AI Regulations in Dubai Mainland: Complete Guide

The problem a Dubai mainland business actually has

A company licensed in Dubai mainland that is building or buying artificial intelligence is not looking for a single AI statute to comply with, because there is no dedicated federal AI law to point at. Its real problem is narrower and more immediate: the licence limits what it may do, the data law limits how it may use personal information, the employment law limits how it may treat staff, and the vendor contract decides who carries the risk when the model is wrong. None of those instruments mention algorithms. All of them apply.

The starting point is a plain description of each system in use: what it decides or produces, about whom, on what data, and who at the company signs off on the result. Compliance questions that seem abstract become concrete once that description exists.

Does your licence cover what you are selling

A mainland company may carry on only the activities on its trade licence, issued by the Department of Economy and Tourism. Building an AI tool for internal use is one thing. Selling it, or selling a service delivered through it, may fall under a different activity, and where the service is in a regulated sector it may require the sector regulator's authorisation as well. Check this before the first customer contract, not when a renewal raises it.

On ownership, the 51% UAE-national requirement for mainland limited liability companies was removed by Federal Decree-Law No. 26 of 2020, effective 1 June 2021, and full foreign ownership is available for most mainland activities, subject to a list of activities of strategic impact. Founders holding shares through arrangements set up under the old rule should confirm the current position for their activity and tidy up structures that no longer serve any purpose. The company itself is governed by Federal Decree-Law No. 32 of 2021 on Commercial Companies, in force 2 January 2022, which replaced Federal Law No. 2 of 2015.

Personal data is where most AI compliance lands

Federal Decree-Law No. 45 of 2021, the PDPL, governs the processing of personal data. Most AI projects touch it, often without a decision having been made. Customer support transcripts, CVs, CCTV, call recordings, transaction histories and device logs are all personal data, and feeding them into a model is processing.

• Purpose. Data collected to deliver a service is not automatically available to train a product. If you want to use it that way, address it properly rather than relying on a general clause nobody read.
• Location. Most model providers host abroad. Know where prompts, outputs, logs and fine-tuning data actually go, including backups, and deal with transfers explicitly.
• Requests from individuals. Build the ability to find and explain what you hold about a person. Retrofitting that into a pipeline is painful.

DIFC and ADGM operate their own data regimes under the DFSA and the FSRA. A group with a mainland company and a free zone entity is running more than one rulebook and should not assume one notice and one policy cover both.

Using AI on employees and candidates

Federal Decree-Law No. 33 of 2021 replaced Federal Law No. 8 of 1980 and governs employment on the mainland. Where a tool screens applicants, ranks performance or flags conduct, the exposure is not the tool. It is whether the resulting decision can be explained and justified on grounds the law recognises, by a person who made it.

Three habits reduce the risk. Keep a human decision-maker who reviews the recommendation and records reasons in their own words. Tell employees what monitoring is in place instead of leaving them to discover it. Keep the underlying facts, not only the score, so a decision can be defended on its merits if it is challenged later.

The vendor contract you were handed

Federal Decree-Law No. 50 of 2022 on Commercial Transactions replaced Federal Law No. 18 of 1993 and governs commercial contracts under UAE law. Model and platform agreements are drafted by suppliers and allocate risk to the customer. Read for these points before signing:

• Whether your inputs may be used to train the supplier's models, and whether that can be switched off.
• Who owns outputs, and what is warranted about third-party rights in them.
• What is promised about accuracy. Usually very little, which means you manage that risk through how the system is used and reviewed.
• Whether the supplier may change or withdraw the model, and on what notice. A silent update can change the behaviour of a product your customers rely on.
• Sub-processors and hosting locations, which feed straight back into the data analysis above.

Then look at your own customer terms and check they are consistent. Promising customers more than your supplier promises you is a gap you fund yourself.

Claims, and the cost of overstating

Describing a system as accurate, unbiased or approved turns marketing into a promise. Say what the system does and where its limits are, and keep the testing that supports the claim. This is the cheapest exposure any AI business can remove, and the one most often left unaddressed because it sits with a marketing team rather than with counsel.

Where disputes go

Mainland court proceedings are conducted in Arabic and documents relied on must be translated, which is one reason technology contracts often choose arbitration. Federal Law No. 6 of 2018, amended in 2023, governs arbitration seated in the UAE. The DIFC-LCIA was abolished by Dubai Decree No. 34 of 2021 and its caseload moved to DIAC, while DIFC remains available as a seat; ADCCAC was restructured as arbitrateAD from 2024. Contracts still naming the abolished institution should be corrected by agreement with the counterparty. Whichever route you pick, name it consistently across supplier terms, customer terms and any partner agreements, because inconsistent clauses turn the opening stage of technology dispute resolution into an argument about forum before anyone reaches the merits.

Tax, briefly

Corporate tax under Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023, at 0% on taxable income up to AED 375,000 and 9% above. VAT is 5% under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022. Investor materials still describing the UAE as tax-free should be updated.

What to do this quarter

1. List every AI system in use, including tools teams adopted without approval.
2. Record for each one its purpose, its data, its internal owner and the human review applied.
3. Check the licence covers what you sell, and whether a sector regulator is involved.
4. Map personal data against the PDPL, including transfers outside the UAE.
5. Renegotiate the vendor terms that matter and align your customer terms with them.
6. Review marketing claims against what you can evidence.

For advice on AI use, vendor terms or licensing in Dubai, contact the Nour Attorneys team.

Schedule Your Consultation

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Related Resources

Explore more of our insights on related topics:

• AI Regulations Compliance Requirements in the UAE
• Blockchain Legal Defense Strategies for Dubai Businesses
• Cryptocurrency Compliance Guidelines for UAE Operators
• Data Privacy Laws for Multinational Entities