artificial-intelligence.giGlobal AI Monitor

United Arab Emirates AI Regulation & Governance

AE10 active modules2 quiet

Last updated · 12 modules · 15 instruments · 68 claims · 58 sources in the cumulative register

Framework status
DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).
Main regulator

RegulatorOffice of the Minister of State for Artificial Intelligence, Digital Economy and Remote Work Applications; from 14 June 2026 consolidated into the new federal Artificial Intelligence and Data Authority

Next milestone
: Expected federal AI law issuance (01 AI Framework Law)
Record status
Live · Periodic active record · 58 sources (46 retrieved) · 8 under review · Not yet expert-reviewed
AI-assembled from cited sources
Evidence-gated · How we verify ·
DisclosureNot yet expert-reviewed · Not legal, compliance or investment advice. Facts are machine-assembled from cited public sources. Individual claims have not each been independently verified by a human reviewer. See methodology.

Source tiers: T1 enacted statute, regulation, or binding supervisory order · T2 official regulator guidance, consultation, or registry · T3 international standard-setter or peer-reviewed analysis · T4 practitioner commentary or secondary reporting. Confidence: high = corroborated by retrieved T1/T2 text · medium = single official source or secondary corroboration · low = preliminary or unverified. Full definitions →

Research checked · Updated
Record history

Research as of · Record last changed · Published · Page built

Next milestones in this record

Jump to module (12)

#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

4 instruments (4 current) · 1 obligation · 17 claims · 2 milestones · Next: (Expected federal AI law issuance)

Standing sub-brief · as of 12 Nov 2026 272 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Binding law in force: DIFC Regulation 10, part of the DIFC Data Protection Regulations and the UAE's only binding, AI-specific legal instrument, took effect on 1 September 2023 and remains the one binding, AI-specific instrument currently in force in the UAE, there being no standalone federal AI statute. Regulation 10 applies to any autonomous or semi-autonomous System that processes personal data, treating the Deployer as controller-equivalent and the Operator as processor-equivalent, and requires Systems impacting data subjects to be designed for ethicality, fairness, transparency, security and accountability. At emirate level, Abu Dhabi Law No. (3) of 2024 establishes the Artificial Intelligence and Advanced Technology Council (AIATC) to regulate AI and advanced-technology activity in Abu Dhabi.

Instruments (4)
  • DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01
    Binding
  • DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems) In force since 2023-09-01
    Binding
  • Law Establishing the Artificial Intelligence and Advanced Technology Council (AIATC) In force since 2024-01-01
    Binding
  • UAE Charter for the Development and Use of Artificial Intelligence Published 2024-06-10; valid from 2024-07-30
    Non-binding

Obligations

  • Article 18(1)

    A data subject has the right to object to decisions issued with respect to automated processing, including profiling, particularly where such decisions have legal impact on or seriously/adversely affect the data subject.

    Applies to: Other · UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

Milestones

  • DIFC Regulation 10 full enforcement Met
    DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
  • (Year)Expected federal AI law issuance Upcoming
    UAE Charter for the Development and Use of Artificial Intelligence
Claims and evidence (17)

  • The UAE has no dedicated, standalone federal statute regulating artificial intelligence as such; AI is governed through sectoral and data-protection instruments plus DIFC Regulation 10.

    Confidence: Probable (capped: best source is T3) · As of 25 Apr 2026 · Evidenced
    Evidence and sources
    • Latham & Watkins T3 · Retrieved · retrieved 4 Nov 2026Regulation 10 prohibits the commercial use of Systems to engage in such high risk processing

  • The UAE Cabinet approved establishing a federal Artificial Intelligence and Data Authority on 14 June 2026, merging the AI Office, the UAE Data Office and TDRA digital functions.

    Confidence: Uncertain (capped: best source is T3) · As of 14 Jun 2026 · Evidenced
    Evidence and sources
    • Reconn Orbit T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

  • The UAE Charter for the Development and Use of Artificial Intelligence is a non-binding ethical instrument issued June 2024 setting 12 principles.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Latham & Watkins T3 · Retrieved · retrieved 4 Nov 2026The UAE Council for Artificial Intelligence and Blockchain, established in February 2018, promotes cross-sector AI adoption

  • Abu Dhabi Law No. (3) of 2024 establishes the AIATC to regulate AI and advanced-technology activity in the emirate.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Latham & Watkins T3 · Retrieved · retrieved 4 Nov 2026The UAE Council for Artificial Intelligence and Blockchain, established in February 2018, promotes cross-sector AI adoption

  • DIFC Regulation 10 brings AI and autonomous/semi-autonomous systems within scope whenever they process personal data.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Middle East AI News T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

  • The UAE has no horizontal federal AI Act with prohibited uses or risk-tier conformity assessment requirements as at this cycle.

    Confidence: Probable (capped: best source is T3) · As of 25 Apr 2026 · Evidenced
    Evidence and sources
    • Latham & Watkins T3 · Retrieved · retrieved 4 Nov 2026Regulation 10 prohibits the commercial use of Systems to engage in such high risk processing

  • DIFC Regulation 10 applies to any autonomous or semi-autonomous System that processes personal data, with the Deployer as controller-equivalent and the Operator as processor-equivalent.

    Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • LexNova T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

  • DIFC Regulation 10 requires Systems impacting data subjects to be designed for ethicality, fairness, transparency, security and accountability.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • LexNova T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

  • The UAE has no horizontal federal AI Act; AI is governed through sectoral and free-zone instruments, chiefly DIFC Regulation 10.

    Confidence: Probable (capped: best source is T1) · As of 25 Apr 2026 · Evidenced
    Evidence and sources
    • Abu Dhabi Global Market (ADGM) T1 · Surfaced · retrieved 4 Nov 2026There is no horizontal AI Act with prohibited uses or risk-tier conformity assessments
    • Central Bank of the UAE T1 · Surfaced · retrieved 4 Nov 2026There is currently no dedicated AI law in force in the United Arab Emirates.
    • obgulf.com T3 · Retrieved · retrieved 4 Nov 2026There is no single "AI Act" in force in the UAE as of October 2026.

  • The UAE AI Charter (June 2024) sets 12 non-binding ethical AI principles with no penalty or liability regime.

