AI governance in the UAE: soft law on top, hard data rules underneath

Series

Start-up compliance series · 5 of 7

Federal approach

Sectoral and principles led rather than one general AI statute

Binding foundations

Applicable privacy law, DIFC autonomous systems rules and sector requirements

Guidance

National AI Strategy 2031, UAE Charter for AI Development and AI ethics materials

Where binding UAE AI obligations sit

• UAE Federal PDPL. Personal data used to train or operate AI requires a lawful basis, and the law addresses certain automated decisions and higher risk processing involving new technologies.
• DIFC. Regulation 10 of the DIFC Data Protection Regulations addresses processing through autonomous and semi autonomous systems, including transparency and system information duties.
• ADGM. AI deployments remain subject to the ADGM data protection framework where personal data is processed, even without a separate general AI regulation.
• Financial services. Relevant financial regulators have issued guidelines for institutions adopting enabling technologies, which may shape provider and buyer expectations.

Why non-binding guidance still matters

The UAE Charter for AI Development, AI ethics materials and sector guidance may not create the same obligations as legislation, but they indicate the standards that regulators, government bodies and sophisticated buyers may expect.

A start-up selling into regulated or public sector environments can use these principles as a design baseline while separately mapping the binding requirements that apply to each use case.

Five controls to establish early

• Maintain an AI register. Record use cases, models, data sources, providers, owners and intended users.
• Assess data use. Identify a lawful basis and evaluate privacy risk before personal data is used to train, test or operate an AI system.
• Provide point of use transparency. Tell people when they are interacting with AI and provide the information required by the applicable regime.
• Design human oversight. Define meaningful review and escalation for consequential automated decisions.
• Map principles to evidence. Connect policy commitments to ownership, testing, approval, monitoring and incident records.

Sources and scope

Source briefing: White & Case AI Watch, UAE; DLA Piper, UAE and DIFC.

This article provides general information for start-ups and does not constitute legal advice. Requirements should be checked against current official sources and assessed for the organisation's circumstances before reliance.