PDPL and AI: What Changes Before the January 2027 Deadline
Last updated: 9 October 2026
- January 2027 is a real deadline, but not for the PDPL.
- The PDPL gives companies six months to comply, but the clock starts only when the executive regulations are issued. They have not been published yet.
- The real 1 January 2027 deadline belongs to the Child Digital Safety law: age verification, parental consent for children under 13, no targeted advertising with children’s data.
- Missing regulations do not switch the law off. The PDPL already applies to AI systems that process personal data.
- Six months is not enough to rebuild an AI system from scratch. Do not wait for the PDPL regulations.
Over the last few months, one date keeps appearing in UAE compliance blogs: 1 January 2027. Many of them call it the deadline for the Personal Data Protection Law, the PDPL. Some even give checklists of what “must be done” by then. Clients have started asking us about it too, usually with one question: if we use AI, what do we have to fix before January?
Before planning around this date, it is worth checking where it comes from. The answer is a little unexpected: January 2027 is a real deadline, but not for the PDPL.
Where the January 2027 date really comes from
The PDPL (Federal Decree-Law No. 45 of 2021) has been in force since 2 January 2022. Its Article 29 gives companies six months to comply, but the clock starts only when the executive regulations to the law are issued. As of October 2026, these regulations still do not appear on the official UAE legislation portal. Without them, no PDPL deadline can be calculated, in January 2027 or any other month. If you see a blog that says the regulations were already published, check the source: none of them is an official database.
The date that is real belongs to a different law. Federal Decree-Law No. 26 of 2025 on Child Digital Safety entered into force on 1 January 2026 and gave platforms one year to comply, so the deadline is 1 January 2027, unless the Cabinet extends it. This law has its own rules on personal data, and they matter for AI products. Most likely, the two laws simply got mixed up somewhere along the way.
What the PDPL already requires from AI today
Missing regulations do not switch the law off. The text of the PDPL already contains several rules that apply directly to AI systems that process personal data:
- A legal basis for the data. Personal data may be processed only with consent or under one of the exceptions in Article 4. This covers the data you use to train a model, as well as what customers type into a chatbot.
- Automated decisions. Under Article 18, a person may object to a decision made by automated processing, including profiling, if it has legal consequences for them, such as refusing a service.
- Impact assessment. Article 21 requires an assessment before using modern technologies that may pose a high risk to personal data. AI that profiles people or makes automated decisions is a textbook example.
- Data Protection Officer. Article 10 requires one where new technologies create a high risk, or where sensitive data is processed on a large scale.
- Cross-border transfers. Many AI tools run on servers outside the UAE. Under Articles 22 and 23, data can be sent abroad only to countries with adequate protection or with other safeguards, such as a contract or the person’s explicit consent.
- Data breaches. Under Article 9, a breach must be reported to the regulator and to the affected people.
Are there PDPL fines today?
There is one practical catch. The PDPL says that penalties will be set by a Cabinet decision, and this decision has not been issued yet. So today the risk of a fine on the mainland is low. But as soon as the regulations appear, companies will have only six months to bring everything in order, and for AI systems this is very little time.
What does change by January 2027: children’s data
The Child Digital Safety law applies to digital platforms that operate in the UAE or are aimed at users there, from social media and games to apps and websites. By 1 January 2027, they must be able to:
- verify the age of users and restrict access where needed;
- obtain explicit, documented consent from a parent before collecting data of a child under 13, with a simple way to withdraw it;
- stop using children’s data for targeted advertising, commercial purposes or tracking beyond what was agreed.
For AI products this is very concrete. An AI tutor for schoolchildren, a chatbot in a game or an AI app that teenagers can easily download all fall into this area. The detailed rules and penalties are still expected from the Cabinet, but the obligations themselves are already in the law.
One more change to watch: who will enforce
Until recently, the PDPL was to be supervised by the UAE Data Office. In June 2026 this office became part of the new Federal Authority for Artificial Intelligence and Data, together with the UAE AI Office. In other words, the bodies responsible for data and for AI now sit under one roof. How the supervisory powers will be divided has not been officially explained yet, but the direction is clear: data protection and AI will most likely be looked at together.
What we recommend before January 2027
- Check whether children can use your product in the UAE. If yes, plan age verification and parental consent now. This is the one deadline that is real.
- List where your AI processes personal data and write down the legal basis for each use.
- Run an impact assessment for AI that profiles people or makes automated decisions.
- Find out where your AI vendors store and process data, and check that transfers abroad are covered.
- Do not wait for the PDPL regulations. Six months is not enough to rebuild an AI system from scratch.
The bottom line
January 2027 is not the PDPL deadline, and it is better to know this before building a compliance plan around it. But it is a real deadline for anyone whose product children can use, and the PDPL itself already applies to AI today, even without its regulations. If you are not sure which of these rules apply to your AI product, AML ZONE can support you check it and prepare before the regulator does.
Sources
1. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Art. 29 and Art. 31 — https://uaelegislation.gov.ae/en/legislations/1972
Chambers and Partners, Data Protection & Privacy 2026 – UAE, March 2026 — s://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/uae
2. Federal Decree-Law No. 26 of 2025 on Child Digital Safety — https://uaelegislation.gov.ae/en/legislations/3912/download
Latham & Watkins, “UAE’s Child Digital Safety Law: What Every Digital Platform and ISP Should Know” — s://www.lw.com/en/insights/uaes-child-digital-safety-law-what-every-digital-platform-and-isp-should-know
5. Federal Decree-Law No. 44 of 2021 establishing the UAE Data Office — https://app.reallaw.ai/en/legal-table/doc/federal-decree-law-no-44-of-2021-on-the-establishment-of-the-uae-data-office-635
Morgan Lewis, “UAE Establishes Federal Authority for Artificial Intelligence and Data”, June 2026 — s://www.morganlewis.com/pubs/2026/06/uae-establishes-federal-authority-for-artificial-intelligence-and-data
09.10.2026
