---
title: "United Arab Emirates — Global AI Monitor"
canonical: https://artificial-intelligence.gi/jurisdictions/united-arab-emirates/
source_html: /jurisdictions/united-arab-emirates/index.html
description: "United Arab Emirates AI governance record: 15 instruments, 16 obligations and 68 evidenced claims across 12 modules. Research as of 11 Nov 2026."
generated_at: 2026-11-12T17:20:02Z
content_sha256: 2cb66b0993acc85b3244f3aebff0002cbc77c35a7e302ccef22ef8f8c14e4d83
generator: "fe-fleet/md-twin@1.0"
---
# United Arab Emirates AI Regulation & Governance

10 active modules 2 quiet

Last updated 11 Nov 2026 · 12 modules · 15 instruments · 68 claims · 58 sources in the cumulative register

Download report (PDF) Collapse all

Framework status DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

Main regulator Regulator [Office of the Minister of State for Artificial Intelligence, Digital Economy and Remote Work Applications; from 14 June 2026 consolidated into the new federal Artificial Intelligence and Data Authority](https://ai.gov.ae/)

Next milestone 31 Dec 2027 : Expected federal AI law issuance ([01 AI Framework Law](#sec-mod-ai_framework_law))

Record status Live · Periodic active record · 58 sources (46 retrieved) · 8 under review · Not yet expert-reviewed

✦ AI-assembled from cited sources

Evidence-gated · [How we verify](/methodology/#ai-content-disclosure) · Disclosure Not yet expert-reviewed · Not legal, compliance or investment advice. Facts are machine-assembled from cited public sources. Individual claims have not each been independently verified by a human reviewer. See [methodology](/methodology/).

Source tiers: T1 enacted statute, regulation, or binding supervisory order · T2 official regulator guidance, consultation, or registry · T3 international standard-setter or peer-reviewed analysis · T4 practitioner commentary or secondary reporting. Confidence: high = corroborated by retrieved T1/T2 text · medium = single official source or secondary corroboration · low = preliminary or unverified. [Full definitions →](/methodology/#source-tiers)

Research checked 11 Nov 2026 · Updated 11 Nov 2026 Record history Research as of 11 Nov 2026 · Record last changed 11 Nov 2026 · Published 11 Nov 2026 · Page built 12 Nov 2026

15 Instruments

14 Current instruments

7 Binding, in force +1 more binding, in-force date not recorded

16 Obligations

68 Claims

1 Upcoming milestones

58 Sources

## Next milestones in this record

- 31 Dec 2027Expected federal AI law issuance Scheduled · [01 AI Framework Law](#sec-mod-ai_framework_law)

Jump to module (12)

### 01AI Framework LawActive Derived: Probable▾#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

4 instruments (4 current) · 1 obligation · 17 claims · 2 milestones · Next: 31 Dec 2027 (Expected federal AI law issuance)

Binding law in force: DIFC Regulation 10, part of the DIFC Data Protection Regulations and the UAE's only binding, AI-specific legal instrument, took effect on 1 September 2023 and remains the one binding, AI-specific instrument currently in force in the UAE, there being no standalone federal AI statute. Regulation 10 applies to any autonomous or semi-autonomous System that processes personal data, treating the Deployer as controller-equivalent and the Operator as processor-equivalent, and requires Systems impacting data subjects to be designed for ethicality, fairness, transparency, security and accountability. At emirate level, Abu Dhabi Law No. (3) of 2024 establishes the Artificial Intelligence and Advanced Technology Council (AIATC) to regulate AI and advanced-technology activity in Abu Dhabi.

Non-binding frameworks and institutional developments: The UAE Charter for the Development and Use of Artificial Intelligence, issued in June 2024, sets twelve non-binding ethical principles and carries no penalty or liability regime. On 14 June 2026 the UAE Cabinet approved establishment of a federal Artificial Intelligence and Data Authority, reportedly merging the AI Office, the UAE Data Office and TDRA digital functions; this remains a reported rather than confirmed development, and no founding legal instrument had been published.