    Confidence: Probable (capped: best source is T3) · As of 10 Jun 2024 · Evidenced
    Evidence and sources
    • Business Dubai T3 · Retrieved · retrieved 4 Nov 2026establishes principles for the ethical, transparent and responsible development and use of AI

  • A comprehensive federal AI law is reported in draft with anticipated issuance in 2026 or 2027.

    Confidence: Uncertain · Evidenced
    Evidence and sources
    • Abu Dhabi Global Market (ADGM) T1 · Surfaced · retrieved 4 Nov 2026There is no horizontal AI Act with prohibited uses or risk-tier conformity assessments

  • As of June 2026, the UAE has no standalone federal law regulating the development, deployment or use of AI systems.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Al Tamimi & Company T3 · Surfaced · retrieved 11 Nov 2026there is currently no standalone federal AI law regulating the development, deployment or use of AI systems

  • As of October 2026, the UAE has no single, comprehensive AI Act in force; AI use onshore is governed by existing law (PDPL, sectoral regulators, and DIFC Regulation 10 within the DIFC).

    Confidence: Probable (capped: best source is T3) · As of 8 Oct 2026 · Evidenced
    Evidence and sources
    • OBG Gulf T3 · Retrieved · retrieved 8 Oct 2026As of October 2026 the UAE has no single, comprehensive AI Act in force

  • DIFC Regulation 10, governing personal data processed through autonomous and semi-autonomous AI systems, took effect on 1 September 2023.

    Confidence: Probable · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Surfaced · retrieved 11 Nov 2026The updated DIFC Data Protection Regulations enacted on September 1, 2023, include Regulation 10 on Processing Personal Data

  • DIFC Regulation 10 is described by legal commentary as the one binding, AI-specific legal instrument currently in force in the UAE.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • LexNova T3 · Retrieved · retrieved 11 Nov 2026DIFC's Regulation 10: the One Binding, AI-Specific Instrument in the UAE

  • Derived: Probable On 14 June 2026 the UAE Cabinet approved creation of a federal Artificial Intelligence and Data Authority, but no founding legal instrument has been published.

    Confidence: Probable · As of 14 Jun 2026 · Evidenced
    Evidence and sources
    • UAE Cabinet (Media Center) T1 · Surfaced · retrieved 11 Nov 2026His Highness Sheikh Mohammed bin Rashid Al Maktoum ... has approved the establishment of the Artificial Intelligence and Data Authority.

  • DIFC Regulation 10 is the only binding, AI-specific legal instrument in force in the UAE; there is no standalone federal AI statute.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • LexNova T3 · Retrieved · retrieved 11 Nov 2026DIFC's Regulation 10: the One Binding, AI-Specific Instrument in the UAE

#

Nothing recorded for this module in the research of 2026-11-11.

0 instruments · 0 obligations · 0 claims

#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

3 instruments (3 current) · 7 obligations · 19 claims · 1 milestone

Standing sub-brief · as of 12 Nov 2026 322 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Binding law in force: DIFC Regulation 10, which took effect on 1 September 2023, defines a 'System' broadly under Regulation 10.1.1(a) to capture any machine-based autonomous or semi-autonomous system that processes personal data, treating the Deployer as controller and the Operator as processor. Regulation 10.1.1 and 10.3.3 prohibit commercial use of such a System for High Risk Processing Activities unless the controller or processor first assesses, documents and mitigates privacy risk and four cumulative conditions are met, including Commissioner-established certification/audit requirements, human-defined or approved processing purposes, and appointment of an Autonomous Systems Officer. The Deployer and Operator of a System engaged in High Risk Processing Activities must appoint an Autonomous Systems Officer with competencies, status, role and tasks substantially similar to a Data Protection Officer, and this role may be combined with the DPO function. Certification under Regulation 10.3.3 is system-specific rather than entity-specific and may only be issued by an Accredited Certification Body. Regulation 10 further requires Systems impacting data subjects to be designed for ethicality, fairness, transparency, security and accountability. Regulation 10's audit and certification requirements reached full enforcement on 1 January 2026. Separately, in the Abu Dhabi Global Market, ADGM Data Protection Regulation 20 gives data subjects a right not to be subject to a solely-automated decision with legal or similarly significant effect, requiring written notice and an opportunity for reconsideration. The UAE Federal Decree-Law No. 45 of 2021 (PDPL) automated-processing and profiling duties apply extraterritorially to controllers and processors both inside and outside the UAE where UAE data subjects are involved. A July 2025 amendment to the DIFC Data Protection Law raised the maximum fine for failing to carry out a Data Protection Impact Assessment before High Risk Processing Activities from USD 20,000 to USD 50,000.

Instruments (3)
  • DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01
    Binding
  • DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems) In force since 2023-09-01
    Binding
  • Federal Decree-Law No. 45 of 2021 (PDPL) Valid from 2022-01-02
    Binding

Obligations

  • 10.3.3

    Commercial use of a System for High Risk Processing Activities requires Commissioner certification/audit, human-defined/approved processing purposes, and an appointed ASO.

    Conformity assessment · Applies to: Deployer · DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
  • 10.3.3(d)

    Appointment of an Autonomous Systems Officer for high-risk System deployment, with DPO-equivalent competencies.

    Other · Applies to: Deployer · DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
  • 10.1.1(a)/10.2.1

    Deployers and Operators of autonomous or semi-autonomous AI systems processing personal data must adhere to general processing principles, appoint a DPO and/or Autonomous Systems Officer, run DPIAs for high-risk processing, and meet certification/audit conditions, with full enforcement from January 2026.

    Data governance · Applies to: Deployer · DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
  • 10.1.1 / 10.3.3

    Commercial use of an autonomous or semi-autonomous system for High-Risk Processing Activities is prohibited unless four cumulative conditions are met: Commissioner-established audit/certification requirements, system compliance with them, processing solely for human-defined/approved purposes, and appointment of an Autonomous Systems Officer.

    Risk management · Applies to: Deployer · DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems)
  • 10.1.1(d) / 10.3.3(d)

    The deployer or operator of a system engaged in High Risk Processing Activities must appoint an Autonomous Systems Officer with competencies, status, role and tasks substantially similar to a Data Protection Officer under Articles 17-18 of the DIFC Data Protection Law.

    Other · Applies to: Deployer · DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems)
  • 10.3.3(d)

    Both the Deployer and the Operator of a System engaged in High Risk Processing Activities must appoint an Autonomous Systems Officer with DPO-equivalent competencies, status, role and tasks.

