Legal Insight

AI Regulation in the UAE: Framework, Liability & Future Law

Understand the current framework for AI regulation in the UAE, covering the National AI Strategy, data protection, liability for AI decisions, and future legal developments.

2 October 2025 · Emerging Areas, Private Notary & Integration

Introduction: The UAE’s AI Ambition and the Need for Legal Clarity

The United Arab Emirates (UAE) has firmly established itself as a global leader in technology adoption, with Artificial Intelligence (AI) at the core of its national vision. From smart cities to advanced healthcare systems, AI is rapidly transforming every sector of the economy. This rapid integration, however, presents a critical challenge for businesses: navigating the evolving legal and regulatory landscape.

For companies operating in or looking to enter the UAE market, understanding the current framework for AI governance, a key component of AI regulation UAE, is not just a matter of compliance—it is a strategic imperative. This focus on AI regulation UAE ensures responsible innovation. Questions surrounding data usage, ethical deployment, and, crucially, liability for autonomous AI decisions are paramount.

At Fakher & Co Legal Consultancy, we understand that our clients need more than just legal advice; they need a clear roadmap for innovation within the bounds of the law. Our expertise in emerging technologies, coupled with our commitment to a strict non-conflict policy, ensures that your business interests are protected as you leverage the power of AI. This authoritative guide clarifies the UAE’s current AI regulation UAE framework, addressing the core concerns of business leaders and legal counsel regarding AI law.

The Foundation: UAE’s Vision for AI Governance

The The UAE’s approach to AI regulation UAE is characterized by a proactive, top-down strategy. This forward-thinking AI regulation UAE is key to the nation’s success. designed to foster innovation while ensuring responsible deployment. This strategy is anchored by a clear national vision and supported by specialized regulatory bodies.

The National Strategy for Artificial Intelligence 2031

The cornerstone of the UAE’s AI journey is the UAE National Strategy for Artificial Intelligence 2031[1]. Launched in 2017, this ambitious strategy aims to position the UAE as a global leader in AI by 2031, integrating AI across key sectors including healthcare, education, transport, energy, and government services.

The strategy is not merely a technological roadmap; it is a governance framework that emphasizes:

Economic Growth: Using AI to create new economic value and enhance productivity.
Public Service Efficiency: Streamlining government operations and improving citizen services.
Global Norms: Shaping international standards for the responsible and impactful deployment of AI.

Key Regulatory Bodies and Authorities

The oversight of artificial intelligence Dubai and across the nation is managed through a multi-tiered structure involving federal and local authorities, reflecting the country’s decentralized governance model. This focus on artificial intelligence Dubai is a model for the region.

This structure ensures that while a national strategy guides the overall direction, local and sector-specific needs are addressed by specialized bodies.

The Current Regulatory Approach: A Hybrid Framework

TThe UAE’s regulatory framework for AI, a key aspect of AI law, is a dynamic blend of “soft law”aw” (ethical guidelines and charters) and “hard law” (existing federal and local legislation applied to AI contexts). This hybrid approach allows for flexibility to encourage innovation while providing a legal safety net.

The Role of Soft Law: Ethical Guidelines and Charters

Recognizing the speed at which AI technology evolves, the UAE has prioritized the establishment of ethical principles to guide development and deployment.

The UAE Charter for the Development and Use of Artificial Intelligence: Issued in 2024, this non-binding charter outlines 12 ethical principles, including safety, algorithmic bias mitigation, data privacy, transparency, human oversight, and accountability [2]. It serves as a moral compass for developers and organizations.
AI Ethics Guide: Published by the UAE’s AI Office, this guide sets out key ethical principles such as fairness, transparency, and safety, complementing international standards like UNESCO’s AI ethics recommendation.
Digital Dubai’s AI Principles and Ethics: At the local level, Dubai has issued its own guidelines covering fairness, security, privacy, and sustainability, often requiring companies to adhere to these standards to obtain certifications like the Dubai AI Seal [3].

Regulatory Sandboxes and Flexibility

To prevent regulation from stifling innovation, the UAE employs mechanisms to grant temporary exemptions for cutting-edge projects. Federal Decree Law No. (25) of 2018 on the Projects of Future Nature authorizes the UAE Cabinet to grant interim licenses and temporary exemptions under federal law for innovative projects, particularly those involving emerging technologies like AI, that lack existing regulation [4].

This mechanism, often implemented through regulatory sandboxes (such as those in the DIFC and ADGM), allows businesses to test and refine AI solutions in a controlled environment, providing a pathway for new technologies to enter the market while bespoke legislation is being drafted.

Navigating Data Use and Privacy in AI Systems

AI systems are inherently data-driven, making data protection and privacy a central pillar of AI regulation UAE.E*. Businesses must be acutely aware of how they collect, process, and use personal data for AI training and operation.

