TRW & Co · Technology & IP
Artificial Intelligence Law in the UAE
Artificial intelligence in the UAE is governed by data protection law, sector guidance and free zone rules rather than one AI Act. Banks now have Central Bank guidance, the DIFC regulates autonomous systems, and a child digital safety law took effect in 2026. This guide explains the rules, the decisions that matter and how to deploy AI with confidence.
Key pointIn the DIFC, a business that deploys an AI system processing personal data is treated as the controller even if a vendor runs the model, and high-risk processing requires an autonomous systems officer, so vendor choice never removes the deployer's accountability.
At a glance
No single AI Act
The UAE regulates AI through data protection, consumer, cybercrime and sector rules, guided by the 2024 Charter for the Development and Use of AI.
DIFC Regulation 10
Applies to personal data processed by autonomous and semi-autonomous systems, with notice duties and an autonomous systems officer for high-risk processing.
Central Bank AI guidance
A 2026 CBUAE guidance note expects licensed firms to explain high-impact AI decisions, offer human review, test for bias and oversee vendors.
Child Digital Safety Law
Federal Decree-Law No. 26 of 2025 took effect on 1 January 2026, with a one-year transition for platforms to comply.
Ownership of outputs
Copyright in purely machine-generated output is unsettled under Federal Decree-Law No. 38 of 2021, so contracts and trade secrets carry more weight.
Swipe or scroll →
What the law on artificial intelligence in the UAE covers
Artificial intelligence in the UAE is regulated less by a single statute than by a web of data protection law, sector rules, free zone regulations, intellectual property law and contract. For a business building, buying or deploying AI, the legal questions are concrete: can we train on this data, who owns the output, what must we tell customers, who is liable when the model is wrong, and which regulator will ask?
The government is one of the most active adopters of AI anywhere. The UAE appointed a Minister of State for Artificial Intelligence in 2017, launched its National AI Strategy 2031 the same year, and in 2025 announced that AI would help draft and review federal legislation. That ambition shapes regulation: the state wants AI deployed quickly, but with clear accountability, and regulators expect firms to show they have thought about risk.
The legal analysis usually starts when a business moves from experiment to production: a bank automates credit decisions, a hospital deploys a diagnostic tool, a retailer launches a customer-facing chatbot, or a group licenses a foundation model and fine-tunes it on customer data. Each step triggers different obligations depending on whether the business sits onshore, in a free zone, or in the DIFC or ADGM.
The legal and regulatory framework
The UAE has not adopted a horizontal, EU-style AI Act. Instead, binding obligations come from general laws applied to AI, supplemented by charters, guidelines and sector-specific guidance. The practical effect is that compliance depends heavily on the use case and the jurisdiction within the UAE.
Federal instruments
The UAE Charter for the Development and Use of Artificial Intelligence, issued in 2024, sets out principles including human oversight, safety, fairness, privacy and transparency. It is not a statute, but regulators and government procurers use it as a benchmark. Binding rules come from:
- the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, which covers automated processing and gives data subjects rights in relation to decisions based solely on it;
- the Cybercrime Law, Federal Decree-Law No. 34 of 2021, which criminalises misuse of data and the spread of false content, relevant to deepfakes and synthetic media;
- the Child Digital Safety Law, Federal Decree-Law No. 26 of 2025, in force from 1 January 2026 with a one-year transition, which imposes age assurance, privacy-by-default and advertising limits on platforms used by children;
- the Consumer Protection Law, Federal Law No. 15 of 2020, and the new Civil Transactions Law, Federal Decree-Law No. 25 of 2025, in force from 1 June 2026, which frame liability for defective products and services; and
- Federal Decree-Law No. 25 of 2018 on projects of a future nature, which allows temporary licences for innovative technologies that existing rules do not yet accommodate.
Institutions
Policy is led federally by the Minister of State for AI, Digital Economy and Remote Work Applications and the UAE AI Office, with the Telecommunications and Digital Government Regulatory Authority (TDRA) responsible for digital government and online-platform standards. Abu Dhabi has its Artificial Intelligence and Advanced Technology Council; Dubai has the Dubai Centre for AI, which runs the Dubai AI Seal as a credibility mark for AI providers. The UAE Data Office is the federal data protection regulator.
DIFC and ADGM
The DIFC went furthest. Regulation 10 of its Data Protection Regulations, introduced in 2023, applies to personal data processed through autonomous and semi-autonomous systems. Deployers are treated as controllers and operators as processors.