    Other · Applies to: Deployer · DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems)
  • 5.1.6; Reg 10.3.3

    A System used for High Risk Processing Activities may only be certified by an Accredited Certification Body; certification is system-specific, not entity-specific.

    Conformity assessment · Applies to: Notified body

Milestones

  • DIFC Regulation 10 full enforcement Met
    DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
Claims and evidence (19)

  • Commercial use of a System for High Risk Processing Activities under DIFC Regulation 10 is prohibited unless Commissioner certification/audit requirements are met and an Autonomous Systems Officer is appointed.

    Confidence: Probable (capped: best source is T3) · As of 7 Sep 2023 · Evidenced
    Evidence and sources
    • Directors' Institute T3 · Retrieved · retrieved 4 Nov 2026providing data subjects with a clear and explicit notice in accordance with the updated regulations that covers the potential impact

  • DIFC Regulation 10 brings AI and autonomous/semi-autonomous systems within scope whenever they process personal data.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Middle East AI News T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

  • DIFC Regulation 10.1.1(a) defines 'System' broadly to capture any machine-based autonomous or semi-autonomous system processing personal data, with the Deployer treated as controller and the Operator as processor.

    Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • Virtual Data Protection Officer (vdpo.org) T3 · Retrieved · retrieved 4 Nov 2026A financial institution should have appropriate governance structures to support sound development and usage of algorithm driven solutions

  • DIFC Regulation 10 reached full enforcement of its audit and certification requirements in January 2026.

    Confidence: Probable (capped: best source is T3) · As of 1 Jan 2026 · Evidenced
    Evidence and sources
    • The Leveraged Years T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

  • The PDPL's automated-processing and profiling duties apply extraterritorially to controllers/processors both inside and outside the UAE where UAE data subjects are involved.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources

  • ADGM Regulation 20 gives data subjects a right not to be subject to a solely-automated decision with legal or similarly significant effect, requiring written notice and reconsideration.

    Confidence: Probable · As of 14 Feb 2021 · Evidenced
    Evidence and sources
    • Abu Dhabi Global Market (ADGM) T1 · Surfaced · retrieved 4 Nov 2026The Data Subject has the right not to be subject to a decision based solely on automated Processing, including Profiling, which produces legal effects

  • Commercial high-risk AI processing in the DIFC requires Commissioner certification and an appointed Autonomous Systems Officer.

    Confidence: Probable (capped: best source is T3) · As of 7 Sep 2023 · Evidenced
    Evidence and sources
    • Latham & Watkins T3 · Retrieved · retrieved 4 Nov 2026Regulation 10 prohibits the commercial use of Systems to engage in such high risk processing

  • DIFC Regulation 10 requires appointment of an Autonomous Systems Officer for high-risk System deployment, which may be combined with the DPO role.

    Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • Reconn Orbit T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

  • DIFC Regulation 10 requires Systems impacting data subjects to be designed for ethicality, fairness, transparency, security and accountability.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • LexNova T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

  • An Accredited Certification Body certifies individual Systems, not entities, against Regulation 10.3.3's high-risk-processing requirements.

    Confidence: Probable · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 4 Nov 2026An Accredited Certification Body shall assess that the Systems used for High Risk Processing is or will be monitored by an Automated Systems Officer

  • DIFC Regulation 10 moved to full enforcement of its audit and certification requirements on 1 January 2026.

    Confidence: Probable (capped: best source is T3) · As of 1 Jan 2026 · Evidenced
    Evidence and sources
    • Middle East AI News T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

  • DIFC Regulation 10, governing personal data processed through autonomous and semi-autonomous AI systems, took effect on 1 September 2023.

    Confidence: Probable · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Surfaced · retrieved 11 Nov 2026The updated DIFC Data Protection Regulations enacted on September 1, 2023, include Regulation 10 on Processing Personal Data

  • Derived: Probable A July 2025 amendment to the DIFC Data Protection Law raised the maximum fine for failing to carry out a DPIA before High Risk Processing Activities from USD 20,000 to USD 50,000.

    Confidence: Probable · As of 15 Jul 2025 · Evidenced
    Evidence and sources
    • Baker McKenzie (Connect on Tech) T3 · Retrieved · retrieved 1 Jul 2025failure to carry out a data protection impact assessment ("DPIA") prior to conducting high risk processing activities in accordance with Article 20: maximum fine increased from USD 20,000 to USD 50,000
    • DIFC Authority T1 · Retrieved · retrieved 11 Nov 2026Schedule 2 contains a list of administrative fines that may be issued under Article 62(2) of this Law

  • DIFC Regulation 10.1.1 restricts commercial use of an autonomous or semi-autonomous system for High-Risk Processing Activities unless the controller or processor first assesses, documents and mitigates privacy risk.

    Confidence: Probable (capped: best source is T3) · As of 14 Jan 2026 · Evidenced
    Evidence and sources
    • Clyde & Co T3 · Retrieved · retrieved 14 Jan 2026These activities (discussed in more detail below) include processing involving: (i) the adoption of new technologies or methods

  • A deployer or operator of an autonomous or semi-autonomous system used commercially for High-Risk Processing must appoint an Autonomous Systems Officer with competencies substantially similar to a Data Protection Officer.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • ETO Agora T3 · Retrieved · retrieved 11 Nov 202610.3.4 For the purposes of Regulation 10 and the Law:12 (a) a Deployer of a System shall be deemed to act as a Controller

  • Commercial use of a system for High Risk Processing Activities under DIFC Regulation 10.3.3 is prohibited unless four cumulative conditions are met, including Commissioner-established certification requirements and appointment of an Autonomous Systems Officer.

    Confidence: Probable · As of 7 Sep 2023 · Evidenced
    Evidence and sources
    • Clyde & Co T3 · Retrieved · retrieved 7 Sep 2023On 7 September 2023, the Dubai International Financial Centre (DIFC) announced that it had enacted amendments to its Data Protection Regulations
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 11 Nov 202610.2 Obligations of Deployers and Operators of Systems 10.2.1 Without limiting any other provision in this Regulation 10, where Personal Data is Processed for use in, or

  • DIFC opened a 30-day public consultation (closing 18 July 2026) proposing amendments to Regulation 10 and a new Regulation 11 establishing an accreditation and certification framework for AI systems.