The Impact of the UAE Data Protection Law (PDPL)

The Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data (PDPL) is the primary federal legislation governing data use. The PDPL requires the lawful processing of personal data and imposes strict requirements that directly impact AI development:

Sector-Specific Data Requirements

In addition to the federal law, specific free zones and sectors have enhanced data protection requirements:

DIFC Data Protection Regulations: These regulations have been amended to specifically address AI systems, emphasizing the need for robust measures to protect personal data and mandating clear disclosures regarding data use in digital services.
Healthcare: The Dubai Health Authority’s AI Policy in Healthcare mandates compliance with international, federal, and Dubai-specific data protection standards, ensuring patient data privacy is paramount in AI-powered diagnostics and clinical support systems.

Practical Scenario: A Dubai-based FinTech firm uses an AI model to assess creditworthiness. The firm must ensure that the data used to train the model complies with the PDPL, that the automated decision-making process allows for human intervention, and that the customer is informed of their right to object to the automated decision. Fakher & Co assists clients in structuring their data governance frameworks to meet these complex, overlapping requirements.

Liability Issues for AI Decisions: The Current Legal Vacuum

One of the most pressing concerns for businesses deploying artificial intelligence Dubai is determining who is liable when an autonomous AI system causes harm, makes a discriminatory decision, or breaches a contract. This is a critical question in AI law. As of now, the UAE does not have a single, dedicated AI law assigning liability to AI systems themselves.

Applying Existing Civil and Criminal Frameworks

In the absence of AI-specific legislation, liability is determined by applying existing civil and criminal laws, primarily focusing on human negligence and product liability.

Civil Liability (Federal Decree Law No. (5) of 1985): The Civil Transactions Law establishes liability for harm caused by negligence. In an AI context, this means liability is likely to fall on the human actors responsible for the AI system:
The Developer/Manufacturer: If the harm is due to a design flaw, inadequate testing, or a failure to incorporate safety measures.
The Operator/User: If the harm is due to negligent oversight, misuse, or failure to update the system.
Criminal Liability: Federal Decree-Law No. (34) of 2021 on Countering Rumors and Cybercrimes can be invoked if an AI system is used to spread false information or commit cyber offenses. The liability would typically be assigned to the person or entity controlling the system.

Sector-Specific Liability Examples

The most concrete examples of AI liability are found in sector-specific regulations:

Autonomous Vehicles:Dubai’s Regulation of Autonomous Vehicles – Law No. (9) of 2023 places clear obligations on operators and agents, making them liable for damages caused by the autonomous vehicle. This is a crucial precedent, as it assigns responsibility to the entity controlling the technology, not the technology itself.
Financial Services: Guidelines for Financial Institutions Adopting Enabling Technologies require institutions to establish clear governance frameworks and ensure accountability by senior management for AI models, effectively placing the liability burden on the financial institution.

Client Concern:“If our AI-powered diagnostic tool in a Dubai hospital makes an error, who is sued?”

Fakher & Co Answer: While the AI is the immediate cause, the hospital (operator) and the software manufacturer (developer) are the primary targets. The legal inquiry will focus on whether there was negligence in the design, validation, deployment, or human oversight of the tool. Our role is to ensure your contracts and governance structure clearly define responsibilities and mitigate this risk.

Ethical Guidelines: The Bridge to Future Regulation

The UAE’s emphasis on ethical guidelines is a strategic move. It serves as a testing ground for principles that are likely to be codified into future “hard law.” These guidelines address the core ethical risks inherent in AI deployment.

Algorithmic Bias Mitigation

The UAE Charter explicitly calls for algorithmic bias mitigation. This is a critical concern, particularly in areas like recruitment, lending, and law enforcement, where biased training data can lead to discriminatory outcomes. Companies are expected to:

Audit Data: Regularly audit training datasets for demographic imbalances or historical biases.
Ensure Fairness: Implement technical measures to ensure AI outputs are fair and equitable across different demographic groups.
Document Decisions: Maintain detailed records of the AI model’s development and decision-making process to demonstrate compliance.

Transparency and Explainability (XAI)

The principle of transparency requires that the functioning of AI systems is understandable and that users can be informed when they are interacting with an AI. Explainable AI (XAI) is becoming a de facto requirement, especially in high-stakes applications like finance and healthcare. Regulators demand that institutions can explain how an AI reached a particular decision, moving away from “black box” models.

Future Regulatory Developments: Moving Towards Enforceable Law

The current hybrid framework is a transitional phase. The consensus among legal experts and industry leaders is that the UAE is rapidly moving towards more comprehensive, enforceable AI law.

