Skip to main content

    AI by country · Middle East

    AI in the United Arab Emirates: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in United Arab Emirates know before starting with AI?

    The UAE has no single AI law as of 29 October 2026. Onshore, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) applies, while companies in the DIFC and ADGM free zones follow their own data protection laws. The first job is to work out which regime covers you, then check automated decisions, transfers abroad and breach reporting under that regime.

    At a glance

    United Arab Emirates at a glance

    Key facts about United Arab Emirates
    Data protection lawFederal Decree-Law No. 45 of 2021 (PDPL), in force since 2 January 2022; DIFC Data Protection Law No. 5 of 2020; ADGM Data Protection Regulations 2021
    RegulatorUAE Data Office (federal, named in the PDPL as the Bureau); DIFC Commissioner of Data Protection; ADGM Commissioner of Data Protection
    AI policyUAE Strategy for Artificial Intelligence (launched October 2017, 2031 horizon) and the UAE Charter for the Development and Use of AI. No dedicated AI law as of 29 October 2026
    Time zoneGST, UTC+4 (India is 1.5 hours ahead)
    CurrencyAED (UAE dirham)
    Business languageArabic and English

    Why now

    Why United Arab Emirates is worth watching

    Each point links to the document it comes from.

    • The UAE government says it launched its Strategy for Artificial Intelligence in October 2017, covering sectors such as transport, health, energy, water and education.[5]

    • The UAE Charter for the Development and Use of AI sets 12 principles, including safety, algorithmic bias, data privacy, transparency and human oversight.[6]

    • The Cyber Security Council's National Cyber Security Policy for AI sets minimum security requirements for adopting AI, from governance to incident response.[7]

    • A federal framework calls for agentic AI in 50% of government sectors, services and operations by 2028, so suppliers to government will meet AI requirements more often.[8]

    • Since 2023 the DIFC has had a specific regulation for personal data processed by autonomous and semi-autonomous systems, Regulation 10.[3]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

    In force2021People can object to decisions from automated processing, including profiling, that have legal or adverse effects, and the controller must add human review on request (Article 18). An impact assessment is needed before automated profiling with legal or serious effects (Article 21). Transfers abroad need an adequate country or a listed ground such as a contract or explicit consent (Articles 22 and 23). The Executive Regulations that set breach deadlines and penalties had not been confirmed as issued, so their status is unclear as of 29 October 2026.[1]

    PDPL scope exclusions

    In force2021The PDPL does not apply to government data, health data or banking and credit data that have their own laws, or to free zone companies with their own data protection laws (Article 2). So a hospital, a bank or a DIFC firm must check its own rules first.[1]

    DIFC Data Protection Law No. 5 of 2020 and Regulation 10

    In force2020People can object to decisions based solely on automated processing with legal or serious effects and ask for manual review (Article 38), and breaches go to the Commissioner as soon as practicable (Article 41). Regulation 10 requires clear notice when a system processes data in ways not directed by a person. It bars commercial use of such systems for high-risk processing until the Commissioner sets certification rules and an Autonomous Systems Officer is appointed.[3]

    ADGM Data Protection Regulations 2021

    In force2021People have a right not to be subject to solely automated decisions with legal or similarly significant effects, with exceptions for contracts, explicit consent and some legal duties (section 20). Breaches must be reported to the Commissioner within 72 hours where feasible (section 32). Fines can reach USD 28 million (section 55).[4]

    Where AI fits first

    Where AI fits first

    Banking and finance

    Know-your-customer document checks, fraud alerts and Arabic and English customer service.

    The PDPL excludes banking and credit data that has its own legislation, so check Central Bank rules. Firms in the DIFC or ADGM follow those zones' data laws instead.[1]

    Health care

    Drafting clinical notes and triage support, with clinicians making decisions.

    The PDPL excludes health data that has its own law. The PDPL's preamble cites Federal Law No. 2 of 2019 on ICT in the health fields, which you should check.[1]

    Government services and suppliers

    Agents that answer service questions or prepare case files for staff to approve.

    Federal entities now have Chief Executive Officers for AI, and the agentic AI target runs to 2028. The PDPL itself does not apply to government data.[9]

    Professional and financial services in free zones

    Contract review and research assistants for advisory firms in the DIFC or ADGM.

    In the DIFC, Regulation 10 notice rules apply when a system processes personal data on its own initiative.[3]

    Your first steps

    Your first steps

    1. Confirm whether you sit onshore, in the DIFC, in ADGM or in another free zone, because that decides which data law applies.
    2. List each AI decision that affects a person and set up human review on request, as the PDPL, DIFC and ADGM rules all require in some form.
    3. Run an impact assessment before any automated profiling with legal or serious effects.
    4. Map where personal data is stored and processed, and record the transfer ground for each country outside the UAE.
    5. If you are in the DIFC, write the Regulation 10 notice for any app or website that uses AI on personal data.
    6. Prepare a breach process that can reach the ADGM Commissioner within 72 hours, or the DIFC Commissioner as soon as practicable.
    7. Check the National Cyber Security Policy for AI and use it as a baseline for securing models and data.