    Confidence: Probable (capped: best source is T1) · As of 18 Jun 2026 · Evidenced
    Evidence and sources
    • Hadef & Partners T3 · Retrieved · retrieved 11 Nov 2026The proposed changes focus principally on Regulation 10, which addresses Personal Data processed by autonomous and semi-autonomous systems, and introduce a new Regulation 11
    • DIFC Authority T1 · Surfaced · retrieved 18 Jun 2026The DP Regulations were updated in 2023 to introduce safeguards for the rapidly expanding use of Personal Data in advanced, AI enabled Systems

  • DIFC Regulation 10 requires Deployers and Operators of high-risk AI Systems to appoint an Autonomous Systems Officer with DPO-equivalent competencies.

    Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • ETO Agora T3 · Retrieved · retrieved 11 Nov 202610.3.4 For the purposes of Regulation 10 and the Law:12 (a) a Deployer of a System shall be deemed to act as a Controller

  • A high-risk-processing System in DIFC may only be certified by an Accredited Certification Body under Regulation 10's certification framework.

    Confidence: Probable · As of 27 Aug 2024 · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 11 Nov 2026An Applicant Accredited Certification Body must demonstrate that decisions shall be accessible and easily understood, as well as made publicly available

#

Nothing recorded for this module in the research of 2026-11-11.

0 instruments · 0 obligations · 0 claims

#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

4 instruments (4 current) · 3 obligations · 6 claims · 1 milestone

Standing sub-brief · as of 12 Nov 2026 155 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Binding law in force: DIFC Regulation 10.2 requires Deployers and Operators to give data subjects clear notice of System use, the processing logic and purpose, and the System's potential impact on their rights. Separately, Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, Article 40, treats AI-enabled deepfake fraud as Cyber Fraud, carrying a minimum of one year's imprisonment and/or a fine of AED 250,000 to AED 1,000,000 per offence; the Article imposes no separate, AI-specific duty to label synthetic media.

Regulatory expectations: Joint guidelines from the Central Bank of the UAE, the Securities and Commodities Authority, the Dubai Financial Services Authority and the ADGM Financial Services Regulatory Authority expect financial institutions using Big Data Analytics and AI to inform customers of such use. The Central Bank of the UAE's Guidance Note on AI/ML further expects licensed financial institutions to disclose AI/ML use in plain, accurate, bilingual language, supported by multilingual telephone channels.

Instruments (4)
  • DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01
    Binding
  • DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems) In force since 2023-09-01
    Binding
  • Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes In force since 2022-01-02
    Binding
  • Guidelines for Financial Institutions Adopting Enabling Technologies Published 2021-11-15
    Regulatory expectation

Obligations

  • 10.2

    Notice to data subjects covering System use, processing logic/purpose and potential rights impact.

    Transparency disclosure · Applies to: Deployer · DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
  • Article 40

    Use of technology including AI deepfakes to defraud is criminalised as Cyber Fraud, minimum one year imprisonment and/or AED 250,000-1,000,000 fine.

    Prohibition · Applies to: Other · Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes
  • §2

    The non-binding CBUAE Guidance Note sets principles for licensed financial institutions on governance, fairness/non-discrimination, transparency/explainability, human oversight, and data management/privacy for AI and ML systems.

    Applies to: Other · CBUAE Guidance Note on Consumer Protection and the Responsible Adoption and Use of AI and ML by Licensed Financial Institutions

Milestones

  • DIFC Regulation 10 full enforcement Met
    DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
Claims and evidence (6)

  • DIFC Regulation 10.2 requires deployers and operators to give data subjects clear notice of autonomous-system processing, its logic and purpose, and potential impact on rights.

    Confidence: Probable · Evidenced
    Evidence and sources
    • Central Bank of the UAE T1 · Surfaced · retrieved 4 Nov 2026There is currently no dedicated AI law in force in the United Arab Emirates.

  • The CBUAE Guidance Note on AI/ML expects licensed financial institutions to disclose AI/ML use in plain, accurate, bilingual language with multilingual telephone support.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • GCC Business and Data Intelligence (GCCBDI) T3 · Retrieved · retrieved 4 Nov 2026Senior management and Boards of Directors bear responsibility and accountability for AI/ML systems, outcomes, model selection, deployment

  • Joint CBUAE/SCA/DFSA/FSRA guidelines expect financial institutions using Big Data Analytics and AI to inform customers of such use.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • obgulf.com T3 · Retrieved · retrieved 4 Nov 2026Ensure Customers are informed of Products and/or Services that utilise Big Data Analytics

  • Derived: Probable Federal Decree-Law No. 34 of 2021, Article 40, treats AI-enabled deepfake fraud as Cyber Fraud, carrying a minimum one year's imprisonment and/or a fine of AED 250,000 to AED 1,000,000 per offence, with no separate duty to label synthetic media.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Baker McKenzie (Global Compliance News) T3 · Retrieved · retrieved 4 Nov 2026Article 40 of the UAE Cybercrimes Law, considers this “Cyber Fraud”, which carries a minimum of one year’s imprisonment

  • DIFC Regulation 10 requires a clear notice to data subjects on System use, processing logic/purpose and rights impact.

    Confidence: Probable (capped: best source is T3) · As of 1 Jan 2025 · Evidenced
    Evidence and sources
    • Directors' Institute T3 · Retrieved · retrieved 4 Nov 2026providing data subjects with a clear and explicit notice in accordance with the updated regulations that covers the potential impact

  • Derived: Probable UAE Cybercrime Law Article 40 criminalises AI-enabled deepfake fraud with imprisonment and a fine of AED 250,000-1,000,000, but imposes no AI-specific synthetic-media labelling duty.

    Confidence: Probable (capped: best source is T3) · As of 4 Jul 2024 · Evidenced
    Evidence and sources
    • Baker McKenzie (Global Compliance News) T3 · Retrieved · retrieved 4 Nov 2026Article 40 of the UAE Cybercrimes Law, considers this “Cyber Fraud”, which carries a minimum of one year’s imprisonment

#

The UAE Copyright Law makes no provision for AI authorship or computer-generated works, because its Article 1 defines an Author as a person who creates a work.