Pending developments: A comprehensive federal AI law is reported in draft with anticipated issuance in 2026 or 2027, though this timing is unconfirmed.

Standing position: As of October 2026 the UAE has no single, comprehensive federal AI Act in force; AI use onshore continues to be governed by existing law, namely the PDPL, sectoral regulators and, within the DIFC, Regulation 10, and the UAE has no horizontal federal AI Act with prohibited uses or risk-tier conformity assessment requirements as.

Read full sub-brief · 272 words

Instruments (4)
- DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01Binding
- DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems) In force since 2023-09-01Binding
- Law Establishing the Artificial Intelligence and Advanced Technology Council (AIATC) In force since 2024-01-01Binding
- UAE Charter for the Development and Use of Artificial Intelligence Published 2024-06-10; valid from 2024-07-30Non-binding

Obligations

- Article 18(1)A data subject has the right to object to decisions issued with respect to automated processing, including profiling, particularly where such decisions have legal impact on or seriously/adversely affect the data subject.Applies to: Other · UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

Milestones

- 1 Jan 2026DIFC Regulation 10 full enforcement MetDIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
- 31 Dec 2027 (Year)Expected federal AI law issuance UpcomingUAE Charter for the Development and Use of Artificial Intelligence

Claims and evidence (17)
- The UAE has no dedicated, standalone federal statute regulating artificial intelligence as such; AI is governed through sectoral and data-protection instruments plus DIFC Regulation 10.Confidence: Probable (capped: best source is T3) · As of 25 Apr 2026 · EvidencedEvidence and sources[Latham & Watkins](https://www.lw.com/en/insights/ai-in-the-uae-understanding-the-regulatory-landscape-and-key-authorities) T3 · Retrieved · retrieved 4 Nov 2026Regulation 10 prohibits the commercial use of Systems to engage in such high risk processing

- The UAE Cabinet approved establishing a federal Artificial Intelligence and Data Authority on 14 June 2026, merging the AI Office, the UAE Data Office and TDRA digital functions.Confidence: Uncertain (capped: best source is T3) · As of 14 Jun 2026 · EvidencedEvidence and sources[Reconn Orbit](https://orbit.reconn.io/difc-regulation-10-complete-guide/) T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

- The UAE Charter for the Development and Use of Artificial Intelligence is a non-binding ethical instrument issued June 2024 setting 12 principles.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Latham & Watkins](https://www.lw.com/en/insights/ai-in-the-uae-understanding-the-regulatory-landscape-and-key-authorities) T3 · Retrieved · retrieved 4 Nov 2026The UAE Council for Artificial Intelligence and Blockchain, established in February 2018, promotes cross-sector AI adoption

- Abu Dhabi Law No. (3) of 2024 establishes the AIATC to regulate AI and advanced-technology activity in the emirate.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Latham & Watkins](https://www.lw.com/en/insights/ai-in-the-uae-understanding-the-regulatory-landscape-and-key-authorities) T3 · Retrieved · retrieved 4 Nov 2026The UAE Council for Artificial Intelligence and Blockchain, established in February 2018, promotes cross-sector AI adoption

- DIFC Regulation 10 brings AI and autonomous/semi-autonomous systems within scope whenever they process personal data.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Middle East AI News](https://www.middleeastainews.com/p/325-dubai-ai-companies-certified) T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

- The UAE has no horizontal federal AI Act with prohibited uses or risk-tier conformity assessment requirements as at this cycle.Confidence: Probable (capped: best source is T3) · As of 25 Apr 2026 · EvidencedEvidence and sources[Latham & Watkins](https://www.lw.com/en/insights/ai-in-the-uae-understanding-the-regulatory-landscape-and-key-authorities) T3 · Retrieved · retrieved 4 Nov 2026Regulation 10 prohibits the commercial use of Systems to engage in such high risk processing

- DIFC Regulation 10 applies to any autonomous or semi-autonomous System that processes personal data, with the Deployer as controller-equivalent and the Operator as processor-equivalent.Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · EvidencedEvidence and sources[LexNova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