Deployers must give clear notice at first use, explain the purposes and safeguards, and, for high-risk processing, appoint an autonomous systems officer and meet certification requirements set by the Commissioner. The ADGM Office of Data Protection applies the ADGM Data Protection Regulations 2021, which give similar rights against significant automated decisions. Our pages on DIFC data protection and ADGM data protection go further.
| Area | Main instrument | Who it bites on | Key obligation |
|---|---|---|---|
| Personal data (onshore) | Federal Decree-Law No. 45 of 2021 | Controllers and processors outside DIFC/ADGM | Lawful basis, transparency, rights against solely automated decisions |
| Personal data (DIFC) | DIFC Data Protection Law and Regulation 10 | Deployers and operators of AI systems in or serving the DIFC | Notices, purpose limits, autonomous systems officer for high-risk processing |
| Financial services | CBUAE AI guidance note; 2021 joint enabling-technologies guidelines | Banks, insurers, finance companies and other licensees | Governance, explainability, human review, vendor oversight |
| Children online | Federal Decree-Law No. 26 of 2025 | Platforms and ISPs serving UAE users | Age assurance, no targeted ads to children, parental controls |
| Healthcare | Health authority AI policies; ICT Health Law | Providers and vendors licensed by MOHAP, DHA or DoH | Clinical validation, data localisation, accountability |
Sector rules that apply to AI
Financial services
In 2026 the Central Bank of the UAE issued a Guidance Note on Consumer Protection and the Responsible Adoption and Use of Artificial Intelligence and Machine Learning, applying to its licensed institutions. It builds on the November 2021 Guidelines for Financial Institutions Adopting Enabling Technologies issued jointly by the CBUAE, SCA, DFSA and FSRA.
The note expects firms to disclose AI use, explain high-impact decisions such as credit, pricing and claims in plain Arabic and English, provide human review on request, test for bias, and keep the ability to suspend an AI application. It also requires due diligence, audit rights and contractual protections for third-party AI. See our page on fintech regulation.
Healthcare
The Ministry of Health and Prevention, the Dubai Health Authority and Abu Dhabi's Department of Health each regulate the use of AI in clinical settings through policies and licensing conditions. Health data is also subject to the localisation rules in the ICT Health Law, Federal Law No. 2 of 2019, which matters for any cloud-hosted model. Our healthcare regulation team covers licensing.
Media, platforms and marketing
Generative AI used for advertising or content must respect media content standards, consumer protection rules on misleading claims and the Cybercrime Law's restrictions on false or harmful content. Synthetic images or voices of real people raise personality and privacy issues, and the government has published guidance on deepfakes.
AI in hiring, workplaces and government projects
Two everyday settings generate many of the questions we see about artificial intelligence in the UAE: employers using AI on staff and candidates, and suppliers selling AI to government.
Recruitment and workforce tools
CV screening, video-interview analysis, productivity monitoring and attrition prediction all process employee personal data and can produce decisions with significant effects. The UAE Labour Law, Federal Decree-Law No. 33 of 2021, prohibits discrimination on grounds such as race, colour, sex, religion, national or social origin and disability, and an AI tool that replicates historic bias can expose the employer even if a vendor built it.
Combine a data protection assessment with bias testing, tell candidates and staff that AI is used, and keep a human decision-maker for hiring, promotion and dismissal. Our employment policies team can help draft the internal rules.
Selling AI to government
Federal and emirate government entities are among the largest buyers of artificial intelligence in the UAE. Procurement typically requires compliance with national AI principles, information security standards and, often, hosting of data within the country. Expect detailed questionnaires on training data, model explainability, security certifications and Arabic-language capability. Contract terms in government deals tend to favour the buyer on IP and liability, so price the risk accordingly.
Before signing any AI vendor contract, ask three questions in writing: where will our data be processed and stored, will our inputs be used to train the vendor's models, and how will we be told if the model changes materially? The answers determine your data protection, outsourcing and consumer-protection position for artificial intelligence in the UAE, and they are far easier to fix before signature than after.
Key decisions when deploying artificial intelligence in the UAE
Projects involving artificial intelligence in the UAE turn on a small number of decisions that are hard to reverse once a system is live.
Build, buy or fine-tune
Licensing a third-party model shifts development risk but not regulatory accountability: the deployer remains responsible to customers and regulators. Building in-house gives control over training data and documentation but demands governance capacity. Fine-tuning a licensed model on your own data combines both sets of issues, so the licence must deal with rights in the fine-tuned weights and outputs. Our technology transactions team negotiates these terms.
Where to locate the business
A DIFC entity faces the most prescriptive AI-specific data rules but benefits from a common-law framework and a regulator that has published detailed expectations. An onshore or non-financial free zone entity operates mainly under the federal PDPL, whose operational detail depends on implementing regulations, so check the current position before relying on any specific deadline. Where a group serves customers across the UAE, more than one regime will usually apply.
Intellectual property in data and outputs
The Copyright Law, Federal Decree-Law No. 38 of 2021, protects original works and software, and databases with creative selection or arrangement. Whether purely machine-generated output attracts copyright is not settled, so businesses should rely on contract and trade secrets to protect valuable outputs and prompts. Training on third-party content without permission carries infringement risk. See our pages on copyright and content and trade secrets.