0 instruments (0 current) · 0 obligations · 2 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 39 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Binding law in force: The UAE Copyright Law makes no provision for AI authorship or computer-generated works. Its Article 1 defines an 'Author' as a person who creates a work, a definition that excludes machine-generated output from authorship protection.

Cited evidence in this module rests solely on tier 3/4 commentary despite primary official sources existing for this jurisdiction.

Claims and evidence (2)

  • Derived: Probable The UAE Copyright Law makes no provision for AI authorship or computer-generated works, because its Article 1 defines an Author as a person who creates a work.

    Confidence: Probable (capped: best source is T3) · As of 30 Sep 2025 · Evidenced
    Evidence and sources
    • LexNova T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

  • The UAE Copyright Law makes no provision for AI authorship or computer-generated works, since 'Author' is defined as a person who creates a work.

    Confidence: Probable (capped: best source is T3) · As of 30 Sep 2025 · Evidenced
    Evidence and sources
    • LexNova T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

#

ADGM FSRA Guidance – Chapter 14, Algorithm Driven Solutions (Date not recorded).

4 instruments (4 current) · 5 obligations · 12 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 318 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Binding law in force: Federal Decree-Law No. 45 of 2021 (PDPL) Article 18 grants data subjects a right to object to automated-processing decisions with legal or adverse impact, with a right to human review on request, and Article 21(a) requires a Data Protection Impact Assessment before systematic automated or profiling assessments with legal consequences or serious impact. DIFC Regulation 10 applies to any autonomous or semi-autonomous System processing personal data in the financial free zone, treating the Deployer as controller-equivalent and the Operator as processor-equivalent. At emirate level, Abu Dhabi Law No. (3) of 2024 establishes the Artificial Intelligence and Advanced Technology Council (AIATC) to regulate AI and advanced-technology activity.

Instruments (4)
  • ADGM FSRA Guidance – Chapter 14, Algorithm Driven Solutions Date not recorded
    Regulatory expectation
  • CBUAE Guidance Note on Consumer Protection and the Responsible Adoption and Use of AI and ML by Licensed Financial Institutions Date not recorded
    Regulatory expectation
  • CBUAE Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E. Published 2026-02-11
    Regulatory expectation
  • Dubai AI Seal Published 2025-10-19; valid from 2025-01-01
    Non-binding

Obligations

  • Article 18

    Right to object to automated-decision outcomes with legal/adverse impact, with human review on request.

    Other · Applies to: Other · UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
  • Article 21(a)

    DPIA required before systematic automated/profiling assessment with legal consequences or serious impact.

    Fundamental rights impact assessment · Applies to: Other · UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
  • §2

    The non-binding CBUAE Guidance Note sets principles for licensed financial institutions on governance, fairness/non-discrimination, transparency/explainability, human oversight, and data management/privacy for AI and ML systems.

    Applies to: Other · CBUAE Guidance Note on Consumer Protection and the Responsible Adoption and Use of AI and ML by Licensed Financial Institutions
  • n/a

    CBUAE Guidance Note sets non-binding principles for licensed financial institutions on AI/ML governance, fairness, transparency, human oversight and data privacy.

    Other · Applies to: Other · UAE Charter for the Development and Use of Artificial Intelligence
  • Fairness and Non-Discrimination/Ethics principle

    Licensed financial institutions must not deploy or continue to use an AI/ML system that is discriminatory or manipulative.

    Risk management · Applies to: Deployer · CBUAE Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.
Claims and evidence (12)

  • The CBUAE's non-binding Guidance Note requires licensed financial institutions to maintain effective human oversight of AI/ML systems, particularly for decisions with significant consumer implications.

    Confidence: Probable (capped: best source is T3) · As of 11 Feb 2026 · Evidenced
    Evidence and sources
    • The Middle East Insider T3 · Retrieved · retrieved 4 Nov 2026If the processing includes a systematic and comprehensive assessment of the personal aspects of the Data Subject, using automated processing

  • Abu Dhabi Law No. (3) of 2024 establishes the AIATC to regulate AI and advanced-technology activity in the emirate.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Latham & Watkins T3 · Retrieved · retrieved 4 Nov 2026The UAE Council for Artificial Intelligence and Blockchain, established in February 2018, promotes cross-sector AI adoption

  • The CBUAE Guidance Note sets non-binding principles for licensed financial institutions' use of AI and ML systems, covering governance, fairness, transparency, human oversight and data privacy.

    Confidence: Probable · Evidenced
    Evidence and sources
    • Central Bank of the UAE T1 · Surfaced · retrieved 4 Nov 2026Guidance Note outlines principals and guidelines for the use of Artificial Intelligence (AI) systems and Machine Learning (ML) technologies

  • DIFC Regulation 10 applies to any autonomous or semi-autonomous System that processes personal data, with the Deployer as controller-equivalent and the Operator as processor-equivalent.

    Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · Evidenced
    Evidence and sources
    • LexNova T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

  • UAE PDPL Article 18 grants data subjects a right to object to automated-processing decisions with legal or adverse impact, with a right to human review on request.

    Confidence: Probable (capped: best source is T3) · As of 20 Sep 2021 · Evidenced
    Evidence and sources
    • Legal Advice Middle East T3 · Retrieved · retrieved 4 Nov 2026The Data Subject has the right to object to decisions issued with respect to Automated Processing that have legal consequences

  • UAE PDPL Article 21(a) requires a DPIA before systematic automated/profiling assessments with legal or serious impact.

    Confidence: Probable (capped: best source is T3) · As of 20 Sep 2021 · Evidenced
    Evidence and sources
    • The Middle East Insider T3 · Retrieved · retrieved 4 Nov 2026If the processing includes a systematic and comprehensive assessment of the personal aspects of the Data Subject, using automated processing

  • CBUAE's Guidance Note on AI/ML places board-level accountability for AI/ML systems on licensed financial institutions.

    Confidence: Probable · As of 1 Feb 2026 · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 4 Nov 2026Senior management and Boards of Directors bear responsibility and accountability for AI/ML systems, outcomes, model selection, deployment

  • CBUAE guidance cautions against fully automated AI/ML decision-making lacking human oversight, except for low-risk non-material processes.