    AI services for United Arab Emirates

    AI consulting and development for teams in United Arab Emirates

    We work remotely with companies in United Arab Emirates, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. The UAE is on UTC+4 and India on UTC+5:30, a 1.5 hour gap. Taking a 9:00 to 18:00 day in the UAE and 9:30 to 18:30 in India, the overlap is 8 hours, from 09:00 to 17:00 UAE time, Monday to Friday.

    Questions

    Common questions about AI in United Arab Emirates

    Does the UAE have an AI law?

    Not a dedicated one as of 29 October 2026. AI is shaped by the data protection laws, the AI Charter and the National Cyber Security Policy for AI. In the DIFC, Regulation 10 is the nearest thing to an AI rule.

    We are in the DIFC. Does the federal PDPL apply to us?

    Article 2 of the PDPL excludes free zone companies that have their own data protection legislation. The DIFC has its own law, so DIFC firms follow DIFC Law No. 5 of 2020. Check with a lawyer if you also process data onshore.

    Have the PDPL Executive Regulations been issued?

    We could not confirm it. Article 28 said they would come within six months, and Article 29 gives businesses six months from their issue to comply. A UAE business publication reported in August 2026 that they had not been issued.

    Can we use an AI service hosted outside the UAE?

    Under the PDPL, yes, if the destination has adequate law approved by the Data Office or a listed ground applies, such as a contract with protections or the person's explicit consent. The DIFC and ADGM have their own transfer rules.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] UAE Legislation (federal government portal), 2021-09-20. Federal Decree by Law No. (45) of 2021 Concerning the Protection of Per…(uaelegislation.gov.ae)
      Full title and what we used it for

      Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data. Primary, official English text read in full. Used for Articles 2, 9, 10, 18, 21, 22, 23, 28, 29 and 31 (in force on 2 January 2022).

    2. [2] Dubai International Financial Centre, 2025-07-01. Data Protection Law, DIFC Law No. 5 of 2020 (consolidated version, July…(difc.com)
      Full title and what we used it for

      Data Protection Law, DIFC Law No. 5 of 2020 (consolidated version, July 2025). Primary. Consolidated text as amended by DIFC Laws Amendment Law No. 1 of 2025, downloaded from this page. Used for Articles 38 and 41.

    3. [3] Dubai International Financial Centre, 2023-09-01. Data Protection Regulations, Consolidated Version No. 2 (in force 1 Sep…(difc.com)
      Full title and what we used it for

      Data Protection Regulations, Consolidated Version No. 2 (in force 1 September 2023), Regulation 10. Primary, regulations PDF linked from this page. Used for Regulation 10 notice rules, the high-risk restriction, the Autonomous Systems Officer, and the DIFC's Articles 38 and 41 context. We did not find whether the Commissioner has set the certification rules, so that is unclear.

    4. [4] Abu Dhabi Global Market, 2021-04-22. Data Protection Regulations 2021 (ADGM rulebook)(en.adgm.thomsonreuters.com)
      Full title and what we used it for

      Data Protection Regulations 2021 (ADGM rulebook). Primary, official ADGM rulebook. Used for sections 20, 32, 55 and 64. The date is the start of the earliest version the rulebook shows for section 55; amendments from 2022 to 2025 are listed on the rulebook and were not read.

    5. [5] UAE Government portal (u.ae), 2024-12-30. UAE Strategy for Artificial Intelligence(u.ae)
      Full title and what we used it for

      UAE Strategy for Artificial Intelligence. Primary. Used for the October 2017 launch and the sectors covered.

    6. [6] UAE Government portal (u.ae), 2026-07-03. The UAE Charter for the Development and Use of Artificial Intelligence(u.ae)
      Full title and what we used it for

      The UAE Charter for the Development and Use of Artificial Intelligence. Primary. Used for the 12 principles. The page does not state whether the Charter is binding.

    7. [7] UAE Government portal (u.ae), for the Cyber Security Council, 2026-07-02. The National Cyber Security Policy for Artificial Intelligence(u.ae)
      Full title and what we used it for

      The National Cyber Security Policy for Artificial Intelligence. Primary. Used for the minimum security requirements and the six areas it covers.

    8. [8] UAE Government portal (u.ae), 2026-09-30. Agentic AI for Government Services(u.ae)
      Full title and what we used it for

      Agentic AI for Government Services. Primary. Used for the 50% by 2028 target.

    9. [9] UAE Government portal (u.ae), 2026-10-08. Artificial intelligence in government policies(u.ae)
      Full title and what we used it for

      Artificial intelligence in government policies. Primary. Used for the UAE Council for AI and the Chief Executive Officer for AI roles in federal entities.

    10. [10] Business Dubai, 2026-08-10. UAE PDPL data protection(businessdubai.ae)
      Full title and what we used it for

      UAE PDPL data protection. Secondary, used only for interpretation: reports that the PDPL Executive Regulations had not been issued, citing law-firm guides. We could not confirm either way on an official source.

    This is general information, not legal advice. The UAE has three separate data protection regimes, and the federal Executive Regulations may change the picture when confirmed. Check with a qualified UAE lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in United Arab Emirates?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score