- DIFC Regulation 10 requires Systems impacting data subjects to be designed for ethicality, fairness, transparency, security and accountability.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[LexNova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

- The UAE has no horizontal federal AI Act; AI is governed through sectoral and free-zone instruments, chiefly DIFC Regulation 10.Confidence: Probable (capped: best source is T1) · As of 25 Apr 2026 · EvidencedEvidence and sources[Abu Dhabi Global Market (ADGM)](https://adgmen.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER2021.pdf) T1 · Surfaced · retrieved 4 Nov 2026There is no horizontal AI Act with prohibited uses or risk-tier conformity assessments
- [Central Bank of the UAE](https://rulebook.centralbank.ae/sites/default/files/en_net_file_store/CBUAE_EN_6958_VER1.pdf) T1 · Surfaced · retrieved 4 Nov 2026There is currently no dedicated AI law in force in the United Arab Emirates.
- [obgulf.com](https://obgulf.com/insights/uae-ai-law-business-guide) T3 · Retrieved · retrieved 4 Nov 2026There is no single "AI Act" in force in the UAE as of October 2026.

- The UAE AI Charter (June 2024) sets 12 non-binding ethical AI principles with no penalty or liability regime.Confidence: Probable (capped: best source is T3) · As of 10 Jun 2024 · EvidencedEvidence and sources[Business Dubai](https://www.businessdubai.ae/blogs/uae-pdpl-data-protection) T3 · Retrieved · retrieved 4 Nov 2026establishes principles for the ethical, transparent and responsible development and use of AI

- A comprehensive federal AI law is reported in draft with anticipated issuance in 2026 or 2027.Confidence: Uncertain · EvidencedEvidence and sources[Abu Dhabi Global Market (ADGM)](https://adgmen.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER2021.pdf) T1 · Surfaced · retrieved 4 Nov 2026There is no horizontal AI Act with prohibited uses or risk-tier conformity assessments

- As of June 2026, the UAE has no standalone federal law regulating the development, deployment or use of AI systems.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Al Tamimi & Company](https://www.tamimi.com/law_update_articles/uae-establishes-new-federal-authority-for-ai-and-data-a-significant-step-in-the-evolution-of-digital-regulation/) T3 · Surfaced · retrieved 11 Nov 2026there is currently no standalone federal AI law regulating the development, deployment or use of AI systems

- As of October 2026, the UAE has no single, comprehensive AI Act in force; AI use onshore is governed by existing law (PDPL, sectoral regulators, and DIFC Regulation 10 within the DIFC).Confidence: Probable (capped: best source is T3) · As of 8 Oct 2026 · EvidencedEvidence and sources[OBG Gulf](https://obgulf.com/insights/uae-ai-law-business-guide) T3 · Retrieved · retrieved 8 Oct 2026As of October 2026 the UAE has no single, comprehensive AI Act in force

- DIFC Regulation 10, governing personal data processed through autonomous and semi-autonomous AI systems, took effect on 1 September 2023.Confidence: Probable · As of 1 Sep 2023 · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10) T1 · Surfaced · retrieved 11 Nov 2026The updated DIFC Data Protection Regulations enacted on September 1, 2023, include Regulation 10 on Processing Personal Data

- DIFC Regulation 10 is described by legal commentary as the one binding, AI-specific legal instrument currently in force in the UAE.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[LexNova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) T3 · Retrieved · retrieved 11 Nov 2026DIFC's Regulation 10: the One Binding, AI-Specific Instrument in the UAE

- Derived: Probable On 14 June 2026 the UAE Cabinet approved creation of a federal Artificial Intelligence and Data Authority, but no founding legal instrument has been published.Confidence: Probable · As of 14 Jun 2026 · EvidencedEvidence and sources[UAE Cabinet (Media Center)](https://uaecabinet.ae/en/news/mohammed-bin-rashid-approves-establishing-artificial-intelligence-and-data-authority) T1 · Surfaced · retrieved 11 Nov 2026His Highness Sheikh Mohammed bin Rashid Al Maktoum ... has approved the establishment of the Artificial Intelligence and Data Authority.

