Navigating the New UAE AI Law: What Legal Professionals Need to Know

The UAE AI law, enacted as Federal Decree-Law No. 11 of 2024 concerning the Regulation of Artificial Intelligence Systems, applies to any natural or juridical person that designs, develops, deploys, uses or imports AI systems within the UAE-including mainland Dubai, free zones such as DIFC and ADGM, and foreign providers serving UAE customers-covering software, hardware and hybrid solutions that process personal data, make automated decisions or generate content.

Related Services: Explore our Data Regulation & Compliance and Data Protection Officer Service services for practical legal support in this area.

WHAT IS THE SCOPE OF THE UAE AI LAW AND WHO DOES IT AFFECT?

The law applies to any natural or juridical person that designs, develops, deploys, uses or imports AI systems within the UAE, including entities operating in mainland Dubai, free zones such as DIFC and ADGM, and foreign providers offering services to UAE customers. It covers AI systems that process personal data, make automated decisions, or generate content, and it distinguishes between prohibited, high-risk and limited-risk applications.

The legislation defines an AI system as any machine-based system that, for a given set of human-defined objectives, can make predictions, recommendations or decisions influencing real or virtual environments. It applies to software, hardware and hybrid solutions, irrespective of whether the AI component is embedded in a larger product or offered as a standalone service.

Developers must conduct a risk assessment before placing an AI system on the market or putting it into service. Deployers are required to ensure that the system complies with the applicable risk-based obligations, maintain documentation of conformity assessments, and provide users with clear information about the system's capabilities and limitations. Users, including employers and consumers, receive rights to transparency, explanation and, where relevant, human oversight.

Free-zone entities are not exempt; the law applies uniformly, although DIFC and ADGM may supplement the federal rules with their own sector-specific guidance.

WHAT ARE THE KEY COMPLIANCE REQUIREMENTS FOR HIGH-RISK AI SYSTEMS?

High-risk AI systems must satisfy a set of mandatory obligations before they can be lawfully used in the UAE.

First, the provider must draw up technical documentation that demonstrates conformity with the essential requirements set out in the law, including a description of the system's architecture, training data, performance metrics and risk-mitigation measures. This documentation must be retained for ten years after the system is withdrawn from the market.

Second, a conformity assessment procedure must be carried out. For most high-risk systems, this involves internal production control supplemented by periodic audits; for certain categories, such as AI used in critical infrastructure or biometric identification, the law requires involvement of a notified body accredited by the UAE Ministry of Economy.

Third, the provider must register the AI system in the national AI registry maintained by the UAE Artificial Intelligence Office. Registration entails submitting a summary of the system's purpose, its risk classification, and the conformity assessment outcome.

Fourth, ongoing post-market monitoring is obligatory. Providers must collect and analyse data on system performance, incidents and malfunctions, and report any serious incident to the AI Office within fifteen days of becoming aware of it.

Finally, deployers must ensure that users receive clear instructions, that human oversight mechanisms are in place where the law mandates them, and that any personal data processed by the system is handled in accordance with the UAE Personal Data Protection Law (PDPL).

WHAT PROHIBITIONS DOES THE UAE AI LAW IMPOSE?

The law expressly prohibits certain AI practices that are deemed incompatible with UAE values, public order or fundamental rights.

It bans the use of AI systems that manipulate human behaviour through subliminal techniques, exploit vulnerabilities of specific groups, or enable social scoring by public authorities.

It also prohibits AI applications that facilitate unlawful surveillance, including real-time remote biometric identification in publicly accessible spaces, except where strictly necessary for national security and subject to judicial oversight.

Additionally, the law forbids the deployment of AI systems that generate deep-fake content intended to deceive, defame or incite hatred, unless the content is clearly labelled as synthetic and the creator obtains explicit consent from any depicted individual.

Violations of these prohibitions are punishable by administrative fines of up to AED 5 million, imprisonment of up to two years, or both, depending on the severity of the breach and the resulting harm.

HOW DOES THE UAE AI LAW INTERACT WITH EXISTING DATA PROTECTION RULES?

The AI legislation works alongside the UAE Personal Data Protection Law (PDPL) and, where applicable, the DIFC Data Protection Law and the ADGM Data Protection Regulations.

When an AI system processes personal data, the PDPL's principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality apply in full.

The AI law adds specific requirements: a data protection impact assessment (DPIA) must be conducted for any high-risk AI system that engages in large-scale profiling, systematic monitoring of public areas, or processing of special categories of data such as health or biometric information.

The DPIA must be consulted with the UAE Data Office prior to deployment, and its findings must be incorporated into the system's risk management plan.

If the AI system transfers personal data outside the UAE, the transfer must comply with the PDPL's cross-border transfer mechanisms-adequacy decisions, explicit consent, contractual necessity or other recognised exceptions-while also satisfying any sector-specific restrictions imposed by the AI law.

WHAT ARE THE IMPLICATIONS FOR LAW FIRMS ADVISING CLIENTS ON AI MATTERS?

Law firms must adapt their practice to address the new regulatory landscape.

First, they need to develop internal checklists that guide clients through the risk classification process, the preparation of technical documentation, and the conformity assessment steps.

Second, firms should offer services that include drafting AI-specific clauses in commercial contracts-such as warranties of conformity, indemnities for non-compliance, and audit rights-to allocate risk appropriately between providers and deployers.

Third, staying abreast of guidance issued by the UAE Artificial Intelligence Office and the Data Office is essential, as the law empowers these bodies to publish technical standards, sector-specific codes of practice, and updated lists of prohibited AI applications.

Fourth, litigation and dispute resolution strategies must consider the possibility of administrative proceedings before the AI Office, civil claims for damages arising from AI-induced harm, and potential criminal liability for violations of the prohibitions.

Finally, firms advising on cross-border transactions should assess how the UAE AI law interacts with foreign regimes such as the EU AI Act, the US Executive Order on AI, and the UK's AI regulation, ensuring that clients' global AI governance programmes remain coherent.

FREQUENTLY ASKED QUESTIONS

What is the legal basis for the UAE AI law?
The UAE AI law is enacted as Federal Decree-Law No. 11 of 2024 concerning the Regulation of Artificial Intelligence Systems. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

Must every AI system be registered in the national AI registry?
Only AI systems classified as high-risk or those specifically listed by the UAE Artificial Intelligence Office are required to be registered. Limited-risk and minimal-risk systems are exempt from registration but remain subject to transparency and documentation obligations.

Can a company rely on consent to process personal data through an AI system?
Consent is a valid legal basis under the PDPL, but it must be freely given, specific, informed and unambiguous. For high-risk AI systems, the law additionally requires a data protection impact assessment and prior consultation with the Data Office, even when consent is obtained.

What penalties apply for non-compliance with the AI law's transparency obligations?
Failure to provide clear information about an AI system's capabilities, limitations or the logic behind automated decisions can attract an administrative fine of up to AED 1 million. Repeated violations may lead to higher fines and, in cases causing harm, imprisonment of up to six months.

Are DIFC and ADGM entities subject to the same AI law as mainland UAE companies?
Yes. The federal AI law applies across all emirates and free zones. DIFC and ADGM may issue supplementary guidance, but they cannot exempt entities from the core federal requirements.

How does the law treat AI used in employment decisions?
AI systems that evaluate job candidates, monitor employee performance or influence promotion decisions are considered high-risk when they process special categories of data or produce legally significant effects. Such systems must undergo conformity assessment, maintain documentation, and provide employees with the right to explanation and human review.

If your matter involves ai law in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.