🇦🇪United Arab Emirates

Overview

The United Arab Emirates (UAE) has established itself as a global pioneer in the governance of artificial intelligence, characterized by a top-down, strategic commitment to becoming a world leader in AI by 2031. This ambition was solidified in 2017 with the launch of the UAE National Strategy for Artificial Intelligence 2031 and the appointment of the world’s first Minister of State for Artificial Intelligence. The UAE’s regulatory philosophy is fundamentally pro-innovation, aiming to transform the country into a global 'testbed' for emerging technologies. Rather than implementing restrictive, horizontal AI legislation early on, the UAE has focused on building an enabling ecosystem that combines high-level policy visions with practical, non-binding guidelines designed to foster trust and accelerate adoption across government and private sectors. This strategy is part of the broader UAE Centennial 2071 project, which seeks to make the UAE the best country in the world by its 100th anniversary. The AI strategy specifically targets eight key sectors: resources and energy, logistics and transport, tourism and hospitality, healthcare, cybersecurity, and education. By integrating AI into these pillars, the UAE aims to generate up to AED 335 billion in extra economic growth. The governance model is designed to be agile, allowing the government to pivot as technology evolves, ensuring that the legal framework supports rather than hinders the rapid deployment of machine learning and automated systems. The maturity of the UAE’s AI regulatory landscape is reflected in its sophisticated 'soft law' infrastructure. This includes the 'AI Ethics Principles and Guidelines' and the 'AI Adoption Guideline in Government Services,' which provide a structured roadmap for developers and operators. The governance model is highly centralized at the federal level through the UAE Artificial Intelligence Office (AI Office), yet it allows for significant regional leadership, particularly from Dubai through the Digital Dubai Authority. The UAE approach prioritizes the 'AI-native' transformation of government services, using public sector deployment as a catalyst for broader economic change. This strategy is supported by the UAE Centennial 2071 vision, which views AI as a critical pillar for the country’s long-term economic diversification and social development. The government's role is seen as both a regulator and a primary consumer of AI, setting the standard for ethical use through its own digital transformation initiatives. This dual role allows for a feedback loop where regulatory guidelines are tested in real-world government applications before being recommended to the private sector.

Regulatory approach

The UAE utilizes a risk-based and sector-agnostic approach that leans heavily on voluntary compliance and ethical frameworks. The regulatory architecture distinguishes between different levels of decision-making impact, specifically identifying 'significant decisions' and 'critical decisions.' Significant decisions are those that could have a substantial impact on individuals or society, while critical decisions involve high-stakes outcomes such as life-and-death situations or criminal justice. For these higher-risk categories, the government recommends more stringent safeguards, including human-in-the-loop controls, rigorous testing, and enhanced transparency. This proportionality ensures that innovation is not stifled in low-risk applications, such as entertainment or administrative automation, while maintaining a high bar for safety in sensitive domains. The UAE's approach is also characterized by its 'experimental' nature, where the government actively seeks to partner with technology companies to co-create regulatory standards through sandboxes and pilot programs. A unique feature of the UAE’s regulatory approach is the use of 'experimental legislation' enabled by Federal Decree-Law No. 25 of 2018 on the Projects of Future Nature. This law allows the UAE Cabinet to grant provisional licenses for innovative projects—including those driven by AI—that do not yet have a dedicated legal framework. This 'Legislation Lab' model permits controlled experimentation and time-limited exemptions from existing federal laws to test new technologies in a real-world environment. This approach allows regulators to observe the technology's impact before drafting permanent, binding statutes. Consequently, the UAE's current regime is a hybrid of high-level enabling decrees and detailed operational guidelines, moving gradually toward a more formal legislative structure as the technology and its risks become better understood. This 'learn-by-doing' philosophy is central to the UAE's goal of being a global laboratory for the Fourth Industrial Revolution, providing a flexible legal environment that can adapt to the speed of technological change without compromising public safety or national security. The primary custodian of AI policy in the UAE is the Minister of State for Artificial Intelligence, Digital Economy, and Remote Work Applications, who leads the UAE Artificial Intelligence Office (AI Office). This office is responsible for coordinating national AI efforts, publishing guidelines, and overseeing the implementation of the 2031 Strategy. The AI Office acts as a central knowledge repository and a bridge between the government and the private sector. It is supported by the UAE Council for Artificial Intelligence and Blockchain, which serves as a cross-departmental body to ensure horizontal alignment across different ministries and emirates, facilitating the scaling of successful AI pilots. The Council plays a vital role in breaking down silos and ensuring that AI initiatives in one emirate, such as Dubai, are compatible with national standards and can be scaled across the entire country. At the technical and infrastructure level, the Telecommunications and Digital Government Regulatory Authority (TDRA) plays a critical role in managing the digital foundations required for AI, including data centers, cloud computing, and connectivity. Furthermore, the UAE Data Office, established under the federal data protection law, oversees the governance of personal data, which is the essential fuel for AI systems. In Dubai, the Digital Dubai Authority (formerly Smart Dubai) is a key institutional actor, having developed the country's first comprehensive AI Ethics Toolkit and Self-Assessment Tool, which have since been mirrored and adopted at the national level to ensure consistency in ethical standards across the country. These bodies work in a collaborative ecosystem where the AI Office sets the strategy, the TDRA provides the infrastructure, the Data Office ensures privacy, and sectoral regulators like the Central Bank or the Health Authority provide specific oversight for their respective domains.