Licensing a model moves the engineering risk to the vendor. It does not move the regulator's question about who is accountable to the customer.
Process: taking an AI system from pilot to production
- Map the use case. Record what the system does, whose data it uses, which decisions it influences and which entities and jurisdictions are involved.
- Classify the risk. Identify high-impact decisions (credit, employment, health, insurance, access to services) and any children's or sensitive data. These attract the strictest expectations.
- Check data rights. Confirm the lawful basis for training and inference, cross-border transfer routes and any localisation rules for health, financial or government data.
- Contract with vendors. Negotiate warranties, IP ownership, audit rights, incident notification, data use limits, model change notices and exit.
- Design notices and human review. Prepare transparency notices in Arabic and English, escalation routes and a process for customers to contest outcomes.
- Test, document and approve. Run bias and accuracy testing, record results and obtain senior sign-off. Regulators expect to see the file.
- Monitor and review. Track drift, complaints and incidents, and re-run assessments when the model, data or purpose changes.
Documents and evidence to keep
AI inventory and register
A list of every AI use case, its owner, data sources, risk rating and status. DIFC Regulation 10 expects a register; other regulators ask for one in practice.
Impact assessments
Data protection impact assessments and algorithmic risk assessments for high-impact or novel processing, updated when the model or purpose changes.
Model documentation
Training data provenance, testing results, known limitations and human-oversight design. This is your best defence in a complaint, audit or dispute.
Contracts and notices
Vendor licences, data processing agreements, customer terms and AI disclosures. Inconsistency between them is a common source of regulatory and litigation risk.
Risks and common mistakes
Treating AI guidance as optional
Charters and guidance notes are not statutes, but regulators use them to interpret binding obligations such as fair treatment of customers, data protection and governance. A bank that ignores the CBUAE guidance on explainability may find the gap framed as a consumer protection breach. Health authorities can attach conditions to licences. Treat sector guidance as the standard you will be measured against, and document how you meet it or why a point does not apply.
Training on data you cannot use
Customer data collected for one purpose cannot always be repurposed to train a model. Under the PDPL and the DIFC and ADGM regimes, you need a lawful basis and transparent notice for training as well as for inference. Health and financial data carry extra restrictions, including localisation. Scraped web content and licensed datasets raise copyright and contract issues. Audit training data sources before training, not after a complaint.
Weak vendor contracts
Standard AI vendor terms often reserve the right to use customer inputs to improve the vendor's models, disclaim accuracy and cap liability at fees paid. For a regulated business those terms may be incompatible with confidentiality, outsourcing and data protection duties. Negotiate restrictions on data use, audit and information rights, notification of material model changes, security standards and meaningful remedies, and confirm where data is processed.
No human in the loop for high-impact decisions
Fully automated decisions on credit, insurance, employment or access to services attract specific rights under the PDPL and the DIFC and ADGM rules, and the CBUAE expects meaningful human involvement. A purely nominal review, where staff rubber-stamp the model's output, will not satisfy a regulator. Define when humans must intervene, give them authority and information to override, and keep records of overrides.
Ignoring children and synthetic media
Consumer-facing AI products may be used by children even if not designed for them. The Child Digital Safety Law requires proportionate age assurance and bars targeted advertising to children, with full compliance expected by early 2027. Generative tools that can produce images or voices of real people create defamation, privacy and cybercrime exposure. Build safeguards and content policies into the product rather than relying on terms of use.
Cross-border angle
Any project involving artificial intelligence in the UAE is likely to have an international supply chain: models are trained in one country, hosted in another and used in a third. For UAE businesses the main cross-border issues are data transfers, foreign AI laws with extraterritorial reach, and enforcement of contracts with offshore vendors.
European Union and United Kingdom. A UAE business placing AI systems on the EU market or whose outputs are used there may fall within the EU AI Act. The UK takes a sector-led approach similar in spirit to the UAE's. Groups with European operations should align their governance so that one framework satisfies both.
Singapore and China. Singapore's model governance framework and AI Verify toolkit are often used as reference points by UAE regulators and businesses. China regulates generative AI services and algorithmic recommendations directly; UAE firms licensing Chinese models or serving Chinese users need to check those rules.
Bangladesh, India and the GCC. Many UAE groups run development and operations teams in Bangladesh and India, which means personal data flows to those jurisdictions and must satisfy UAE transfer rules. Saudi Arabia's data and AI authority has issued its own AI ethics principles. Our page on cross-border data transfers explains the mechanics.
