The UAE has no single AI statute, so AI governance for a UAE company depends on where it operates. Onshore businesses follow the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Firms in the DIFC and ADGM follow those free zones’ own data protection laws instead, and the DIFC adds Regulation 10, a rule written specifically for AI and other autonomous systems that process personal data. Above these sit the National Strategy for Artificial Intelligence 2031, the 2024 UAE Charter for the Development and Use of AI, and Dubai’s government AI programme, all of which assume an AI-literate workforce.
This guide is for compliance, legal, data protection, technology and HR leaders at UAE companies. It explains which rules apply to you and gives a practical checklist for AI governance and training.
First question: which regime applies to you?
| Where you operate | Data protection law | Regulator | AI-specific provisions |
|---|---|---|---|
| Onshore UAE (including mainland Dubai and Abu Dhabi) | Federal Decree-Law No. 45 of 2021 (PDPL) | UAE Data Office | Right to object to automated processing, including profiling |
| Dubai International Financial Centre (DIFC) | DIFC Data Protection Law No. 5 of 2020 and the DIFC Data Protection Regulations | DIFC Commissioner of Data Protection | Regulation 10 on autonomous and semi-autonomous systems |
| Abu Dhabi Global Market (ADGM) | ADGM Data Protection Regulations 2021 | ADGM Office of Data Protection | Right not to be subject to solely automated decisions with legal or similarly significant effects |
Many groups operate in more than one of these. A bank may have a DIFC entity and onshore operations; a technology firm may sell from ADGM to onshore clients. Map each entity and each AI use to the regime that governs it before you write a single policy.
The UAE PDPL: the federal baseline
The PDPL took effect on 2 January 2022. It applies to the processing of personal data of people in the UAE, including by controllers and processors outside the country. It does not displace the data protection laws of free zones that have their own, such as the DIFC and ADGM, and it excludes some categories, such as government data and certain health and credit data governed by other laws.
For AI use at work, the provisions that matter most are:
- Lawful processing and consent: personal data used in AI tools needs a valid basis, and consent must meet the law’s conditions.
- Security and breach notification: controllers must protect personal data and report breaches. Staff pasting customer or employee data into unapproved AI tools creates exactly this exposure.
- Automated processing: data subjects can object to decisions made through automated processing, including profiling, subject to exceptions. Where an exception applies, organisations are still expected to protect the individual and provide human review on request.
One practical caution: the PDPL gives organisations six months from the publication of its Executive Regulations to comply, and the Executive Regulations had not been published when the trackers we reviewed were last updated. Confirm the current position with the UAE Data Office or your counsel, and do not wait for the regulations to start governing AI use.
DIFC Regulation 10: rules for autonomous and semi-autonomous systems
Regulation 10 of the DIFC Data Protection Regulations has been in force since 1 September 2023. It applies to personal data processed through “any machine-based system operating in an autonomous or semi-autonomous manner”, which includes AI, generative AI and machine-learning tools. It distinguishes the deployer (broadly similar to a controller, and generally accountable) from the operator (broadly similar to a processor).
The main requirements:
- Clear notice at first use: tell individuals that the system uses technology that is not human-initiated or human-directed, and explain its human-defined purposes, design principles and safeguards, and any relevant codes or certifications.
- A register on request: covering matters such as necessity and proportionality, whether decisions are solely automated, and where third parties are located.
- Design principles: systems should be ethical, fair, transparent, secure and accountable.
- High-risk processing: commercial use of these systems for high-risk processing is restricted unless the system meets audit and certification requirements set by the Commissioner, processes personal data only for human-defined or human-approved purposes, and an Autonomous Systems Officer (ASO) has been appointed.
The rules are evolving. In Consultation Paper No. 3 of 2026 (18 June to 18 July 2026), the DIFC proposed amendments including adding “safety” to the design principles, setting out the competencies expected of an ASO, requiring organisations without an ASO to allocate internal responsibility for oversight, and a new Regulation 11 letting the Commissioner recognise accreditation and certification schemes. Check whether the amendments have been enacted before finalising your controls.
Regulation 10 has a direct training implication: the ASO, and anyone given oversight of autonomous systems, needs a mix of data protection, technical and governance knowledge that few people have today.
ADGM: GDPR-style rights on automated decisions
The ADGM Data Protection Regulations 2021 follow a GDPR-style model. Among other rights, individuals have a right not to be subject to decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on them. The ADGM Office of Data Protection publishes guidance on applying the regulations, which compliance teams in ADGM entities should track.
The national picture: strategy, charter and Dubai’s government AI programme
- National Strategy for Artificial Intelligence 2031: adopted by the UAE Cabinet in April 2019, with the aim of making the UAE a leading nation in AI by 2031. The UAE created a Minister of State for Artificial Intelligence in October 2017.
- UAE Charter for the Development and Use of AI (2024): sets out 12 principles, including a harmonious human-machine relationship, safety, addressing algorithmic bias, data privacy, transparency, human oversight, governance and accountability, and compliance with existing laws and international treaties. The charter is a statement of principles rather than a statute, but it signals what government, regulators and large buyers expect.