Enforcement & penalties

Currently, the UAE's AI-specific guidelines—such as the AI Ethics Principles—are non-binding and do not carry direct administrative fines for non-compliance. Instead, enforcement is indirect, achieved through procurement preferences (where government entities require adherence to ethics guidelines from vendors) and reputational incentives. However, this does not mean AI activities are unregulated. Unlawful or harmful use of AI is strictly enforced through existing federal statutes. For instance, the use of AI for fraud, impersonation, or spreading misinformation is subject to severe penalties under Federal Decree-Law No. 34 of 2021 on Combatting Rumors and Cybercrimes, which includes heavy fines and potential imprisonment. This law is particularly relevant for generative AI and deepfakes, providing a robust legal deterrent against the misuse of synthetic media to harm individuals or the state. Furthermore, any AI system that processes personal data must comply with Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL). Violations of the PDPL, such as unauthorized automated processing or failure to conduct a Data Protection Impact Assessment (DPIA) for high-risk AI systems, can result in administrative fines determined by the UAE Cabinet. In the financial sector, the Central Bank of the UAE and other financial regulators have the power to sanction licensed institutions that fail to maintain adequate governance and risk management over their 'enabling technologies,' including AI, as outlined in the joint 2021 guidelines. Appeals against regulatory decisions are typically handled through the administrative grievance procedures of the respective authority or the UAE federal court system. As the regulatory landscape matures, it is expected that more specific administrative penalties will be introduced for violations of AI-specific safety and transparency standards, particularly for systems classified as 'critical.'

Data protection

The backbone of the UAE's data governance for AI is Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL). This law is the UAE's first comprehensive federal privacy statute and shares many principles with the EU's GDPR, including requirements for lawful basis for processing, data minimization, and the rights of data subjects. Crucially for AI, the PDPL addresses automated processing, granting individuals the right to object to decisions based solely on automated processing that produces legal effects or significantly affects them. It also mandates that controllers conduct a DPIA when using new technologies that pose a high risk to the privacy and confidentiality of data subjects. This requirement is a key pillar of the UAE's risk-based AI governance, ensuring that privacy is considered at the design stage of any AI system. In addition to the federal PDPL, the UAE maintains several 'free zone' data protection regimes, such as those in the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM). These jurisdictions have their own data protection laws (e.g., DIFC Data Protection Law No. 5 of 2020) which are highly aligned with international standards and include specific provisions for AI and automated processing. The DIFC, for instance, has issued specific guidance on how its data protection law applies to AI developers, providing clarity on issues like data scraping and model training. Data localization is also a factor in the UAE; while the PDPL allows for international data transfers under certain conditions (such as adequacy or specific contracts), certain sectors like healthcare and government services may have stricter requirements for keeping data within the UAE, impacting how cloud-based AI models are deployed and managed.