- DIFC Regulation 10 is the only binding, AI-specific legal instrument in force in the UAE; there is no standalone federal AI statute.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[LexNova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) T3 · Retrieved · retrieved 11 Nov 2026DIFC's Regulation 10: the One Binding, AI-Specific Instrument in the UAE

### 02Prohibited PracticesQuiet▾#

Nothing recorded for this module in the research of 2026-11-11.

0 instruments · 0 obligations · 0 claims

Nothing recorded for this module in the research of 2026-11-11.

### 03High-Risk SystemsActive Derived: Probable▾#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

3 instruments (3 current) · 7 obligations · 19 claims · 1 milestone

Binding law in force: DIFC Regulation 10, which took effect on 1 September 2023, defines a 'System' broadly under Regulation 10.1.1(a) to capture any machine-based autonomous or semi-autonomous system that processes personal data, treating the Deployer as controller and the Operator as processor. Regulation 10.1.1 and 10.3.3 prohibit commercial use of such a System for High Risk Processing Activities unless the controller or processor first assesses, documents and mitigates privacy risk and four cumulative conditions are met, including Commissioner-established certification/audit requirements, human-defined or approved processing purposes, and appointment of an Autonomous Systems Officer. The Deployer and Operator of a System engaged in High Risk Processing Activities must appoint an Autonomous Systems Officer with competencies, status, role and tasks substantially similar to a Data Protection Officer, and this role may be combined with the DPO function. Certification under Regulation 10.3.3 is system-specific rather than entity-specific and may only be issued by an Accredited Certification Body. Regulation 10 further requires Systems impacting data subjects to be designed for ethicality, fairness, transparency, security and accountability. Regulation 10's audit and certification requirements reached full enforcement on 1 January 2026. Separately, in the Abu Dhabi Global Market, ADGM Data Protection Regulation 20 gives data subjects a right not to be subject to a solely-automated decision with legal or similarly significant effect, requiring written notice and an opportunity for reconsideration. The UAE Federal Decree-Law No. 45 of 2021 (PDPL) automated-processing and profiling duties apply extraterritorially to controllers and processors both inside and outside the UAE where UAE data subjects are involved. A July 2025 amendment to the DIFC Data Protection Law raised the maximum fine for failing to carry out a Data Protection Impact Assessment before High Risk Processing Activities from USD 20,000 to USD 50,000.

Pending reform: The DIFC opened a 30-day public consultation, closing 18 July 2026, proposing amendments to Regulation 10 and a new Regulation 11 establishing an accreditation and certification framework for AI systems.

Read full sub-brief · 322 words

Instruments (3)
- DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01Binding
- DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems) In force since 2023-09-01Binding
- Federal Decree-Law No. 45 of 2021 (PDPL) Valid from 2022-01-02Binding

Obligations

- 10.3.3Commercial use of a System for High Risk Processing Activities requires Commissioner certification/audit, human-defined/approved processing purposes, and an appointed ASO.Conformity assessment · Applies to: Deployer · DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
- 10.3.3(d)Appointment of an Autonomous Systems Officer for high-risk System deployment, with DPO-equivalent competencies.Other · Applies to: Deployer · DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
- 10.1.1(a)/10.2.1Deployers and Operators of autonomous or semi-autonomous AI systems processing personal data must adhere to general processing principles, appoint a DPO and/or Autonomous Systems Officer, run DPIAs for high-risk processing, and meet certification/audit conditions, with full enforcement from January 2026.Data governance · Applies to: Deployer · DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
- 10.1.1 / 10.3.3Commercial use of an autonomous or semi-autonomous system for High-Risk Processing Activities is prohibited unless four cumulative conditions are met: Commissioner-established audit/certification requirements, system compliance with them, processing solely for human-defined/approved purposes, and appointment of an Autonomous Systems Officer.Risk management · Applies to: Deployer · DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems)
- 10.1.1(d) / 10.3.3(d)The deployer or operator of a system engaged in High Risk Processing Activities must appoint an Autonomous Systems Officer with competencies, status, role and tasks substantially similar to a Data Protection Officer under Articles 17-18 of the DIFC Data Protection Law.Other · Applies to: Deployer · DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems)
- 10.3.3(d)Both the Deployer and the Operator of a System engaged in High Risk Processing Activities must appoint an Autonomous Systems Officer with DPO-equivalent competencies, status, role and tasks.Other · Applies to: Deployer · DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems)
- 5.1.6; Reg 10.3.3A System used for High Risk Processing Activities may only be certified by an Accredited Certification Body; certification is system-specific, not entity-specific.Conformity assessment · Applies to: Notified body