    Confidence: Probable (capped: best source is T3) · As of 11 Feb 2026 · Evidenced
    Evidence and sources
    • The Leveraged Years T3 · Retrieved · retrieved 4 Nov 2026the guidance cautions that the latter approach should only be taken for “low-risk, non-material processes with appropriate controls in place”

  • ADGM FSRA guidance expects financial institutions to maintain governance structures for algorithm-driven solutions.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Virtual Data Protection Officer (vdpo.org) T3 · Retrieved · retrieved 4 Nov 2026A financial institution should have appropriate governance structures to support sound development and usage of algorithm driven solutions

  • The Dubai AI Seal is a mandatory certification for AI companies seeking Dubai/UAE government project partnerships, distinct from a general business licence.

    Confidence: Probable · As of 1 Jan 2025 · Evidenced
    Evidence and sources

  • CBUAE's AI/ML guidance note requires LFIs to avoid discriminatory/manipulative AI and holds senior management and the Board accountable for AI/ML outcomes.

    Confidence: Confirmed · As of 11 Feb 2026 · Evidenced
    Evidence and sources

  • The Dubai AI Seal is a voluntary AI certification programme that Dubai government entities are directed to require of their AI service suppliers.

    Confidence: Probable · As of 19 Oct 2025 · Evidenced
    Evidence and sources
    • Dubai Future Foundation T1 · Retrieved · retrieved 11 Nov 2026Dubai Centre for Artificial Intelligence has announced strong global interest for "Dubai AI Seal", the city's first-of-its-kind certification programme

#

Commercial use of a System for High Risk Processing Activities under DIFC Regulation 10 is prohibited unless Commissioner certification/audit requirements are met and an Autonomous Systems Officer is appointed.

0 instruments (0 current) · 0 obligations · 1 claim · 0 milestones

Standing sub-brief · as of 12 Nov 2026 47 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Binding law in force: Commercial use of a System for High Risk Processing Activities under DIFC Regulation 10 is prohibited unless Commissioner certification and audit requirements are met and an Autonomous Systems Officer is appointed, embedding a pre-deployment safety-assurance gate for high-risk AI processing in the DIFC.

Cited evidence in this module rests solely on tier 3/4 commentary despite primary official sources existing for this jurisdiction.

Claims and evidence (1)

  • Commercial use of a System for High Risk Processing Activities under DIFC Regulation 10 is prohibited unless Commissioner certification/audit requirements are met and an Autonomous Systems Officer is appointed.

    Confidence: Probable (capped: best source is T3) · As of 7 Sep 2023 · Evidenced
    Evidence and sources
    • Directors' Institute T3 · Retrieved · retrieved 4 Nov 2026providing data subjects with a clear and explicit notice in accordance with the updated regulations that covers the potential impact

#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

3 instruments (3 current) · 1 obligation · 10 claims · 1 milestone

Standing sub-brief · as of 12 Nov 2026 225 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Binding law in force: DIFC Regulation 10.3.3 prohibits commercial use of a System for High Risk Processing Activities unless certification, purpose-limitation and Autonomous Systems Officer conditions are satisfied, and Regulation 10.3.1 requires Systems impacting data subjects to be designed in accordance with ethicality, fairness, transparency, security and accountability principles. Regulation 10.3.3(d) requires appointment of an Autonomous Systems Officer for high-risk processing deployments, a role that may be combined with the Data Protection Officer function. Certification under Regulation 10 is system-specific, not entity-specific, and may only be issued by a DIFC Accredited Certification Body, which must assess whether the System is or will be monitored by an Autonomous Systems Officer and satisfies Regulation 10.3.3's requirements before certifying. Regulation 10's audit and certification requirements reached full enforcement on 1 January 2026.

Pending reform: The DIFC has opened a 30-day public consultation, closing 18 July 2026, proposing amendments to Regulation 10 and a new Regulation 11 establishing an accreditation and certification framework for AI systems.

Instruments (3)
  • DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01
    Binding
  • DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems) In force since 2023-09-01
    Binding
  • Dubai AI Seal Published 2025-10-19; valid from 2025-01-01
    Non-binding

Obligations

  • 5.1.6; Reg 10.3.3

    A System used for High Risk Processing Activities may only be certified by an Accredited Certification Body; certification is system-specific, not entity-specific.

    Conformity assessment · Applies to: Notified body

Milestones

  • DIFC Regulation 10 full enforcement Met
    DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
Claims and evidence (10)

  • DIFC Regulation 10.3.3 prohibits commercial use of a System for High Risk Processing Activities unless certification, purpose-limitation and Autonomous Systems Officer conditions are satisfied.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Directors' Institute T3 · Retrieved · retrieved 4 Nov 2026providing data subjects with a clear and explicit notice in accordance with the updated regulations that covers the potential impact

  • DIFC Regulation 10.3.3(d) requires appointment of an Autonomous Systems Officer for high-risk processing deployments, with dual-hatting with the DPO permitted.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • The Leveraged Years T3 · Retrieved · retrieved 4 Nov 2026the guidance cautions that the latter approach should only be taken for “low-risk, non-material processes with appropriate controls in place”

  • DIFC Regulation 10.3.1 requires Systems impacting data subjects to be designed in accordance with ethicality, fairness, transparency, security and accountability principles.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Virtual Data Protection Officer (vdpo.org) T3 · Retrieved · retrieved 4 Nov 2026A financial institution should have appropriate governance structures to support sound development and usage of algorithm driven solutions

  • A DIFC Accredited Certification Body must assess whether a high-risk System is or will be monitored by an Autonomous Systems Officer and meets Regulation 10.3.3's requirements before issuing system-specific certification.

    Confidence: Probable · Evidenced
    Evidence and sources
    • Abu Dhabi Global Market (ADGM) T1 · Surfaced · retrieved 4 Nov 2026There is no horizontal AI Act with prohibited uses or risk-tier conformity assessments

  • DIFC Regulation 10 reached full enforcement of its audit and certification requirements in January 2026.

    Confidence: Probable (capped: best source is T3) · As of 1 Jan 2026 · Evidenced
    Evidence and sources
    • The Leveraged Years T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

  • An Accredited Certification Body certifies individual Systems, not entities, against Regulation 10.3.3's high-risk-processing requirements.

    Confidence: Probable · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 4 Nov 2026An Accredited Certification Body shall assess that the Systems used for High Risk Processing is or will be monitored by an Automated Systems Officer

  • The Dubai AI Seal is a mandatory certification for AI companies seeking Dubai/UAE government project partnerships, distinct from a general business licence.

