Is There a UAE AI Act? AI Law in the UAE (2026 Guide)

Is There a UAE AI Act? What the Law Actually Says in 2026

As of autumn 2026, the UAE does not have a single AI Act like the one adopted in the European Union.
That does not mean AI is unregulated. The rules exist, they are just spread across several laws, regulators and free zones.
On 14 June 2026 the UAE announced the Federal Authority for Artificial Intelligence and Data. So far it has not published an AI law.
In our practice, the rules that apply to AI products usually come from five areas: personal data, content and deepfakes, children, finance, and principles and sandboxes.
A future federal law will most likely build on the existing obligations rather than start from zero.

“Is there an AI law in the UAE?”

We hear this question almost every week, usually from founders who are about to launch a chatbot, an AI-based KYC tool or a trading algorithm and want to know which rules to follow.

Does the UAE have an AI Act?

The answer is short: as of autumn 2026, the UAE does not have a single AI Act like the one adopted in the European Union. But that does not mean AI is unregulated here. The rules exist, they are just spread across several laws, regulators and free zones.

Comparing with Europe? See our guide to the EU AI Act

What changed in 2026: a new AI regulator, not a new AI law

The biggest development this year is institutional.

The Federal Authority for Artificial Intelligence and Data

On 14 June 2026 the UAE announced the Federal Authority for Artificial Intelligence and Data. It brings together:

the UAE Artificial Intelligence Office,
the Emirates Data Office,
the digital government sector of the TDRA (Telecommunications and Digital Government Regulatory Authority).

It reports directly to the Cabinet and is led by Omar Sultan Al Olama, the Minister of State for Artificial Intelligence. Its mandate includes setting national AI and data policy, proposing legislation and issuing standards for data and AI management.

What this means for businesses today

In practice this means one thing: if a federal AI law appears, it will most likely be prepared by this Authority. So far it has not published one, so for now the new Authority is a signal to watch, not a new set of obligations.

A small irony: the UAE already uses AI to help write its laws. In April 2025 the Cabinet approved a regulatory intelligence system that drafts and reviews legislation with the help of AI.

The rules that already apply to AI

Since there is no single AI Act, the right question is not “what does the AI law say?” but “which existing rules does my AI product touch?”. In our practice, the answer usually comes from five areas.

Area	Rule	What it requires	Status
Personal data (mainland)	Federal Personal Data Protection Law, Article 18	Right to object to decisions made through automated processing that have legal consequences	Executive regulations not yet published; enforcement on the mainland limited
Personal data (DIFC)	DIFC Regulation 10 (2023)	Users must be told; register of systems; Autonomous Systems Officer may be required for high-risk processing	Certification requirements expected in 2026
Personal data (ADGM)	ADGM data protection rules	Cover automated decision-making	-
Content and deepfakes	Cybercrime Law (Federal Decree-Law No. 34 of 2021); UAE Media Council warning (September 2025)	Prohibits false news, defamation and impersonation, whether made by a person or by a model	Already applies
Children	Federal Decree-Law No. 26 of 2025 on Child Digital Safety	Age verification; guardian’s consent for children under 13; no targeted advertising or profiling	Applied since 1 January 2026, with one year to comply
Finance	CBUAE Guidance Note on AI and ML (February 2026)	Board-level accountability; bias testing; telling customers when AI is used; human review of high-impact decisions	Not legally binding
Principles and sandboxes	UAE Charter for the Development and Use of AI; law on Projects of Future Nature	12 principles; temporary licence where no regulation exists yet	Charter not binding, but regulators refer to it

1. Personal data: PDPL, DIFC Regulation 10 and ADGM

If an AI system processes personal data, the federal Personal Data Protection Law applies. Its Article 18 gives individuals the right to object to decisions made through automated processing that have legal consequences for them. The executive regulations to this law have still not been published, so enforcement on the mainland remains limited.

The free zones went further. In 2023 the DIFC adopted Regulation 10 on autonomous and semi-autonomous systems:

users must be told when such a system processes their data,
companies must keep a register of these systems,
and high-risk processing may require an Autonomous Systems Officer.

The DIFC Commissioner is expected to introduce certification requirements in 2026. ADGM’s data protection rules also cover automated decision-making.

