AI Regulation in the UAE:
No Single Law, But Real Obligations
There's no "UAE AI Act" - but if your business builds, deploys, or relies on AI systems in the UAE, you're already subject to real requirements under PDPL, DIFC Regulation 10 for autonomous and semi-autonomous systems (introduced in September 2023, with enforcement from January 2026)
9+ Years of Compliance Expertise
End-to-End Execution
AI regulation in the UAE is layered, not centralized: there is no single federal AI law. Obligations apply through the federal Personal Data Protection Law (PDPL, Federal Decree-Law No. 45 of 2021), DIFC Regulation 10 for autonomous and semi-autonomous systems (in force since January 2026), the ADGM Data Protection Regulations 2021, and sector-specific guidance depending on your industry. A new Artificial Intelligence and Data Authority was approved on 14 June 2026, consolidating federal AI policy - though its mandate is currently government-facing rather than a direct private-sector enforcer.
What's Included
AI system inventory and regulatory mapping (PDPL / DIFC Reg 10 / ADGM / sector-specific)
Data Protection Impact Assessments (DPIA) for AI-driven processing
AI governance framework and policy drafting
Regulator liaison and documentation for UAE Data Office, DIFC, or ADGM as applicable
Ongoing monitoring for AI and Data Authority developments relevant to your sector
Question 1 of 8
Check Your AI Compliance Score
Frequently Asked Questions
No. The UAE regulates AI through a combination of federal data protection law (PDPL), free-zone-specific rules (DIFC Regulation 10, ADGM Data Protection Regulations), and sector-specific guidance - not one central AI statute.
PDPL applies to any processing of personal data, including data processed by AI systems. It does not name "AI" specifically, but its obligations - lawful processing, data subject rights, DPIAs for high-risk processing - apply directly to AI-driven data processing.
The UAE Data Office can impose administrative fines, order mandatory audits, and suspend or restrict data processing activities. The specific penalty schedule is set by a separate Cabinet Decision under PDPL Article 26, which hasn't been publicly detailed — so don't treat any commonly cited fine figure as confirmed.
It depends on where your entity is registered and where your processing takes place. PDPL applies to mainland UAE and most free zones; DIFC and ADGM operate their own separate data protection regimes for entities registered within them.
Not currently. Its mandate, as established in June 2026, is primarily government-facing. It does not yet exercise direct enforcement powers over private businesses, though this may change as federal AI policy develops.
Related
Not sure which UAE AI framework applies to your business?
By submitting this form, I acknowledge that I have read and agree to the Privacy Policy, and I consent to the processing of my personal data.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.