    Confidence: Probable · As of 1 Jan 2025 · Evidenced
    Evidence and sources

  • DIFC opened a 30-day public consultation (closing 18 July 2026) proposing amendments to Regulation 10 and a new Regulation 11 establishing an accreditation and certification framework for AI systems.

    Confidence: Probable (capped: best source is T1) · As of 18 Jun 2026 · Evidenced
    Evidence and sources
    • Hadef & Partners T3 · Retrieved · retrieved 11 Nov 2026The proposed changes focus principally on Regulation 10, which addresses Personal Data processed by autonomous and semi-autonomous systems, and introduce a new Regulation 11
    • DIFC Authority T1 · Surfaced · retrieved 18 Jun 2026The DP Regulations were updated in 2023 to introduce safeguards for the rapidly expanding use of Personal Data in advanced, AI enabled Systems

  • A high-risk-processing System in DIFC may only be certified by an Accredited Certification Body under Regulation 10's certification framework.

    Confidence: Probable · As of 27 Aug 2024 · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 11 Nov 2026An Applicant Accredited Certification Body must demonstrate that decisions shall be accessible and easily understood, as well as made publicly available

  • The Dubai AI Seal is a voluntary AI certification programme that Dubai government entities are directed to require of their AI service suppliers.

    Confidence: Probable · As of 19 Oct 2025 · Evidenced
    Evidence and sources
    • Dubai Future Foundation T1 · Retrieved · retrieved 11 Nov 2026Dubai Centre for Artificial Intelligence has announced strong global interest for "Dubai AI Seal", the city's first-of-its-kind certification programme

#

Abu Dhabi Law No. (3) of 2024 establishing the Artificial Intelligence and Advanced Technology Council (AIATC) (In force since 2024-01-22).

4 instruments (4 current) · 1 obligation · 13 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 289 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Binding law in force: The DIFC Commissioner of Data Protection may issue administrative fines up to the maxima set out in DIFC Data Protection Law Schedule 2, of roughly USD 10,000 to USD 100,000 per contravention, for breaches including of Regulation 10. A July 2025 amendment to the DIFC Data Protection Law raised the maximum fine specifically for failing to carry out a Data Protection Impact Assessment before High Risk Processing Activities from USD 20,000 to USD 50,000, and Regulation 10's audit and certification requirements reached full enforcement on 1 January 2026. At emirate level, Abu Dhabi Law No. (3) of 2024 establishes the Artificial Intelligence and Advanced Technology Council (AIATC) as a binding emirate-level AI regulatory and investment body.

Instruments (4)
  • Abu Dhabi Law No. (3) of 2024 establishing the Artificial Intelligence and Advanced Technology Council (AIATC) In force since 2024-01-22
    Binding
  • DIFC Data Protection Law No. 5 of 2020 In force since 2020-07-01
    Binding
  • Federal Decree-Law No. 45 of 2021 (PDPL) Valid from 2022-01-02
    Binding
  • UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) In force since 2022-01-02
    Binding

Obligations

  • Article 18(1)

    A data subject has the right to object to decisions issued with respect to automated processing, including profiling, particularly where such decisions have legal impact on or seriously/adversely affect the data subject.

    Applies to: Other · UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
Claims and evidence (13)

  • The UAE Cabinet approved establishing a federal Artificial Intelligence and Data Authority on 14 June 2026, merging the AI Office, the UAE Data Office and TDRA digital functions.

    Confidence: Uncertain (capped: best source is T3) · As of 14 Jun 2026 · Evidenced
    Evidence and sources
    • Reconn Orbit T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

  • The DIFC Commissioner may issue administrative fines up to the maxima in DIFC DPL Schedule 2, roughly USD 10,000-100,000 per contravention, for breaches including of Regulation 10.

    Confidence: Probable · As of 1 Jul 2020 · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 4 Nov 2026An Accredited Certification Body shall assess that the Systems used for High Risk Processing is or will be monitored by an Automated Systems Officer

  • The Cabinet decision specifying PDPL violations and penalties under Article 26 could not be confirmed as published in the Official Gazette, notwithstanding widely circulated unverified figures.

    Confidence: Disputed (capped: best source is T3) · As of 1 Sep 2026 · Evidenced
    Evidence and sources
    • Legal Advice Middle East T3 · Retrieved · retrieved 4 Nov 2026The Data Subject has the right to object to decisions issued with respect to Automated Processing that have legal consequences

  • Derived: Probable A UAE federal Artificial Intelligence and Data Authority was reportedly approved on 14 June 2026, merging the AI Office, UAE Data Office and TDRA digital functions, but no establishing instrument has been verified at a primary source.

    Confidence: Uncertain (capped: best source is T3) · Not evidenced
    Evidence and sources
    • Reconn Orbit T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

  • The UAE Council for Artificial Intelligence and Blockchain is a non-statutory coordination body established in February 2018.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Latham & Watkins T3 · Retrieved · retrieved 4 Nov 2026The UAE Council for Artificial Intelligence and Blockchain, established in February 2018, promotes cross-sector AI adoption

  • DIFC DPL Schedule 2 caps most per-contravention administrative fines at roughly USD 10,000-100,000, including for Regulation 10 (AI) failures such as missing a required DPIA before high-risk processing.

    Confidence: Probable · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 4 Nov 2026An Accredited Certification Body shall assess that the Systems used for High Risk Processing is or will be monitored by an Automated Systems Officer

  • No Cabinet decision fixing PDPL Article 26 penalty amounts for AI-relevant automated-decision and DPIA duties could be confirmed as published, so stated fine figures circulating in secondary sources are unverified.

    Confidence: Uncertain (capped: best source is T3) · As of 1 Sep 2026 · Evidenced
    Evidence and sources
    • Legal Advice Middle East T3 · Retrieved · retrieved 4 Nov 2026The Data Subject has the right to object to decisions issued with respect to Automated Processing that have legal consequences

  • Derived: Probable A federal Artificial Intelligence and Data Authority (AIDA) was reported approved in June 2026, but no founding instrument has yet been published.

    Confidence: Uncertain (capped: best source is T3) · As of 14 Jun 2026 · Evidenced
    Evidence and sources
    • artificialintelligenceregulations.com T3 · Retrieved · retrieved 4 Nov 2026A federal Artificial Intelligence and Data Authority was approved on June 14, 2026, merging the AI Office, the UAE Data Office

  • Abu Dhabi Law No. (3) of 2024 establishes the AIATC as a binding emirate-level AI regulatory and investment body.