Milestones

- 1 Jan 2026DIFC Regulation 10 full enforcement MetDIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)

Claims and evidence (19)
- Commercial use of a System for High Risk Processing Activities under DIFC Regulation 10 is prohibited unless Commissioner certification/audit requirements are met and an Autonomous Systems Officer is appointed.Confidence: Probable (capped: best source is T3) · As of 7 Sep 2023 · EvidencedEvidence and sources[Directors' Institute](https://www.directors-institute.com/post/ai-data-governance-the-emerging-regulation-landscape-in-the-uae) T3 · Retrieved · retrieved 4 Nov 2026providing data subjects with a clear and explicit notice in accordance with the updated regulations that covers the potential impact

- DIFC Regulation 10 brings AI and autonomous/semi-autonomous systems within scope whenever they process personal data.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Middle East AI News](https://www.middleeastainews.com/p/325-dubai-ai-companies-certified) T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

- DIFC Regulation 10.1.1(a) defines 'System' broadly to capture any machine-based autonomous or semi-autonomous system processing personal data, with the Deployer treated as controller and the Operator as processor.Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · EvidencedEvidence and sources[Virtual Data Protection Officer (vdpo.org)](https://vdpo.org/pages/law.php?country_id=23&law_id=31) T3 · Retrieved · retrieved 4 Nov 2026A financial institution should have appropriate governance structures to support sound development and usage of algorithm driven solutions

- DIFC Regulation 10 reached full enforcement of its audit and certification requirements in January 2026.Confidence: Probable (capped: best source is T3) · As of 1 Jan 2026 · EvidencedEvidence and sources[The Leveraged Years](https://www.theleveragedyears.com/ai-regulation-news/difc-regulation-10-autonomous-systems-enforcement-2026) T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

- The PDPL's automated-processing and profiling duties apply extraterritorially to controllers/processors both inside and outside the UAE where UAE data subjects are involved.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Virtual Data Protection Officer (vdpo.org)](https://vdpo.org/pages/law.php?country_id=23&law_id=31) T3 · Retrieved · retrieved 4 Nov 2026each controller or processor outside the UAE that processes personal data of data subjects inside the UAE

- ADGM Regulation 20 gives data subjects a right not to be subject to a solely-automated decision with legal or similarly significant effect, requiring written notice and reconsideration.Confidence: Probable · As of 14 Feb 2021 · EvidencedEvidence and sources[Abu Dhabi Global Market (ADGM)](https://adgmen.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER2021.pdf) T1 · Surfaced · retrieved 4 Nov 2026The Data Subject has the right not to be subject to a decision based solely on automated Processing, including Profiling, which produces legal effects

- Commercial high-risk AI processing in the DIFC requires Commissioner certification and an appointed Autonomous Systems Officer.Confidence: Probable (capped: best source is T3) · As of 7 Sep 2023 · EvidencedEvidence and sources[Latham & Watkins](https://www.lw.com/en/insights/ai-in-the-uae-understanding-the-regulatory-landscape-and-key-authorities) T3 · Retrieved · retrieved 4 Nov 2026Regulation 10 prohibits the commercial use of Systems to engage in such high risk processing

- DIFC Regulation 10 requires appointment of an Autonomous Systems Officer for high-risk System deployment, which may be combined with the DPO role.Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · EvidencedEvidence and sources[Reconn Orbit](https://orbit.reconn.io/difc-regulation-10-complete-guide/) T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