How TRW & Co helps with artificial intelligence in the UAE
We advise developers, deployers and investors on the legal side of AI projects, from first use case to scale. Where representation before UAE onshore courts or the DIFC/ADGM Courts is required, we work alongside locally licensed advocates and registered practitioners.
Regulatory mapping
We identify which federal, emirate, free zone and sector rules apply to each use case and turn them into a short list of concrete obligations and owners.
Contracts and licensing
We draft and negotiate model licences, AI-enabled SaaS terms, data licences and development agreements, with a focus on data use, IP and liability allocation.
Governance programmes
We build AI policies, inventories, impact assessments and notices that fit regulator expectations, working with our AI governance specialists.
Disputes and incidents
We advise on complaints, regulator enquiries, IP claims and vendor disputes arising from AI systems, including incident response with our cybersecurity team.
See all our practices for related technology, data and IP services.
Checklist for decision-makers
- Keep an up-to-date inventory of AI use cases across the group.
- Identify which use cases involve high-impact decisions or children's data.
- Confirm which data protection regime applies: federal, DIFC or ADGM.
- Check sector guidance from the CBUAE, health authorities or other regulators.
- Audit training data sources for consent, licence and localisation issues.
- Renegotiate vendor terms on data use, audit rights and liability.
- Publish clear AI notices and a route to human review.
- Assign board-level accountability and review the programme at least annually.
To discuss an AI project, contact TRW & Co at info@trw.co.
Frequently asked questions
01Does the UAE have a specific AI law?
Not a single horizontal statute like the EU AI Act. AI is regulated through existing laws applied to it, notably the Personal Data Protection Law, the Cybercrime Law, consumer protection law and the Child Digital Safety Law, plus sector guidance such as the Central Bank's AI guidance note. The DIFC has the most specific rules through Regulation 10 of its Data Protection Regulations. The 2024 UAE Charter for the Development and Use of AI sets the principles regulators use. Check for new instruments before each major deployment.
02Can we use customer data to train an AI model?
Only if you have a lawful basis and have told customers. Under the federal PDPL and the DIFC and ADGM regimes, training is processing in its own right, so data collected for service delivery cannot automatically be reused. Health and banking data face extra restrictions, including rules on keeping data in the UAE. Anonymisation can help but must be robust. Review your privacy notices, consents and data processing agreements before training begins.
03Who owns content created by generative AI in the UAE?
The position is unsettled. The Copyright Law, Federal Decree-Law No. 38 of 2021, protects original works, and it is unclear whether output with no meaningful human creative input qualifies. In practice, ownership is allocated by contract between the user and the provider, and businesses protect valuable outputs, prompts and fine-tuned models as confidential information. If outputs are commercially important, ensure your licence assigns or licenses rights to you and that human contribution is documented.
04What does the Central Bank expect from banks using AI?
The CBUAE's guidance note on consumer protection and responsible AI asks licensed institutions to govern AI at board and management level, disclose its use to customers, explain high-impact decisions in plain Arabic and English, provide human review on request, test for bias, protect data and keep the ability to suspend an AI application. It also expects due diligence and contractual protections for third-party AI. It builds on the 2021 joint guidelines on enabling technologies.
05Do we need a licence to offer AI services in the UAE?
There is no general AI licence. You need the trade or commercial licence appropriate to your activity onshore or in a free zone, and any sector licence the service requires, such as a financial services or healthcare licence. For innovative products that existing rules do not fit, Federal Decree-Law No. 25 of 2018 allows temporary licences, and regulators run sandboxes. Dubai's AI Seal is a voluntary credibility mark, not a licence.
06Does DIFC Regulation 10 apply to companies outside the DIFC?
It applies to deployers and operators that are subject to the DIFC Data Protection Law, which mainly covers entities registered in the DIFC and processing carried out in the DIFC, and can extend to some processing elsewhere on behalf of those entities. A Dubai mainland company using an AI system for its own customers is generally subject to the federal PDPL instead. Groups with a DIFC entity and onshore operations often face both regimes, so mapping data flows by entity is the first step.
07Who is liable if an AI system causes harm?
UAE law does not have a special AI liability regime. Liability follows general principles: contract, tort under the Civil Transactions Law (which was replaced by Federal Decree-Law No. 25 of 2025 from 1 June 2026), consumer protection and sector rules. The business that deploys the system to customers will usually be the first target, so it should secure indemnities, warranties and insurance from vendors and keep documentation showing reasonable testing and oversight.
Sources and official materials
- UAE Charter for the Development and Use of AI — National AI principles
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection — Federal data protection law
- ADGM Office of Data Protection — ADGM data protection and automated decisions
- Telecommunications and Digital Government Regulatory Authority — Digital government and child digital safety standards
- CBUAE guidance note on responsible AI (WAM) — Official news release on the Central Bank's AI guidance
- Central Bank of the UAE — Regulator of banks, insurers and finance companies
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
