UAE AI law & data protection
The UAE is building one of the most deliberate AI governance environments in the world. If your team is pasting company data into public AI tools, these are the instruments that should be shaping your decisions, and the reason sovereign deployment exists.
UAE Charter for the Development and Use of AI
Issued in June 2024, the Charter is the UAE's foundational statement on AI. It is explicitly non-binding, a set of guiding principles rather than law, and it sets out twelve principles:
- Strengthening human-machine ties
- Safety
- Algorithmic bias mitigation
- Data privacy
- Transparency
- Human oversight
- Governance and accountability
- Technological excellence
- Human commitment
- Peaceful coexistence with AI
- Promoting AI awareness for an inclusive future
- Compliance with applicable laws and treaties
Our Audit module scores your deployment against the Charter's principles from its own audit trail, not from memory.
Key resources:
- The Charter on u.ae: the official UAE government portal
- The Charter on the UAE Legislation portal
- AI Ethics Principles & Guidelines: practical steps for making AI fair and accountable
- Generative AI Guide: 100+ use cases and best practices for Gen-AI deployment
The UAE's International Stance on AI Policy
A separate official policy document that builds on the AI Charter, extending it into a framework for international AI cooperation and standards alignment. If your organisation works across borders, this is the document that signals how the UAE expects AI governance to interoperate with the rest of the world.
Key resources:
UAE National Strategy for Artificial Intelligence 2031
Launched in 2017 and updated in 2023, this is the long-term roadmap that drives AI-related legislation, procurement, and investment decisions across the UAE. It dictates federal investment, public-sector procurement rules, and the legislative roadmap.
Key resources:
- National AI Strategy 2031 (full roadmap): the executive vision for a 100% AI-enabled government
- AI Strategy overview: a summary of the key sectors targeted for transformation
The National AI System: an AI advisor inside the Cabinet
Since January 2026, a National AI System has sat as a formal advisory member of the UAE Cabinet, the Ministerial Development Council, and the boards of federal entities and state-owned companies. Announced by H.H. Sheikh Mohammed bin Rashid in June 2025, it is the first arrangement of its kind globally, and a measure of how seriously the UAE takes AI at the highest level of government.
The new Artificial Intelligence and Data Authority (June 2026)
On June 14, 2026, the UAE Cabinet approved a new Artificial Intelligence and Data Authority, chaired by H.E. Omar Sultan Al Olama. It absorbs the previous AI Office, the digital-government function of the telecoms regulator (TDRA), and the UAE Data Office, and it reports to the Cabinet.
The Authority may propose future AI and data legislation. As of today, no comprehensive federal AI statute is in force in the UAE. This is the body to watch: when enforceable AI law arrives, it is likely to originate here, and deployments that already keep their data and models inside their own walls will have the least to change.
The laws that already apply
There is no single UAE AI law in force today. What exists is a set of federal statutes and free-zone regulations that already govern how AI touches personal data, generated content and minors. To be compliant, your AI deployment must satisfy these:
Data Privacy: PDPL (Federal Decree-Law No. 45 of 2021)
The "GDPR of the UAE." It governs the processing of personal data, sets conditions on cross-border transfer, and gives data subjects enforceable rights. Employee records, customer lists and CRM data are squarely in scope, including when they are pasted into a chat window hosted abroad. Any AI processing personal data must have a Data Protection Impact Assessment (DPIA).
Federal Decree-Law No. 45 of 2021 · UAE data protection laws
DIFC Data Protection Regulations: Regulation 10
The DIFC amended its data-protection regime specifically to cover autonomous and semi-autonomous systems, one of the first regulators globally to write AI systems into data-protection law, and the amended regime has been in full enforcement since January 2026. If you operate in the DIFC, how your AI processes personal data is already regulated.
ADGM Data Protection Regulations 2021
Abu Dhabi Global Market's data-protection regime imposes GDPR-grade obligations on controllers and processors in the free zone, including transfer restrictions that matter the moment data leaves your infrastructure.
Cybercrimes (Federal Decree-Law No. 34 of 2021)
Strictly governs the creation of AI-generated content, deepfakes, and the unauthorized use of automated bots.
Child Digital Safety (Federal Decree-Law No. 26 of 2025)
Critical for any AI tools used in educational or creative sectors involving minors. In effect from January 1, 2026, with a mandatory alignment period running until January 1, 2027.
Abu Dhabi Oversight: AIATC (Law No. 3 of 2024)
Abu Dhabi-based firms are also governed by the AI and Advanced Technology Council (AIATC) under Law No. 3 of 2024.
Industry-specific regulation
| Industry | Key Regulation / Act | Impact on AI Use |
|---|---|---|
| Real Estate | Federal Decree-Law No. 45 of 2021 (PDPL) | AI-driven lead scoring processes personal data, so PDPL's consent, processing and cross-border transfer conditions apply. |
| Creative Agencies | Federal Decree-Law No. 34 of 2021 (Cybercrimes) | Prohibits the use of AI for unauthorized deepfakes or non-consensual brand manipulation. Disclose and watermark AI-generated media. |
| Hospitality | Federal Law No. 15 of 2020 (Consumer Protection) | AI assistants must be transparent with guests and protect booking and personal data. |
| Healthcare | Federal Law No. 2 of 2019 (ICT in Health) | Health data must by default be stored and processed inside the UAE, so AI diagnostic tools need UAE-resident data handling. |
The sovereign answer
Compliance questions get dramatically simpler when the data never moves. No cross-border transfer assessment is needed for data that never crosses a border. No processor agreement is needed with a cloud AI vendor you do not use. The Audit module then answers the remaining question, "prove your AI is governed", in software: an append-only trail, attribution for every action, human approvals recorded, retention enforced.
This page is a plain-language orientation, not legal advice. It deliberately cites only instruments published by official UAE government sources, and as of August 2026 no comprehensive federal AI statute is in force in the UAE. The information on this page was correct at the time of writing; regulations evolve and links to government documents can change at short notice. Confirm current requirements with your counsel.