- DIFC Regulation 10 requires Systems impacting data subjects to be designed for ethicality, fairness, transparency, security and accountability.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[LexNova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

- An Accredited Certification Body certifies individual Systems, not entities, against Regulation 10.3.3's high-risk-processing requirements.Confidence: Probable · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/regulation-10/difc-reg-10-accreditation-and-certification-framework.pdf) T1 · Retrieved · retrieved 4 Nov 2026An Accredited Certification Body shall assess that the Systems used for High Risk Processing is or will be monitored by an Automated Systems Officer

- DIFC Regulation 10 moved to full enforcement of its audit and certification requirements on 1 January 2026.Confidence: Probable (capped: best source is T3) · As of 1 Jan 2026 · EvidencedEvidence and sources[Middle East AI News](https://www.middleeastainews.com/p/325-dubai-ai-companies-certified) T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

- DIFC Regulation 10, governing personal data processed through autonomous and semi-autonomous AI systems, took effect on 1 September 2023.Confidence: Probable · As of 1 Sep 2023 · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10) T1 · Surfaced · retrieved 11 Nov 2026The updated DIFC Data Protection Regulations enacted on September 1, 2023, include Regulation 10 on Processing Personal Data

- Derived: Probable A July 2025 amendment to the DIFC Data Protection Law raised the maximum fine for failing to carry out a DPIA before High Risk Processing Activities from USD 20,000 to USD 50,000.Confidence: Probable · As of 15 Jul 2025 · EvidencedEvidence and sources[Baker McKenzie (Connect on Tech)](https://connectontech.bakermckenzie.com/dubai-international-financial-centre-updates-data-protection-law/) T3 · Retrieved · retrieved 1 Jul 2025failure to carry out a data protection impact assessment ("DPIA") prior to conducting high risk processing activities in accordance with Article 20: maximum fine increased from USD 20,000 to USD 50,000
- [DIFC Authority](https://assets.u.ae/api/public/content/bb94d503629243a7aa548a8cd387ea86?v=df38af26) T1 · Retrieved · retrieved 11 Nov 2026Schedule 2 contains a list of administrative fines that may be issued under Article 62(2) of this Law

- DIFC Regulation 10.1.1 restricts commercial use of an autonomous or semi-autonomous system for High-Risk Processing Activities unless the controller or processor first assesses, documents and mitigates privacy risk.Confidence: Probable (capped: best source is T3) · As of 14 Jan 2026 · EvidencedEvidence and sources[Clyde & Co](https://www.clydeco.com/en/insights/2026/01/regulation-10-of-the-difc-data-protection-law) T3 · Retrieved · retrieved 14 Jan 2026These activities (discussed in more detail below) include processing involving: (i) the adoption of new technologies or methods

- A deployer or operator of an autonomous or semi-autonomous system used commercially for High-Risk Processing must appoint an Autonomous Systems Officer with competencies substantially similar to a Data Protection Officer.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[ETO Agora](https://agora.eto.tech/instrument/1773) T3 · Retrieved · retrieved 11 Nov 202610.3.4 For the purposes of Regulation 10 and the Law:12 (a) a Deployer of a System shall be deemed to act as a Controller

- Commercial use of a system for High Risk Processing Activities under DIFC Regulation 10.3.3 is prohibited unless four cumulative conditions are met, including Commissioner-established certification requirements and appointment of an Autonomous Systems Officer.Confidence: Probable · As of 7 Sep 2023 · EvidencedEvidence and sources[Clyde & Co](https://www.clydeco.com/en/insights/2023/09/difc-enacts-landmark-regulation-autonomous-systems) T3 · Retrieved · retrieved 7 Sep 2023On 7 September 2023, the Dubai International Financial Centre (DIFC) announced that it had enacted amendments to its Data Protection Regulations
- [DIFC Commissioner of Data Protection](https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-regulation.pdf) T1 · Retrieved · retrieved 11 Nov 202610.2 Obligations of Deployers and Operators of Systems 10.2.1 Without limiting any other provision in this Regulation 10, where Personal Data is Processed for use in, or