Key Trends for 2026 and Beyond:

Codification of Ethics: Expect to see the voluntary ethical guidelines, particularly those concerning bias, transparency, and accountability, codified into binding regulations. This shift will create clear legal obligations for businesses.
Sectoral Deepening: Regulation will continue to deepen within specific high-risk sectors (e.g., finance, healthcare, and autonomous systems), moving from general guidelines to detailed, mandatory technical standards.
Focus on Responsible AI: Future laws will likely focus on mandatory risk assessments and governance frameworks for high-risk AI applications, similar to emerging global standards.
AI-Native Governance: Initiatives like the AI-supported Regulatory Intelligence Office and the AI-native Abu Dhabi government signal a commitment to integrating AI into the legislative and administrative processes, ensuring that future laws are informed by the technology they seek to regulate.

This forward-looking approach underscores the UAE’s commitment to not just adopting AI, but to leading the world in its responsible governance.

Key Takeaways for Business Leaders

Strategic Compliance is Essential: The UAE’s AI regulation UAE framework is a mix of hard law (PDPL, Cybercrime Law) and soft law (Charters, Ethics Guides). Compliance requires adhering to both the letter of the law and the spirit of the ethical guidelines.
Data Governance is Paramount: The PDPL and sector-specific rules make robust data protection and governance non-negotiable for any AI project.
Liability is Human-Centric (For Now): In the event of harm, liability will likely be assigned to the human operator, developer, or manufacturer based on existing negligence and product liability laws.
Transparency is Mandatory: Businesses must be prepared to demonstrate the fairness, transparency, and explainability of their AI models, especially in high-stakes decision-making.
Future-Proofing is Key: The trend is toward mandatory, enforceable AI-specific regulation. Businesses should proactively adopt best practices now to avoid costly restructuring later.
Leverage Regulatory Sandboxes: Utilize the UAE’s regulatory flexibility mechanisms (sandboxes) to test innovative AI solutions in a controlled, compliant environment.
Seek Expert Counsel: The complexity of overlapping federal, free zone, and sector-specific rules necessitates specialized legal guidance.

Frequently Asked Questions (FAQ)

+Q1: Does the UAE have a single, comprehensive AI law like the EU’s AI Act?

No. The UAE currently employs a hybrid, sector-specific approach to AI regulation UAE rather than a single, omnibus AI law like the EU’s AI Act. The framework is built on the National AI Strategy 2031, supported by non-binding ethical charters and guidelines, and enforced through the application of existing laws like the PDPL, Cybercrime Law, and specific regulations for sectors like finance and autonomous vehicles. This allows for greater flexibility and faster adaptation to new technologies.

+Q2: How does the UAE regulate the use of personal data for training AI models?

The primary AI law governing data is the Federal Decree by Law No. (45) of 2021 (PDPL). This AI law mandates that personal data used for AI training must be processed lawfully, typically requiring explicit consent or a clear legal basis. Furthermore, the law grants data subjects the right to object to automated decision-making, requiring companies to ensure human oversight and transparency in their AI systems.

+Q3: What are the main liability risks for a company whose AI system causes financial loss?

The liability risk under the current AI law is based on the principle of negligence under the Civil Transactions Law. The company (as the operator or developer) would likely be held liable if the financial loss is proven to be a direct result of a flaw in the AI’s design, a failure to test or validate the model adequately, or negligent human oversight. This is a key area of development in AI law and for artificial intelligence Dubai businesses. Clear contracts, robust testing protocols, and detailed governance records are essential for mitigating this risk.

+Q4: Are there specific rules for AI in the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM)?

Yes. Both the DIFC and ADGM, as financial free zones, have independent regulatory frameworks that are often more detailed than the federal law. The DIFC Data Protection Regulations, for instance, have specific amendments addressing AI systems and their impact on personal data processing, emphasizing enhanced transparency and data protection measures for financial technology.

+Q5: What is the significance of the UAE’s non-binding ethical guidelines?

While non-binding, these guidelines (like the UAE Charter and AI Ethics Guide) are highly significant. They represent the government’s clear expectations for responsible AI and are a strong indicator of the direction future enforceable legislation will take. Adhering to them now demonstrates good faith and corporate responsibility, which can be a mitigating factor in any future regulatory or legal dispute.

Secure Your AI Future with Expert Counsel

The UAE’s AI regulation UAE landscape is a frontier where innovation meets governance. This complex AI regulation UAE requires expert navigation. We specialize in all aspects of AI law. For your business to thrive, you need a legal partner who is not only fluent in the current laws but is also tracking the future trajectory of regulation.

Fakher & Co Legal Consultancy offers the specialized expertise required to navigate this complexity. As a boutique firm with comprehensive legal expertise since 2011, we pride ourselves on our personalized approach and our deep understanding of emerging technologies. We help you:

Design Compliant AI Governance Frameworks: Ensuring your AI development and deployment adheres to federal and free zone regulations.
Mitigate Liability Risks: Structuring contracts and operational protocols to clearly define and limit your exposure to AI-related liability.
Ensure Data Compliance: Guiding you through the intricacies of the PDPL and sector-specific data requirements.

Client’s Interest Comes First. Contact Fakher & Co today for a confidential consultation to secure your competitive edge in the UAE’s AI-driven economy.