AI Legal Ethics and Confidentiality in UAE Law Practice

Senior counsel can harness generative AI for research and drafting while complying with the UAE's Federal Law No. 11 of 2022 on Artificial Intelligence and its accompanying AI Ethics Guidelines, ensuring confidentiality and professional responsibility under the UAE's legal jurisdiction.

The UAE's regulatory framework for artificial intelligence in legal practice is anchored by Federal Decree-Law No. 45/2021 on the Regulation of Artificial Intelligence and the UAE Personal Data Protection Law (PDPL) Federal Decree-Law No. 45/2021, together with the Dubai International Financial Centre (DIFC) Data Protection Law No. 5/2020 and the Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021, which collectively govern the ethical use, confidentiality, and compliance requirements for AI tools employed by lawyers across the UAE.

Related Services: Explore our Data Regulation & Compliance and Crypto Regulation & Compliance services for practical legal support in this area.

WHAT ARE THE PERMISSIBLE USES OF GENERATIVE AI IN LEGAL RESEARCH AND DOCUMENT DRAFTING UNDER UAE LAW?

Generative AI may be used to provide legal research, preliminary drafting of contracts, and routine correspondence, provided that the lawyer remains ultimately responsible for the accuracy and confidentiality of the output. Federal Decree-Law No. 45/2021 requires that any AI system deployed in a professional context must be transparent about its operation, must not produce misleading or false legal advice, and must be subject to human oversight. The law obliges practitioners to verify AI-generated content against primary sources such as statutes, case law, and official gazettes before reliance.

In practice, this means that a lawyer can employ AI to identify relevant provisions of Federal Law No. 5/1985 (Civil Transactions Law) or to summarise clauses from a standard form contract, but must then review the output, cross-check citations, and ensure that no confidential client information is inadvertently incorporated into the model's training data. The UAE's AI ethics guidelines, issued by the UAE Artificial Intelligence Office in 2023, reinforce this duty by stipulating that AI tools used in legal services must be auditable, explainable, and compliant with data protection standards.

HOW DOES THE UAE PERSONAL DATA PROTECTION LAW AFFECT THE USE OF AI WITH CLIENT INFORMATION?

The PDPL mandates that personal data processed by AI systems be collected lawfully, stored securely, and used only for the purposes expressly consented to by the data subject. When a lawyer feeds client communications, case files, or proprietary documents into a generative AI platform, the PDPL treats that act as processing of personal data. Consequently, the lawyer requires explicit consent from the client, implements appropriate technical and organisational measures (such as encryption and access controls), and ensures that the AI provider provides data localisation or adequate safeguards if data is transferred outside the UAE.

If the AI tool is hosted abroad, the lawyer must verify that the provider adheres to the PDPL's cross-border transfer rules, which require either a adequacy decision from the UAE Data Office or the implementation of standard contractual clauses approved by the regulator. Failure to comply can result in administrative fines of up to AED 500,000 under Article 48 of the PDPL, as well as potential civil liability for breach of confidentiality.

WHAT CONFIDENTIALITY OBLIGATIONS ARISE WHEN USING AI-ASSISTED DRAFTING TOOLS?

Beyond the PDPL, lawyers are bound by the confidentiality duties set out in the UAE Advocacy Law (Federal Law No. 23/1991) and the UAE Code of Professional Conduct for Lawyers, which require that all information relating to a client's affairs be kept secret unless disclosure is authorised or required by law. When using generative AI, the lawyer must ensure that the tool does not retain, log, or reuse input data for model improvement without the client's informed consent.

Many commercial AI providers offer "private instance" or "on-premises" deployment options that keep data within the lawyer's controlled environment. Selecting such a configuration satisfies the confidentiality obligation because it prevents third-party access to sensitive material. Where a public cloud service is used, the lawyer must negotiate a data processing agreement that expressly prohibits the provider from using the data for any purpose other than delivering the requested service and that includes provisions for deletion upon request.

HOW CAN A LAW FIRM ESTABLISH AN AI COMPLIANCE CHECKLIST ALIGNED WITH UAE REGULATIONS?

An effective AI compliance checklist should address the following elements, each grounded in UAE law:

1. Legal Basis Verification - Confirm that the intended AI use falls within the permissible scope defined by Federal Decree-Law No. 45/2021 and that the tool is not prohibited for providing autonomous legal advice.
2. Data Protection Assessment - Conduct a PDPL impact assessment to determine whether personal data will be processed, identify the lawful basis (consent, contractual necessity, or legitimate interest), and implement safeguards such as encryption, pseudonymisation, and access logs.
3. Confidentiality Safeguards - Verify that the AI provider offers a private deployment or a data processing agreement that prohibits reuse of client information and includes breach notification procedures.
4. Human Oversight Protocol - Establish a standard operating procedure requiring a qualified lawyer to review, validate, and sign off on all AI-generated outputs before they are relied upon in client matters.
5. Bias and Accuracy Monitoring - Implement periodic audits to detect potential biases in AI outputs, especially when the tool is used for predictive analytics or risk assessment, and document corrective actions.
6. Record-Keeping - Maintain logs of AI usage, including input prompts, generated outputs, reviewer comments, and dates, to demonstrate compliance during regulatory inspections.
7. Training and Awareness - Provide regular training for lawyers and support staff on the ethical use of AI, the UAE's AI ethics guidelines, and the firm's internal policies.