- DIFC opened a 30-day public consultation (closing 18 July 2026) proposing amendments to Regulation 10 and a new Regulation 11 establishing an accreditation and certification framework for AI systems.Confidence: Probable (capped: best source is T1) · As of 18 Jun 2026 · EvidencedEvidence and sources[Hadef & Partners](https://hadefpartners.com/news-insights/insights/ai-and-data-privacy-proposed-changes-to-the-difc-data-protection-regulations/) T3 · Retrieved · retrieved 11 Nov 2026The proposed changes focus principally on Regulation 10, which addresses Personal Data processed by autonomous and semi-autonomous systems, and introduce a new Regulation 11
- [DIFC Authority](https://www.difc.com/whats-on/news/difc-consultation-amended-data-protection-regulations) T1 · Surfaced · retrieved 18 Jun 2026The DP Regulations were updated in 2023 to introduce safeguards for the rapidly expanding use of Personal Data in advanced, AI enabled Systems

- DIFC Regulation 10 requires Deployers and Operators of high-risk AI Systems to appoint an Autonomous Systems Officer with DPO-equivalent competencies.Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · EvidencedEvidence and sources[ETO Agora](https://agora.eto.tech/instrument/1773) T3 · Retrieved · retrieved 11 Nov 202610.3.4 For the purposes of Regulation 10 and the Law:12 (a) a Deployer of a System shall be deemed to act as a Controller

- A high-risk-processing System in DIFC may only be certified by an Accredited Certification Body under Regulation 10's certification framework.Confidence: Probable · As of 27 Aug 2024 · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/regulation-10/difc-reg-10-accreditation-and-certification-framework.pdf) T1 · Retrieved · retrieved 11 Nov 2026An Applicant Accredited Certification Body must demonstrate that decisions shall be accessible and easily understood, as well as made publicly available

### 04General-Purpose AIQuiet▾#

Nothing recorded for this module in the research of 2026-11-11.

0 instruments · 0 obligations · 0 claims

Nothing recorded for this module in the research of 2026-11-11.

### 05Transparency & Synthetic ContentActive Derived: Probable▾#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

4 instruments (4 current) · 3 obligations · 6 claims · 1 milestone

Binding law in force: DIFC Regulation 10.2 requires Deployers and Operators to give data subjects clear notice of System use, the processing logic and purpose, and the System's potential impact on their rights. Separately, Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, Article 40, treats AI-enabled deepfake fraud as Cyber Fraud, carrying a minimum of one year's imprisonment and/or a fine of AED 250,000 to AED 1,000,000 per offence; the Article imposes no separate, AI-specific duty to label synthetic media.

Regulatory expectations: Joint guidelines from the Central Bank of the UAE, the Securities and Commodities Authority, the Dubai Financial Services Authority and the ADGM Financial Services Regulatory Authority expect financial institutions using Big Data Analytics and AI to inform customers of such use. The Central Bank of the UAE's Guidance Note on AI/ML further expects licensed financial institutions to disclose AI/ML use in plain, accurate, bilingual language, supported by multilingual telephone channels.

Instruments (4)
- DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01Binding
- DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems) In force since 2023-09-01Binding
- Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes In force since 2022-01-02Binding
- Guidelines for Financial Institutions Adopting Enabling Technologies Published 2021-11-15Regulatory expectation

Obligations

- 10.2Notice to data subjects covering System use, processing logic/purpose and potential rights impact.Transparency disclosure · Applies to: Deployer · DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)
- Article 40Use of technology including AI deepfakes to defraud is criminalised as Cyber Fraud, minimum one year imprisonment and/or AED 250,000-1,000,000 fine.Prohibition · Applies to: Other · Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes
- §2The non-binding CBUAE Guidance Note sets principles for licensed financial institutions on governance, fairness/non-discrimination, transparency/explainability, human oversight, and data management/privacy for AI and ML systems.Applies to: Other · CBUAE Guidance Note on Consumer Protection and the Responsible Adoption and Use of AI and ML by Licensed Financial Institutions

