AI Regulations in ADGM: Complete Guide

Anyone building or selling an artificial intelligence product from Abu Dhabi Global Market eventually asks the same question: which rulebook applies? There is no single instrument in the UAE that can be described as "the AI law", and no separate AI licence to apply for. What actually governs an AI business in ADGM is the combination of four things: the licence the Registration Authority grants it, whether its activity falls inside the FSRA's regulated perimeter, the data protection regime that applies inside the free zone, and the contracts it signs with customers and suppliers. Most of the compliance work sits in those four places.

ADGM is a separate legal jurisdiction, not a discount on federal law

ADGM is a common-law jurisdiction with its own courts and its own financial services regulator, the Financial Services Regulatory Authority. English common law applies directly within it. That has practical consequences for a technology company. The federal codes that govern commercial dealings elsewhere in the country, such as the Commercial Transactions Law, Federal Decree-Law No. 50 of 2022, are not the law of your customer agreement if that agreement is governed by ADGM law. Your licensing terms, your limitation of liability, your warranty position and your intellectual property assignments are read against common-law principles and ADGM's own regulations.

The separation is not total. Federal criminal law, immigration and residency, and federal tax legislation reach into the free zone. So do the federal rules on cybercrime and on the misuse of information technology. Being registered in ADGM answers the question of which company law and which court you belong to; it does not remove you from the country's general law.

Licensing: start with the activity, not the entity

The Registration Authority licenses the activity you describe to it. A company that trains models, sells software, or provides data annotation services is typically a non-financial commercial or technology activity. The line to watch is the FSRA perimeter. If your AI product does something a regulated firm would need a licence to do, such as giving investment advice, arranging deals, managing assets or operating a payment service, the fact that a model rather than a person produces the output does not take the activity outside the perimeter. Firms that expect to sit close to that line should raise it with the FSRA early, and ask whether the regulator's testing route for new financial technology is open to their model. Reclassifying an activity after launch is far more expensive than agreeing it before.

Employment is on ADGM's own terms

Staff employed by an ADGM entity are engaged under ADGM's employment regulations rather than the federal Employment Law, Federal Decree-Law No. 33 of 2021, which replaced Federal Law No. 8 of 1980 and governs mainland and most other free zone employment. This matters for AI teams because senior technical hires arrive with option grants, non-competes, invention assignment clauses and moonlighting questions. Those clauses are enforceable, or not, under ADGM law and before the ADGM courts. Copying an employment template written for a mainland company and running it through an ADGM entity produces documents that do not match the regime that will be applied to them.

Data is where AI compliance is actually decided

ADGM operates its own data protection regime. The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, is the general regime for the country, but ADGM and DIFC each apply their own. If your training data, your customer records or your inference logs contain personal data, the ADGM regime is the one your controller and processor obligations are measured against.

Three questions decide most AI data problems, and all three should be answered in writing before a model goes into production:

• What lawful basis covers each use of personal data, separating the basis for training a model from the basis for running it against a customer's data?
• Where does the data go? Cloud training, third-party model providers and offshore support teams all move personal data out of the free zone, and the transfer route has to be documented rather than assumed.
• What are you contractually allowed to keep? Customer agreements that permit you to retain inputs and outputs to improve your models must say so plainly. Silence is not permission, and retrospective consent requests are a poor substitute.

Automated decision-making deserves its own paragraph in your documentation. If a model produces an outcome that affects an individual, such as a credit assessment, a screening result or a fraud flag, record how the decision is reached, what human review exists and how a person can challenge the result.

Intellectual property and customer contracts

Ownership questions in AI contracts are usually unanswered rather than badly answered. A workable customer agreement states who owns the input data, who owns the outputs, whether the provider may use customer data to improve its models, and what happens to derived artefacts such as embeddings and fine-tuned weights when the contract ends. Where the model is licensed in from a third party, the terms you grant downstream cannot exceed what you hold upstream. That sounds obvious and is routinely breached.

On liability, the two clauses that matter are the accuracy position and the indemnity. Suppliers who promise that outputs will be accurate are promising something models do not deliver. The more defensible position states what the product does, requires human review where the stakes justify it, and allocates responsibility for the use made of the output. Carve-outs for gross negligence and wilful misconduct will not be given effect however they are drafted.

Tax and reporting obligations still apply

Corporate tax was introduced by Federal Decree-Law No. 47 of 2022 and applies for financial years starting on or after 1 June 2023, with a 0% rate on taxable income up to AED 375,000 and 9% above that. Registration and filing obligations apply to free zone companies as well; whether any free zone relief is available to your entity depends on conditions that should be confirmed with a tax adviser before you rely on it. VAT is charged at 5% under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022, and software and services sold to customers in the country are within its scope.

Economic Substance Regulations no longer apply to financial years ending after 31 December 2022, following Cabinet Decision No. 98 of 2024. Obligations remain for the FY2019 to FY2022 period, so companies that were in scope then should confirm that their historic notifications and reports were filed rather than quietly abandoning the file.

When something goes wrong

Disputes involving an ADGM entity ordinarily go to the ADGM courts, which apply common law and run on English-language procedure. Arbitration remains available and is often the better choice for cross-border technology contracts; the federal Arbitration Law, Federal Law No. 6 of 2018, as amended in 2023, governs arbitrations seated in the country outside the financial free zones. Whichever route you choose, choose it once and reflect it consistently across the customer agreement, the reseller agreement and the supplier terms. Inconsistent dispute clauses across a contract chain produce parallel proceedings in different forums over the same failure. Careful drafting at this stage does more for technology dispute resolution than anything done after a claim lands.

A short checklist before launch

• Confirm your licensed activity matches what the product actually does, and check the FSRA perimeter if there is any financial element.
• Map every dataset: source, lawful basis, location, retention, and the terms you obtained it under.
• Fix ownership of inputs, outputs and fine-tuned models in the customer agreement.
• Align employment, IP assignment and confidentiality documents with ADGM law.
• Confirm corporate tax registration and VAT position, and close out any historic economic substance filings.

For advice on licensing, data and contracting for an AI business in ADGM, contact the Nour Attorneys team.

Schedule Your Consultation

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Related Resources

Explore more of our insights on related topics:

• AI Regulations Compliance Requirements in the UAE
• Blockchain Legal Defense Strategies for Dubai Businesses
• Cryptocurrency Compliance Guidelines for UAE Operators
• Data Privacy Laws for Multinational Entities