- Dubai Universal Blueprint for Artificial Intelligence (April 2024): its first phase included appointing a Chief AI Officer in every Dubai government entity, and 22 were appointed. Companies supplying Dubai government entities should expect AI-literate buyers asking how their AI is governed.
A UAE AI governance and training checklist
1. Map entities to regimes
List every legal entity and where it is established (onshore, DIFC, ADGM), then map each AI use to the regime that governs it.
2. Build an AI inventory, including shadow AI
Record approved tools, AI features inside existing software, AI agents and unapproved use. AccuroAI’s shadow AI discovery helps security teams find the AI tools employees actually use, which is usually more than the approved list suggests.
3. Flag autonomous and high-risk systems
For DIFC entities, identify which systems fall within Regulation 10 and which involve high-risk processing. For agents that act on systems and data, use a structured model such as AccuroAI’s AI agent governance framework to set permissions, approvals and logging.
4. Assign accountability
Appoint an ASO where Regulation 10 requires one. Elsewhere, give each significant AI system a named business owner and a reviewer who can explain and challenge its outputs.
5. Fix notices and objection routes
Update privacy notices to describe AI use, prepare Regulation 10 notices for DIFC systems, and create a simple route for people to object to automated decisions and request human review.
6. Train by role
| Audience | Focus |
|---|---|
| All employees | Approved tools, data red lines, checking AI output, reporting mistakes |
| HR, customer and credit teams | Automated decisions, human review and objections |
| DPOs, ASOs, legal and compliance | PDPL, DIFC and ADGM requirements, Regulation 10 notices and registers |
| Engineering and security | Secure AI, agent permissions, prompt data controls |
| Board and executives | AI strategy, risk appetite and oversight |
Our AI Governance & Compliance training covers the compliance and legal track, and AI Risk & Strategy for Leaders is built for boards and executive teams. For organisations rolling AI out across every function, our AI-Ready Organisation programme combines leadership, workforce and practitioner training.
7. Report to leadership
Give the board a regular view of AI use, incidents and training coverage. AccuroAI’s executive reporting turns AI usage and policy data into summaries leaders can act on.
8. Review every quarter
Track the PDPL Executive Regulations, the DIFC’s Regulation 10 amendments and any new federal or emirate-level AI guidance.
Frequently asked questions
Does the UAE have an AI law?
There is no single federal AI statute. AI is governed through data protection law (the PDPL onshore, and separate regimes in the DIFC and ADGM), the DIFC’s Regulation 10, sector rules, and national policy instruments such as the National Strategy for AI 2031 and the UAE AI Charter.
Does the PDPL apply to companies in the DIFC or ADGM?
Generally no. The PDPL does not apply in free zones that have their own data protection laws, such as the DIFC and ADGM. A group with entities both onshore and in a free zone may need to comply with more than one regime.
What is an Autonomous Systems Officer?
Under DIFC Regulation 10, an ASO is a role broadly similar to a data protection officer, responsible for monitoring compliance of autonomous and semi-autonomous systems and cooperating with the Commissioner. An ASO is required for high-risk processing through such systems for commercial purposes.
Does Regulation 10 cover tools like ChatGPT or Copilot?
It can. Regulation 10 covers machine-based systems operating autonomously or semi-autonomously, including generative AI, when they process personal data for a DIFC deployer or operator. Take advice on how it applies to each specific use.
Where should a UAE company start with AI training?
Start with a short, practical programme for every employee on safe AI use and data red lines, then add deeper training for the people who make AI-supported decisions, oversee AI compliance or build AI systems.
Get your teams ready
Product Innovation Academy runs AI governance, AI security and AI literacy training for UAE companies in Dubai, Abu Dhabi and across the Emirates, with AI Security & Governance programmes delivered in partnership with AccuroAI. Request a proposal and we will tailor a programme to your entities, regimes and AI use.
Sources
- UAE Legislation, Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data. uaelegislation.gov.ae
- DLA Piper, “Data Protection Laws of the World: United Arab Emirates”. dlapiperdataprotection.com
- DataGuidance, “UAE: Federal” jurisdiction overview. dataguidance.com
- Clyde & Co, “DIFC enacts landmark regulation for autonomous and semi-autonomous systems”, September 2023. clydeco.com
- Hadef & Partners, “AI and data privacy: proposed changes to the DIFC Data Protection Regulations”, 8 July 2026. hadefpartners.com
- ADGM, “Overview of the ADGM Data Protection Regulations 2021”. adgm.com
- UAE Cabinet, “UAE Cabinet adopts National Artificial Intelligence Strategy 2031”. uaecabinet.ae
- WAM, “Mohammed bin Rashid announces Cabinet Reshuffle”, October 2017. wam.ae
- UAE Government portal, “The UAE Charter for the Development and Use of Artificial Intelligence”. u.ae
- WAM, “Hamdan bin Mohammed launches Dubai Universal Blueprint for Artificial Intelligence”, April 2024. wam.ae
- WAM, “Hamdan bin Mohammed appoints 22 Chief AI Officers across government entities in Dubai”. wam.ae