UAE's New Federal AI and Data Authority: What It Does (and Doesn't) Regulate
Last updated: 23 October 2026
Key takeaways
- On 14 June 2026, the UAE approved the establishment of the Artificial Intelligence and Data Authority, which reports directly to the Cabinet.
- It takes over the UAE Data Office, the Digital Government Sector of the TDRA and the Office of Artificial Intelligence, Digital Economy and Remote Work Applications.
- Its announced functions are addressed to federal entities. The announcement says nothing about licensing private AI systems, approving models or fining companies.
- The UAE still has no general binding AI law, and PDPL penalties cannot be enforced yet.
- The DIFC, ADGM and sector regulators such as the Central Bank and VARA keep their own rules.
On 14 June 2026, Sheikh Mohammed bin Rashid Al Maktoum announced that he had approved the establishment of the Artificial Intelligence and Data Authority. Within days, clients started asking us the same questions. Is this the UAE’s AI regulator? Will we need its approval to use AI? Can it fine us? Based on what has been officially published so far, the answer to all three is: not yet. Its announced mandate is mostly about government, not private business. But that does not make it irrelevant.
What was created
The authority reports directly to the Cabinet and is chaired by Omar Sultan Al Olama, Minister of State for Artificial Intelligence. In English, the Cabinet calls it the “Artificial Intelligence and Data Authority”; the Arabic name adds the word “federal”. It takes over the functions of three existing bodies: the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, the Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority (TDRA), and the UAE Data Office. The government describes it as the single national body responsible for data, AI and digital government.
One important detail is missing. The announcements do not name the legal act that establishes the authority, and as of late October 2026 we have not found it on the official UAE Legislation portal. Until it is published, the authority’s exact powers can only be read from the announcement.
What it will do
According to the Cabinet, the authority will:
- propose national policies, legislation and strategies, and lead the national AI strategy;
- manage government data and ensure its quality, availability and sharing across federal entities;
- operate and develop AI-powered national data platforms to support government decision-making;
- set standards and guidelines for data and AI management, digital transformation and government services;
- ensure compliance across federal entities and support government information security.
Look at who these functions are addressed to: federal entities. The announcement says nothing about licensing private AI systems, approving models or fining companies.
What it does not regulate, at least for now
Private-sector AI as such. The UAE still has no general binding AI law. The main national document is the UAE Charter for the Development and Use of Artificial Intelligence of June 2024, which sets out principles rather than enforceable obligations. The new authority can propose legislation, but proposing a law is not the same as regulating.
Personal data, probably, but not officially. The authority has absorbed the UAE Data Office, which was set up to propose data protection policies, issue guidance and supervise the application of federal data protection legislation. It is logical to expect that supervision of the Personal Data Protection Law (PDPL) will move with it, but the announcement does not say so. Either way, enforcement is not possible yet: penalties under the PDPL depend on a Cabinet decision, and its executive regulations, which the law required within six months, have still not been published.
Data that the PDPL excludes. The PDPL does not apply to government data, to personal data held by security and judicial authorities, to health data and banking and credit data that have their own legislation, or to companies in free zones with their own data protection laws. There is an irony here: the authority’s main announced task is government data, which falls outside the PDPL altogether.
The financial free zones. The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) have their own data protection regimes. In the DIFC, Regulation 10 of the Data Protection Regulations remains the binding rule for AI systems that process personal data. Nothing in the announcement changes this.
The financial free zones. The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) have their own data protection regimes. In the DIFC, Regulation 10 of the Data Protection Regulations remains the binding rule for AI systems that process personal data. Nothing in the announcement changes this.
Sector regulators. The announcement does not transfer any powers from the Central Bank, the Virtual Assets Regulatory Authority (VARA) in Dubai or health regulators. AI used in banking, crypto or healthcare remains subject to their rules.
Why it still matters for business
First, direction. With one body responsible for both AI and data, future rules on AI and data protection are likely to be written together rather than separately. Second, government contracts. Standards for data and AI management will apply first to federal entities, and they will pass them on to their suppliers through contracts. A company that sells AI or data services to the federal government should expect these requirements sooner than anyone else.
What we recommend
- Do not wait for an AI licence that does not exist. The PDPL already applies to AI that processes personal data, even without its regulations.
- If you work with federal entities, follow the standards and guidelines the authority publishes: they will reach you through contracts.
- In the DIFC and ADGM, follow your free zone’s own data protection rules.
- Watch the UAE Legislation portal for two documents: the law establishing the authority and the PDPL executive regulations.
The bottom line
The new authority is a big step for AI and data governance in the UAE, but today it is a policy and government body, not a regulator of private AI. Its real powers will become clear only when its founding legislation is published. Until then, the rules that bind businesses are still the PDPL, the free zone regimes and sector regulations. If you are not sure which of them apply to your AI systems, AMLzone can help you map your obligations and prepare for what comes next.
Sources
1. UAE Cabinet, “Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority”, 14 June 2026. https://uaecabinet.ae/en/news/mohammed-bin-rashid-approves-establishing-artificial-intelligence-and-data-authority
2. UAE Cabinet, “Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority”, 14 June 2026. https://uaecabinet.ae/en/news/mohammed-bin-rashid-approves-establishing-artificial-intelligence-and-data-authority
3. Dubai Media Office, “Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority”, 14 June 2026. https://mediaoffice.ae/en/news/2026/june/14-06/mohammed-bin-rashid-approves-establishing-artificial-intelligence-and-data-authority
4. UAE Cabinet, 14 June 2026 (see note 1). https://uaecabinet.ae/en/news/mohammed-bin-rashid-approves-establishing-artificial-intelligence-and-data-authority
5. The UAE Charter for the Development and Use of Artificial Intelligence, June 2024, UAE Legislation portal. https://uaelegislation.gov.ae/en/policy/details/the-uae-charter-for-the-development-and-use-of-artificial-intelligence
6. Federal Decree-Law No. 44 of 2021 on the Establishment of the UAE Data Office, Art. 2 and Art. 3. https://uaelegislation.gov.ae/en/legislations/2433/download
7. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Art. 24, 26 and 28. https://uaelegislation.gov.ae/en/legislations/1972/download
8. Federal Decree-Law No. 45 of 2021, Art. 2(2). https://uaelegislation.gov.ae/en/legislations/1972/download
9. UAE Government portal, “Data protection laws”. https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
27.10.2026
