The Agile Legal Frontier: Navigating Artificial Intelligence Regulation in the UAE (2025 Framework)
No single AI Act: federal data protection law, DIFC rules on autonomous systems and an ethics charter
How AI is regulated in the UAE without a single AI law. The article covers the National AI Strategy 2031, the federal PDPL, the DIFC rules on autonomous systems, regulatory sandboxes and the AI Charter. It then turns to the federal and free-zone compliance split and where liability for AI decisions is likely to fall.
Reviewed by Mohamed Noureldin, Founder, Managing Partner & Senior Legal Consultant
Businesses, investors and technology developers operating in the UAE will not find a single, monolithic AI Act governing their use of AI. The UAE governs AI through an evolving "patchwork" of federal laws, free-zone regulations and ethical charters, designed to foster innovation while maintaining a system of governance. The challenge for companies is to work through this multi-layered system, achieve full compliance and mitigate emerging legal risks. The account below reflects the state of regulation as of 2025.
The national AI strategy made governance one of its objectives
The UAE treats AI not merely as a technological advance but as a fundamental pillar of economic diversification and enhanced public services. The UAE National AI Strategy 2031 aims to position the country as a world leader in AI by embedding the technology across key sectors, including healthcare, education and transportation.
The strategy's core objectives are to build the UAE's position as a destination for AI, enhance the competitive edge of the AI sector, attract leading research capabilities and deliver strong AI governance and regulation. That commitment to governance, set out early in the strategy, signals an intent to regulate responsibly, not restrictively. It set the tone for all subsequent legal and policy developments: a pro-innovation stance balanced with ethical oversight.
The federal data protection law
The UAE currently has no single, overarching AI-specific law at federal level. Two instruments form the primary legal pillars for AI systems, particularly those that process personal data: the federal data protection law and the specialised regulations of the Dubai International Financial Centre (DIFC).
Federal Decree-Law No. 45 of 2021 on Personal Data Protection, known as the PDPL, is the most significant federal legislation affecting AI operations.
The PDPL requires organisations to adhere to principles such as:
- Consent and legal basis. Processing must have a clear legal basis, often requiring explicit consent from the data subject.
- Purpose limitation. Data must be collected for a specific, clear and legitimate purpose.
- Data quality and security. Organisations must ensure data accuracy and implement security measures to protect against unauthorised access or processing.
For AI developers, the PDPL mandates careful consideration of how their algorithms ingest, process and use personal data.
AI rules in the DIFC
The most explicit and advanced AI-related regulation in the UAE is found in the DIFC, the financial free zone. The DIFC's data protection rules directly address autonomous and semi-autonomous systems, including AI and generative machine learning technology.
The DIFC framework also serves as a bellwether for future federal regulation, as it shows a clear willingness to implement targeted, AI-specific rules.
Working across the federal PDPL and the DIFC framework requires specialised expertise in data protection and privacy compliance; see also our article on data protection and privacy in UAE family law proceedings. Businesses must ensure their AI systems are not only technically sound but also legally defensible across these distinct jurisdictions. For related advice, see our corporate governance advisory and crypto regulation compliance advisory services.
Sandboxes test new technology before rules are set
The UAE's regulatory approach is characterised by agility and a commitment to ethical principles, so that governance keeps pace with technological change. A key feature is the use of regulatory sandboxes and labs. These allow new technologies to be tested in a controlled environment before full-scale roll-out and regulation. The approach minimises the risk of stifling innovation with premature or overly rigid laws.
An ethics charter for AI
Alongside the formal legal instruments sits the UAE Charter for the Development and Use of Artificial Intelligence. It sets out a set of guiding principles for the ethical and responsible use of AI technologies, and it supports the UAE's alignment with global AI governance frameworks. The Charter emphasises:
- Fairness and non-discrimination: ensuring AI systems do not perpetuate or amplify bias.
- Transparency and explainability: requiring that the decisions made by AI systems can be understood and explained.
- Accountability: establishing clear lines of responsibility for the outcomes of AI systems.
- Human-centric design: prioritising human well-being and control in the design and use of AI.
A DIFC or ADGM presence adds a second regime
For companies using AI in the UAE, compliance presents both opportunities and complexities. The primary challenge is the jurisdictional divide between the federal UAE and financially autonomous free zones like the DIFC and Abu Dhabi Global Market (ADGM).
Businesses operating solely in the federal UAE must primarily adhere to the PDPL and sector-specific regulations, for example in healthcare or finance. Companies with a presence in the DIFC or ADGM must comply with the data protection laws of those free zones. This necessitates a dual-compliance strategy.
Effective compliance requires the implementation of internal governance frameworks (see our corporate governance advisory services). This includes conducting regular AI risk assessments, establishing clear data lineage and audit trails for algorithmic decisions, and ensuring that all AI models are tested for bias and fairness in line with the ethical principles of the UAE Charter. Proactive corporate compliance is essential to mitigate the risk of regulatory penalties and reputational damage; see our article on corporate training in the UAE.
Who answers for a decision an AI system makes
Legal liability for the actions of autonomous AI systems remains a complex and evolving area globally, and the UAE is no exception. AI-driven decisions are testing current legal frameworks, including civil, commercial and criminal law.
Table 1: Potential liability scenarios for AI in the UAE
| Scenario | Applicable legal framework | Key challenge |
|---|---|---|
| Data breach | Federal PDPL; DIFC Data Protection Law | Assigning liability for security failures caused by autonomous system errors |
| Contractual breach | Commercial Law; Contract Law | Determining whether an AI-executed contract is valid and who is liable for non-performance |
| Harm or damage | Civil Law (torts/delict) | Establishing the causal link between the AI's decision and the resulting harm, and identifying the responsible human or entity (developer, deployer, operator) |
| Discrimination | UAE Charter | Proving algorithmic bias and the intent or negligence behind its use |
For the federal UAE, liability will likely fall on the entity that deployed or operated the AI system.
As AI systems become more sophisticated, businesses must seek expert legal consultancy to draft contracts, establish clear operational protocols and secure appropriate insurance coverage to manage this evolving risk.
Legislative updates need continuous monitoring
The legal framework for AI in the UAE is a moving target. For any business looking to thrive in the UAE's technology sector, continuous monitoring of legislative updates and proactive compliance are non-negotiable. Success depends on a commitment to both technological excellence and legal rigour.
For practical legal support in this area, see our data regulation compliance advisory and crypto regulation compliance advisory services.
Disclaimer: this article is for general information only and does not constitute legal advice. Readers should seek professional legal advice tailored to their own circumstances before making any decision or taking any action based on it.
