AI and Automation: Navigating the Legal Landscape for UAE Businesses

Driven by the UAE National Strategy for Artificial Intelligence 2031, the UAE is rapidly integrating AI across critical sectors, from finance and healthcare to government services and urban planning. The UAE does not yet have a dedicated AI liability law. Even so, a business that trains a model on personal data, lets a system take decisions about individuals, or publishes what a generative tool produces is already subject to federal laws on data protection, copyright and cybercrime. If the system causes harm, the Civil Transactions Law provides a basis for liability. In regulated industries, sector-specific guidelines add further obligations.

Putting AI and automated systems into use is not merely a technical decision; it is a legal and ethical commitment. Technological change often outpaces legislative cycles, yet the UAE has responded with a multi-layered regulatory framework. It is designed to foster innovation while securing accountability, data privacy and ethical compliance.

Related: Explore our property management legal services. The same real estate law advisory team handles property registration.

A national strategy, and ethical charters that are not binding

The UAE National Strategy for AI 2031 was launched. It aims to position the UAE as the foremost global hub for AI by integrating the technology into key areas to enhance public services and economic diversification. The strategy signals a clear governmental commitment. That commitment translates into supportive policies and a regulatory environment designed to be flexible and forward-looking.

Public trust matters for AI adoption, and the UAE has issued several non-binding but highly influential ethical frameworks. They serve as moral and operational guidelines that inform future legislation and regulatory enforcement:

• The UAE Charter for the Development and Use of AI: the charter sets out ethical principles that businesses are expected to adhere to. Key among these are data privacy, transparency, algorithmic bias mitigation, human oversight, and governance and accountability. For businesses, technical excellence must be paired with a demonstrable commitment to ethical outcomes.
• Ethics guidance from the UAE's AI Office: the guidance supports principles of fairness, transparency, accountability, privacy and safety. It acts as a practical framework to help developers and organisations align their AI systems with societal values.

These frameworks are non-binding. They establish the "spirit of the law" that businesses must internalise to secure long-term compliance and avoid regulatory scrutiny. For guidance on business compliance, see our corporate governance advisory services.

Related: Our real estate law advisory services include work for property developers. They also cover legal title verification. For developer liability claims, see our real estate dispute lawyers. For the UAE Labour Law, see our labour and employment law advisory services.

Personal data law governs training data and automated decisions

Nearly all AI applications are built on data, which makes data protection the single most important legal consideration. The cornerstone of this framework is the federal law on the Protection of Personal Data (PDPL).

The PDPL sets requirements for the lawful processing of personal data. That is particularly relevant for AI systems, which rely on vast datasets for training and operation. For businesses, compliance with the PDPL requires:

1. A lawful basis for processing: a clear legal basis for all data used by the AI system.
2. Controls on automated processing and decision-making: the PDPL specifically regulates automated processing.
3. Data security: the implementation of strong technical and organisational measures to protect personal data from unauthorised access or misuse is mandated.

As AI systems become more autonomous, the PDPL keeps the rights and privacy of individuals protected. It places a heavy burden of compliance on the entity putting the system into use. Our data privacy law advisory team advises on the PDPL's requirements for AI.

Who pays when an autonomous system causes harm

Attributing liability when an autonomous system causes harm is one of the most complex legal questions AI raises. The UAE's existing legal framework, particularly the Civil Transactions Law, provides a basis for addressing it.

Without a dedicated AI liability law, the current civil framework suggests that the human or corporate entity responsible for the AI's design, roll-out and oversight will ultimately bear the legal and financial consequences of its actions. That makes clear governance structures and a "human-in-the-loop" approach necessary for high-risk applications. Internal controls are key to mitigating liability. We provide that work through our corporate governance advisory service.

Copyright in training data, output and algorithms

Generative AI (GenAI) has brought intellectual property (IP) rights to the forefront of legal concern. Federal Decree-Law No. (38) of 2021 on Copyright and Neighboring Rights governs the IP landscape for AI in the UAE. The key IP challenges for UAE businesses include:

IP challenge	Legal implication for UAE businesses
Training data	Using copyrighted material to train AI models without proper licensing can lead to infringement claims. Businesses must make sure their datasets are legally sourced and compliant with the Copyright Law.
AI-generated output	The legal status of works created solely by an AI remains ambiguous, so a clear policy on the ownership and commercialisation of AI-generated content is necessary.
Algorithm protection	AI algorithms themselves are typically protected under trade secret law or patents. This requires internal security protocols to prevent unauthorised disclosure.

Businesses must establish clear IP policies to mitigate significant legal exposure, particularly on the use of third-party data and the assignment of rights for AI-created works. Our intellectual property law advisory team helps businesses protect their IP rights in the age of generative AI.

False information and security under the cybercrimes law

Integrating AI increases the attack surface for cyber threats and introduces new risks from the spread of misinformation. Federal Decree-Law No. (34) of 2021 on Countering Rumors and Cybercrimes is the primary legal instrument addressing these concerns.

Compliance in this area requires continuous monitoring, penetration testing and a clear incident response plan to address both malicious attacks and accidental dissemination of harmful content by autonomous systems.

Regulated sectors carry extra rules

Beyond the federal laws, the UAE has implemented detailed, sector-specific guidelines that impose additional compliance obligations on businesses in regulated industries.

The financial sector is overseen by authorities like the UAE Central Bank (CBUAE) and the Dubai Financial Services Authority (DFSA) in the DIFC. See also our corporate governance advisory services.

The DIFC and ADGM set their own data rules

The UAE's legal landscape distinguishes onshore jurisdictions from the specialised free zones, which often operate under their own independent legal frameworks. The Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) are financial free zones that have adopted common-law-based regulatory systems, including their own data protection laws. These zones are often at the vanguard of AI regulation.

Interim licences for AI projects that no law yet covers

To regulate nascent technologies, the UAE uses regulatory sandboxes. The UAE's law on the Projects of Future Nature authorises the grant of interim licences and temporary exemptions from federal law. These are for projects, particularly those involving AI, that lack existing regulation. Businesses can pilot projects and conduct R&D initiatives in a controlled environment while bespoke legislation is being drafted. That provides a crucial pathway for market entry.

Which authority oversees what

Compliance requires understanding the roles of the various federal and emirate-level authorities that govern AI.

Authority	Jurisdiction	Primary role
AI Office	Federal	Provides strategic direction and coordinates national AI initiatives.
UAE Council for AI and Blockchain	Federal	Promotes cross-sector AI adoption, advises on ethical standards, and fosters coordination on data security and digital trust.
Telecommunications and Digital Government Regulatory Authority (TDRA)	Federal	Oversees the UAE's digital environment, sets ICT policy, and makes sure AI implementations align with federal digital strategy.
DIFC/ADGM regulatory authorities	Free zone	Manage AI use in the financial sector through their independent legal frameworks.

Businesses must engage with the relevant authority based on their location (onshore or free zone) and sector, so that all necessary licences and authorisations are secured.

A compliance strategy for AI must integrate legal, ethical and technical requirements from the outset, viewing compliance not as a barrier but as a competitive advantage that builds trust. Working across federal laws, free zone regulations and evolving ethical charters requires specialised expertise. Our corporate governance advisory services cover business compliance.

Related Services: For advice, explore our labour and employment law advisory and legal consultation services.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Additional Resources

More of our insights on related topics:

• Legal crisis management for UAE businesses
• Logistics and transportation compliance in the UAE