Sector-specific rules

The UAE has pioneered sector-specific AI governance, particularly in the financial and healthcare industries. In November 2021, the Central Bank of the UAE (CBUAE), along with the SCA, DFSA, and FSRA, issued the 'Guidelines for Financial Institutions Adopting Enabling Technologies.' These guidelines require financial firms to conduct materiality assessments of their AI applications, ensure model explainability, and maintain rigorous audit trails for at least five years. This ensures that AI used for credit scoring, fraud detection, or algorithmic trading does not compromise financial stability or consumer protection. The guidelines emphasize that boards and senior management remain ultimately accountable for AI-driven decisions, preventing a 'black box' excuse for regulatory failures. This sectoral approach allows for more granular oversight than a horizontal law could provide. In the transport sector, the UAE—and Dubai in particular—has been a leader in autonomous vehicle (AV) regulation. The Roads and Transport Authority (RTA) in Dubai has developed a comprehensive framework for testing and deploying self-driving vehicles, supported by federal-level initiatives to standardize AV safety requirements. Dubai's Autonomous Transportation Strategy aims to transform 25% of total transportation in Dubai to autonomous mode by 2030. In healthcare, the Ministry of Health and Prevention (MOHAP) and local authorities like the Dubai Health Authority (DHA) oversee the use of AI in diagnostics and patient management, ensuring that AI tools are treated as medical devices where applicable and adhere to strict clinical safety standards. These sectoral rules often move faster than horizontal legislation, providing tailored oversight for high-stakes AI applications while allowing the broader ecosystem to remain flexible and innovation-friendly.

International alignment

The UAE actively aligns its AI governance with international best practices to ensure its digital economy remains interoperable with global markets. The UAE AI Ethics Principles are explicitly mapped to international paradigms, including the OECD Principles on Artificial Intelligence and the G20 AI Principles. The UAE is also a signatory to the Bletchley Declaration (2023), signaling its commitment to international cooperation on frontier AI safety. By participating in global summits and multilateral forums, the UAE seeks to influence global AI discourse while ensuring its domestic guidelines reflect the consensus on 'Trustworthy AI.' This international outlook is essential for the UAE's ambition to attract global tech giants and startups, as it provides a regulatory environment that is both familiar and predictable for international legal teams. Furthermore, the UAE maintains a close watch on the EU AI Act and other major regulatory developments. While the UAE has not yet adopted a similarly prescriptive, legally binding horizontal act, its risk-based classification (significant vs. critical) mirrors the EU's approach to high-risk AI. The UAE also focuses on bilateral cooperation; for example, it has entered into various MoUs with other nations and international tech firms to collaborate on AI research and governance. This alignment is strategic, designed to attract international AI companies by providing a regulatory environment that is both familiar to global legal teams and flexible enough to support rapid technological iteration. The UAE's participation in the AI Safety Summit series and its engagement with the UN's High-Level Advisory Body on AI further demonstrate its commitment to being a responsible and collaborative actor in the global AI landscape.

What's next

The UAE's AI regulatory landscape is expected to transition from 'soft law' guidelines to more formal, binding frameworks over the coming years. A key area of focus is the further operationalization of the UAE Charter for the Development and Use of AI, which was adopted in 2024. This charter is expected to serve as the precursor to more specific federal regulations that could codify ethical requirements into law, particularly for 'critical' AI systems. There is also ongoing work to refine the AI Ethics Self-Assessment Tool from its beta phase into a more robust compliance instrument that could eventually be linked to government licensing or certification schemes, such as an 'AI Seal' for ethical systems. This would provide a clear market signal for trustworthy AI products and services, further enhancing the UAE's reputation as a safe and ethical AI hub. Additionally, the UAE is likely to expand its 'Legislation Lab' initiatives to cover more complex AI use cases, such as generative AI and large language models (LLMs). As the UAE develops its own sovereign AI capabilities (e.g., the Falcon LLM developed by TII), there will be an increased focus on 'AI Sovereignty' and the regulation of foundational models. Future developments will also likely include more detailed rules on AI liability and intellectual property, addressing the legal complexities of AI-generated content and autonomous harm. The government has indicated that it will continue its iterative approach, using stakeholder consultations and pilot results to inform the drafting of permanent laws that balance national security, public safety, and economic growth. The goal is to create a legal framework that is as innovative as the technology it regulates, ensuring the UAE remains at the forefront of the global AI revolution for decades to come.