    Confidence: Probable · Evidenced
    Evidence and sources
    • Law Library of Congress T2 · Surfaced · retrieved 4 Nov 2026the Government of the Emirate of Abu Dhabi enacted Law No. (3) of 2024, to establish the

  • DIFC Regulation 10 moved to full enforcement of its audit and certification requirements on 1 January 2026.

    Confidence: Probable (capped: best source is T3) · As of 1 Jan 2026 · Evidenced
    Evidence and sources
    • Middle East AI News T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

  • Derived: Probable A July 2025 amendment to the DIFC Data Protection Law raised the maximum fine for failing to carry out a DPIA before High Risk Processing Activities from USD 20,000 to USD 50,000.

    Confidence: Probable · As of 15 Jul 2025 · Evidenced
    Evidence and sources
    • Baker McKenzie (Connect on Tech) T3 · Retrieved · retrieved 1 Jul 2025failure to carry out a data protection impact assessment ("DPIA") prior to conducting high risk processing activities in accordance with Article 20: maximum fine increased from USD 20,000 to USD 50,000
    • DIFC Authority T1 · Retrieved · retrieved 11 Nov 2026Schedule 2 contains a list of administrative fines that may be issued under Article 62(2) of this Law

  • On 14 June 2026 the UAE announced establishment of a new federal Artificial Intelligence and Data Authority to unify oversight of AI, data governance and digital government.

    Confidence: Probable (capped: best source is T3) · As of 14 Jun 2026 · Evidenced
    Evidence and sources
    • Al Tamimi & Company T3 · Surfaced · retrieved 11 Nov 2026there is currently no standalone federal AI law regulating the development, deployment or use of AI systems

  • Derived: Probable The PDPL's administrative penalty regime remains inoperative because the Cabinet decision specifying violations and penalties under Article 26 has not been published.

    Confidence: Probable (capped: best source is T3) · As of 1 Oct 2026 · Evidenced
    Evidence and sources
    • Trustable T3 · Retrieved · retrieved 11 Nov 2026The Decree-Law leaves violations and administrative penalties to a Cabinet decision under Article 26.

#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

1 instrument (1 current) · 0 obligations · 1 claim · 1 milestone

Standing sub-brief · as of 12 Nov 2026 25 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Regulatory expectations: The DIFC Commissioner of Data Protection operates the Regulation 10 Accelerator, a sandbox enabling testing of autonomous Systems against Regulation 10's privacy-by-design requirements.

Instruments (1)
  • DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01
    Binding

Milestones

  • DIFC Regulation 10 full enforcement Met
    DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
Claims and evidence (1)

  • The DIFC Commissioner operates the Regulation 10 Accelerator, a sandbox for testing autonomous Systems against Regulation 10's privacy-by-design requirements.

    Confidence: Probable (capped: best source is T3) · Evidenced
    Evidence and sources
    • Reconn Orbit T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

#

Over 325 companies had applied for the Dubai AI Seal as of Dubai AI Week 2025.

0 instruments (0 current) · 1 obligation · 2 claims · 0 milestones

Standing sub-brief · as of 12 Nov 2026 70 words · last cycle 11 Nov 2026 · AI research, not expert reviewed

Non-binding framework with binding procurement effect: By Dubai AI Week 2025, over 325 companies had applied for the Dubai AI Seal, the voluntary six-tier (E to S) certification programme for AI companies licensed in Dubai. Since October 2025, Dubai government entities have been directed to work only with Seal-certified AI suppliers on government AI projects, making certification a commercial precondition for public-sector AI contracting rather than a general market-entry requirement.

Obligations

  • general

    The Dubai AI Seal certification (six tiers, E to S) is required for companies selected as partners on UAE/Dubai government AI projects; an October 2025 Dubai Department of Finance directive requires government entities to work only with certified AI suppliers.

    Applies to: Other · Dubai AI Seal
Claims and evidence (2)

  • Over 325 companies had applied for the Dubai AI Seal as of Dubai AI Week 2025.

    Confidence: Probable · As of 1 Jan 2025 · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 4 Nov 2026Senior management and Boards of Directors bear responsibility and accountability for AI/ML systems, outcomes, model selection, deployment

  • Over 325 companies applied for the Dubai AI Seal by Dubai AI Week 2025, and since October 2025 Dubai government entities are directed to work only with certified AI suppliers.

    Confidence: Probable · Evidenced
    Evidence and sources
    • DIFC Commissioner of Data Protection T1 · Retrieved · retrieved 4 Nov 2026Senior management and Boards of Directors bear responsibility and accountability for AI/ML systems, outcomes, model selection, deployment
No modules match.

Filters combine as OR inside a group and AND across groups.

Authorities

AuthorityType
UAE CabinetRegulator
Artificial Intelligence and Advanced Technology Council (AIATC), Abu DhabiRegulator
UAE Council for Artificial Intelligence and BlockchainRegulator
DIFC Commissioner of Data ProtectionRegulator
Central Bank of the UAERegulator
ADGM Financial Services Regulatory AuthorityRegulator
Federal Artificial Intelligence and Data AuthorityRegulator
DIFC Commissioner of Data ProtectionRegulator
Artificial Intelligence and Advanced Technology CouncilRegulator
Central Bank of the UAERegulator
Artificial Intelligence and Data AuthorityRegulator
Federal Authority for Artificial Intelligence and DataAi office
DIFC Commissioner of Data ProtectionData protection authority

Enforcement actions

No enforcement actions recorded in this research.

Cases

No cases recorded in this research.

Consultations

ConsultationAuthorityStatusOpenedCloses
DIFC Consultation Paper No. 3/2026 – proposed amendments to Regulation 10 and new Regulation 11DIFC Commissioner of Data ProtectionClosed

What this record does not yet establish is set out on the transparency register; its dated events are on the regulatory calendar.

Think something on this page is wrong? Report an error.

Technical provenance (record schema, run ID & build metadata)
Schema version
artificial-intelligence-record-v2.12
Research run ID
aic-union-AE-2026-11-04
Page model
module-card-page-v1
Renderer
render_jid_aic_v13
Build date