Each checklist item should be tied to a specific legal provision-for example, the human oversight requirement derives from Article 6 of Federal Decree-Law No. 45/2021, which mandates that AI systems used in professional services remain under human control.

WHAT ARE THE RISKS OF NON-COMPLIANCE WITH AI ETHICS AND DATA PROTECTION RULES IN THE UAE?

Non-compliance can trigger both regulatory sanctions and civil consequences. Under the PDPL, the UAE Data Office may impose fines ranging from AED 50,000 to AED 500,000 for violations such as unlawful processing, insufficient security measures, or unlawful cross-border transfers. Additionally, Federal Decree-Law No. 45/2021 empowers the Ministry of AI to issue administrative penalties, suspend AI licences, or require remedial actions for breaches of transparency, accountability, or human oversight obligations.

From a professional-conduct perspective, a lawyer who relies on unverified AI-generated advice and thereby causes prejudice to a client may be found to have breached the duty of competence and diligence under the Advocacy Law, potentially leading to disciplinary proceedings before the UAE Legal Affairs Department. Furthermore, if confidential client information is exposed through an insecure AI platform, the lawyer could face claims for breach of confidentiality and damages under civil law, irrespective of any regulatory penalty.

HOW DOES THE DIFC AND ADGM REGULATORY ENVIRONMENT DIFFER FOR AI USE IN LEGAL PRACTICE?

The DIFC and ADGM operate as independent common-law jurisdictions with their own data protection regimes. The DIFC Data Protection Law No. 5/2020 mirrors the GDPR's principles and requires a data protection impact assessment for high-risk processing, which includes the use of AI that profiles or makes decisions affecting individuals. Lawyers operating within the DIFC must therefore comply with both the DIFC law and, where relevant, the UAE federal PDPL if data transfers involve onshore entities.

The ADGM Data Protection Regulations 2021 similarly impose obligations of lawfulness, fairness, and transparency, and mandate that AI systems be designed to prevent discriminatory outcomes. The ADGM Registration Authority also expects firms to maintain a record of AI-related processing activities and to appoint a data protection officer when large-scale processing occurs.

While the substantive ethical duties-confidentiality, competence, and supervision-remain consistent across the UAE, DIFC, and ADGM, the procedural requirements for impact assessments, breach notifications, and cross-border transfers differ, necessitating jurisdiction-specific checklists for lawyers who practice across multiple forums.

FREQUENTLY ASKED QUESTIONS

What specific UAE statute governs the ethical use of AI in legal services?
The primary statute is Federal Decree-Law No. 45/2021 on the Regulation of Artificial Intelligence, which sets out transparency, accountability, and human-oversight requirements for AI systems used in professional contexts, including legal practice.

Must a lawyer obtain client consent before using AI to draft documents that contain personal data?
Yes. Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45/2021), processing personal data via an AI tool constitutes data processing that requires a lawful basis; explicit client consent is the most straightforward basis when the data is not strictly necessary for the performance of a contract.

Are there any restrictions on using publicly available generative AI models (e.g., open-source LLMs) for legal research?
Publicly available models may be used, but the lawyer remains responsible for verifying the accuracy of any output and ensuring that no confidential information is entered into the model. The UAE AI ethics guidelines advise that lawyers employ models with clear documentation of training data and, where possible, opt for private or on-premises deployments to protect confidentiality.

What penalties apply for violating the PDPL when using AI tools?
Violations can attract administrative fines of up to AED 500,000 under Article 48 of the PDPL, in addition to potential civil claims for damages resulting from unlawful processing or data breaches.

How should a law firm document its AI compliance efforts?
Firms should maintain a register that logs each AI tool employed, the legal basis for its use, results of PDPL impact assessments, copies of data processing agreements, human-oversight sign-off sheets, and records of periodic audits for bias and accuracy. This documentation demonstrates compliance to regulators and supports professional-conduct defence if questioned.

Do DIFC and ADGM lawyers need to follow separate AI rules from onshore UAE lawyers?
Yes. While the overarching duties of confidentiality and competence apply universally, DIFC and ADGM lawyers must also comply with the DIFC Data Protection Law No. 5/2020 and the ADGM Data Protection Regulations 2021, which impose additional impact-assessment, breach-notification, and cross-border transfer requirements that differ from the federal PDPL.

This article provides a general overview of the UAE's legal and ethical framework governing the use of artificial intelligence in legal practice. It does not constitute legal advice for any particular situation.

Book a consultation to discuss your legal needs with our experienced team.

If your matter involves ai legal ethics in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.