AI Regulations in Sharjah: Complete Guide

A company licensed in Sharjah that adds an artificial intelligence feature to its product, its hiring process or its customer service usually wants to know which authority now takes an interest. There is no separate AI statute for businesses in the emirate. What applies is federal UAE law, read against the activity the system performs, the personal data it uses and the licence the company holds.

That framing is more useful than it sounds, because it tells you exactly which questions to ask. This guide works through them in the order a Sharjah business tends to meet them.

Sharjah mainland, Sharjah free zones, and why it matters

A company on Sharjah mainland operates under federal legislation. Companies in the emirate's free zones are licensed by their respective free zone authorities but remain subject to federal law on data, employment, commercial dealings and criminal liability.

Neither is comparable to the DIFC or ADGM. A policy set written for a group company in one of those centres does not answer a Sharjah entity's obligations, and reusing it produces gaps that only appear when a customer, an investor or an authority asks for evidence.

Corporate position and licence scope

Mainland companies are governed by the Commercial Companies Law, Federal Decree-Law No. 32 of 2021, which replaced Federal Law No. 2 of 2015.

Licence scope is the check that gets missed. A trading or manufacturing company that builds an internal tool and then starts selling it has become a software business, and a services firm that offers automated recommendations may have moved past the activity its licence describes. Confirm that the licence covers what the product does before it is offered to third parties.

Personal data and model training

Personal data handled by a Sharjah company is governed by the federal personal data protection law. The points that recur in AI work are these:

• Basis for training. Data collected to deliver a service is not automatically available to train a model. Reuse for training needs its own justification, decided before the training run rather than defended afterwards.
• What people were told. A privacy notice describing the original service does not cover model development. If the notice is silent about it, the practice is exposed.
• Retention. A training dataset is still data and needs a retention position rather than indefinite storage.

The common failure is not a missing policy. It is a model trained on data gathered for something else, with no record of who authorised it, discovered later during due diligence.

Contracts with AI providers

Most companies license models and tools rather than building them, and the terms are frequently accepted online without review. The clauses that decide the risk are predictable:

• Use of your inputs. Whether the provider may train on your prompts, documents and customer data, and whether that can be switched off.
• Ownership of output. What the company actually owns in what the system generates, especially where the output goes into something sold on.
• Third-party rights. What the provider says about the material behind the model, and whether any indemnity survives the liability cap.
• Confidentiality. Whether client or supplier information may be entered into the tool at all, and by whom.
• Continuity. What happens when a model version is retired or a service withdrawn while the business depends on it.

Where a company resells or embeds an AI capability, what it promises its own customers should not exceed what the upstream provider promises it. Reading the two sets of terms against each other is inexpensive and prevents the most damaging surprises.

Development work commissioned from contractors deserves the same attention. Ownership of code, models and training data should be stated expressly in the agreement rather than assumed from payment, particularly where the contractor reuses a common framework across clients.

Accountability for what the system produces

A company answers for its own advice, prices and decisions whether or not a model produced them. Obligations under contract, consumer expectations and regulatory duties attach to the business, not to the software it bought.

Making that defensible takes ordinary records: which version of the system was used, what it was given, who reviewed the result and what they were entitled to change. Where a decision affects a customer or an employee, human review should be genuine rather than a signature added to whatever the system produced.

Employment and internal use

Tools that screen applicants, monitor performance or feed into decisions about staff process personal data about identifiable people and should be assessed before they are switched on, not after a complaint. Staff use of external AI tools needs a stated internal position as well: without one, confidential material reaches third-party systems the company has never reviewed and cannot account for.

Disputes

Disputes involving AI systems are ordinary commercial disputes in unfamiliar packaging: performance that does not match the demonstration, data used beyond the agreed scope, ownership arguments over outputs, and claims following a decision the system got wrong. Decide the forum in the contract. Arbitration is governed by Federal Law No. 6 of 2018, as amended in 2023, and institutional options have changed: the Abu Dhabi Commercial Conciliation and Arbitration Centre was restructured as arbitrateAD from 2024. Careful drafting at signature avoids most later technology dispute resolution work.

Conclusion

AI compliance in Sharjah is not a search for an AI code. It is a sequence of concrete checks: does the licence cover what the product now does, is there a lawful basis under the federal data protection law for the data behind the model, do the provider terms allocate risk in a way the business would defend to a customer, and can the company show who was accountable for a given output?

Working through those before launch, and keeping the answers on file, costs very little. Reconstructing them under pressure costs a great deal more.

For guidance on AI projects, data protection or technology contracts in Sharjah, contact the Nour Attorneys team.

Schedule Your Consultation

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Related Resources

Explore more of our insights on related topics:

• AI Regulations Compliance Requirements in the UAE
• Blockchain Legal Defense Strategies for Dubai Businesses
• Cryptocurrency Compliance Guidelines for UAE Operators
• Data Privacy Laws for Multinational Entities