2. Content and deepfakes

The Cybercrime Law (Federal Decree-Law No. 34 of 2021) already covers false news, defamation and impersonation, whether the content was made by a person or by a model. In September 2025 the UAE Media Council also warned that using AI to depict public figures and national symbols without prior approval breaches media content standards and can lead to fines.

3. Children: the Child Digital Safety law

Federal Decree-Law No. 26 of 2025 on Child Digital Safety has applied since 1 January 2026, with one year to comply. Platforms aimed at UAE users must:

verify age,
obtain a guardian’s consent to process the data of children under 13,
and must not use children’s data for targeted advertising or profiling.

For consumer AI apps, this is probably the most concrete new obligation of the year.

4. Finance: CBUAE guidance on AI

In February 2026 the Central Bank of the UAE issued a Guidance Note on the responsible use of AI and machine learning by licensed financial institutions. It is not legally binding, but it shows what supervisors expect:

board-level accountability,
regular bias testing,
telling customers when AI is used,
and human review of high-impact decisions such as refusing a loan.

The institution stays responsible even if the model comes from a vendor.

Read more: AI in Financial Services

5. Principles and sandboxes

The UAE Charter for the Development and Use of AI sets out 12 principles, including safety, privacy and human oversight. It is not binding, but regulators refer to it. For truly new products, the Cabinet can grant a temporary licence under the law on Projects of Future Nature, where no regulation exists yet. Abu Dhabi also has its own AI and Advanced Technology Council.

Not sure which of these rules apply to your AI product?
Take the AI Compliance Readiness Score and see where your gaps are.

Not sure which of these rules apply to your AI product? Take the AI Compliance Readiness Score:

What we recommend

Waiting for an “AI Act” is not a strategy. The obligations already exist, and a future federal law will most likely build on them rather than start from zero. Here is what we usually suggest to clients:

Map your AI use cases. Make a simple list of where you use AI: customer chat, onboarding, scoring, transaction monitoring, marketing content.
Check data and jurisdiction. For each use, check whether personal data is involved and where you operate: mainland, DIFC or ADGM. The rules are different, and moving data between them is treated as a cross-border transfer.
Keep a human in the loop. Keep a person in the loop for decisions that affect people: refusing a client, freezing an account, declining a loan.
Review AI vendor contracts. Review your contracts with AI vendors. If their model makes a mistake, the regulator will still come to you.
Follow the new Federal Authority. Follow the new Federal Authority. Its first standards will show where the federal law is heading.

FAQ

Does the UAE have an AI law in 2026?

No. As of autumn 2026, the UAE does not have a single AI Act like the one adopted in the European Union. AI in the UAE is already regulated through data protection, content, child safety and sector rules, spread across several laws, regulators and free zones.

Who regulates AI in the UAE?

There is no single AI regulator yet. The new Federal Authority for Artificial Intelligence and Data sets national AI and data policy, issues standards and proposes legislation, but it does not supervise businesses directly. In the free zones, the DIFC Commissioner of Data Protection and the ADGM Office of Data Protection supervise how companies process personal data, including through AI systems. The UAE Media Council oversees media content, including AI-generated images and videos, and the Central Bank of the UAE sets expectations for financial institutions that use AI.

Does the UAE Personal Data Protection Law apply to AI?

What is DIFC Regulation 10?

In 2023 the DIFC adopted Regulation 10 on autonomous and semi-autonomous systems: users must be told when such a system processes their data, companies must keep a register of these systems, and high-risk processing may require an Autonomous Systems Officer.

How does UAE law treat AI-generated content and deepfakes?

What must AI apps do about children’s data in the UAE?

Under Federal Decree-Law No. 26 of 2025 on Child Digital Safety, platforms aimed at UAE users must verify age, obtain a guardian’s consent to process the data of children under 13 and must not use children’s data for targeted advertising or profiling.

Is the CBUAE guidance on AI binding?

No. The Central Bank of the UAE’s February 2026 Guidance Note on the responsible use of AI and machine learning is not legally binding, but it shows what supervisors expect: board-level accountability, regular bias testing, telling customers when AI is used, and human review of high-impact decisions such as refusing a loan. The institution stays responsible even if the model comes from a vendor.

Will the UAE adopt an AI Act like the EU?

There has been no official announcement of a federal AI law so far. If one appears, it will most likely be prepared by the Federal Authority for Artificial Intelligence and Data and build on the existing obligations rather than start from zero.

02.10.2026