021 on Copyright and Neighbouring Rights gives copyright holders rights over reproduction, electronic storage, publication, modification and making protected works available through computers and information networks โ creating important issues for AI businesses concerning training datasets, web scraping, AI-generated outputs resembling existing works and ownership of commissioned AI developments. A properly drafted AI contract should address these issues expressly.
AI can also interact with UAE electronic-transactions law, which recognises the legal effectiveness of certain automated electronic transactions, including transactions created through automated systems without direct intervention by a natural person โ increasingly relevant as businesses move beyond simple chatbots toward AI agents capable of initiating workflows or executing transactions.
The DIFC has developed one of the UAE's most detailed regulatory approaches to personal data processed through AI and autonomous systems. It amended its Data Protection Regulations in 2023 to introduce Regulation 10, dealing with personal data processed through autonomous and semi-autonomous systems, including AI and generative or machine-learning technologies. The DIFC describes its framework as risk- and outcomes-based.
In June 2026, the DIFC consulted on further amendments seeking to strengthen safety requirements for systems processing personal data, clarify certification obligations and the role of an Autonomous Systems Officer. As of this article's review, these 2026 changes remained a consultation paper rather than enacted regulations โ businesses should monitor the final legislative outcome. DIFC also offers a dedicated AI Licence for qualifying AI developers, though licensing should not be confused with regulatory compliance.
The Central Bank of the UAE (CBUAE), Securities and Commodities Authority (SCA), Dubai Financial Services Authority (DFSA) and ADGM Financial Services Regulatory Authority (FSRA) jointly issued Guidelines for Financial Institutions Adopting Enabling Technologies, addressing AI governance, senior- management accountability, reliability, explainability, model validation, fairness and mechanisms allowing customers to question AI-driven decisions.
On 11 February 2026, the Central Bank issued its Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the UAE. It applies to licensed financial institutions, including insurers, and expressly addresses high-impact decisions such as loan applications or insurance claims โ making AI governance a consumer-protection and conduct issue, not merely an IT issue.
The Dubai Health Authority has issued an Artificial Intelligence in Healthcare Services Policy applicable within its jurisdiction, directing licensed professionals and healthcare facilities to comply. Healthcare businesses considering AI-assisted diagnosis, clinical decision support or medical-data analytics should conduct a dedicated regulatory assessment before deployment โ human clinical responsibility should not be assumed to disappear merely because an AI tool generated the recommendation.
On 14 June 2026, the UAE approved the establishment of the Artificial Intelligence and Data Authority โ the single national body responsible for data, AI and digital government, reporting directly to the UAE Cabinet. Its mandate consolidates functions previously performed by the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, the Digital Government Sector of the TDRA, and the UAE Data Office. Its responsibilities include developing the national AI strategy, proposing national policies and legislation, and setting AI and data standards.
In April 2026, the UAE also renamed the Ministerial Development Council as the Ministerial Council for Artificial Intelligence and Development. At emirate level, Abu Dhabi maintains its own Artificial Intelligence and Advanced Technology Council (AIATC). The TDRA continues to regulate telecommunications and ICT โ including its ICT Regulatory Sandbox โ while the DIFC Commissioner of Data Protection oversees Regulation 10 for AI systems operating in the DIFC.
Businesses developing, buying or deploying AI in the UAE should consider:
The UAE is positioning itself not merely as a market that uses artificial intelligence, but as a jurisdiction seeking to build AI into government, finance, infrastructure and the wider digital economy. For businesses, rapid innovation must be matched by equally sophisticated governance. AI regulation in the UAE cannot be analysed in isolation โ a single AI solution may simultaneously raise questions under data-protection law, cybercrime legislation, intellectual-property law, electronic-transactions rules and sector-specific or free-zone regulation.
Companies developing or deploying AI in the UAE should determine the applicable jurisdiction at an early stage, classify the risks created by each use case, document their governance processes and keep pace with rapidly developing regulatory requirements. Our firm advises businesses on structuring AI governance programmes and reviewing AI-related contracts under UAE law โ read more about our Corporate & Commercial Law practice.