Milestones

- 1 Jan 2026DIFC Regulation 10 full enforcement MetDIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)

Claims and evidence (6)
- DIFC Regulation 10.2 requires deployers and operators to give data subjects clear notice of autonomous-system processing, its logic and purpose, and potential impact on rights.Confidence: Probable · EvidencedEvidence and sources[Central Bank of the UAE](https://rulebook.centralbank.ae/sites/default/files/en_net_file_store/CBUAE_EN_6958_VER1.pdf) T1 · Surfaced · retrieved 4 Nov 2026There is currently no dedicated AI law in force in the United Arab Emirates.

- The CBUAE Guidance Note on AI/ML expects licensed financial institutions to disclose AI/ML use in plain, accurate, bilingual language with multilingual telephone support.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[GCC Business and Data Intelligence (GCCBDI)](https://gccbdi.org/legal-updates/overview-central-bank-uaes-guidance-note-consumer-protection-and-responsible-adoption) T3 · Retrieved · retrieved 4 Nov 2026Senior management and Boards of Directors bear responsibility and accountability for AI/ML systems, outcomes, model selection, deployment

- Joint CBUAE/SCA/DFSA/FSRA guidelines expect financial institutions using Big Data Analytics and AI to inform customers of such use.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[obgulf.com](https://obgulf.com/insights/uae-ai-law-business-guide) T3 · Retrieved · retrieved 4 Nov 2026Ensure Customers are informed of Products and/or Services that utilise Big Data Analytics

- Derived: Probable Federal Decree-Law No. 34 of 2021, Article 40, treats AI-enabled deepfake fraud as Cyber Fraud, carrying a minimum one year's imprisonment and/or a fine of AED 250,000 to AED 1,000,000 per offence, with no separate duty to label synthetic media.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Baker McKenzie (Global Compliance News)](https://www.globalcompliancenews.com/2024/07/04/https-insightplus-bakermckenzie-com-bm-technology-media-telecommunications_1-united-arab-emirates-deepfakes-and-the-use-of-artificial-intelligence-ai-legal-issues-and-considerations_06112024/) T3 · Retrieved · retrieved 4 Nov 2026Article 40 of the UAE Cybercrimes Law, considers this “Cyber Fraud”, which carries a minimum of one year’s imprisonment

- DIFC Regulation 10 requires a clear notice to data subjects on System use, processing logic/purpose and rights impact.Confidence: Probable (capped: best source is T3) · As of 1 Jan 2025 · EvidencedEvidence and sources[Directors' Institute](https://www.directors-institute.com/post/ai-data-governance-the-emerging-regulation-landscape-in-the-uae) T3 · Retrieved · retrieved 4 Nov 2026providing data subjects with a clear and explicit notice in accordance with the updated regulations that covers the potential impact

- Derived: Probable UAE Cybercrime Law Article 40 criminalises AI-enabled deepfake fraud with imprisonment and a fine of AED 250,000-1,000,000, but imposes no AI-specific synthetic-media labelling duty.Confidence: Probable (capped: best source is T3) · As of 4 Jul 2024 · EvidencedEvidence and sources[Baker McKenzie (Global Compliance News)](https://www.globalcompliancenews.com/2024/07/04/https-insightplus-bakermckenzie-com-bm-technology-media-telecommunications_1-united-arab-emirates-deepfakes-and-the-use-of-artificial-intelligence-ai-legal-issues-and-considerations_06112024/) T3 · Retrieved · retrieved 4 Nov 2026Article 40 of the UAE Cybercrimes Law, considers this “Cyber Fraud”, which carries a minimum of one year’s imprisonment

### 06AI & Intellectual PropertyActive Derived: Probable▾#

The UAE Copyright Law makes no provision for AI authorship or computer-generated works, because its Article 1 defines an Author as a person who creates a work.

0 instruments (0 current) · 0 obligations · 2 claims · 0 milestones

Binding law in force: The UAE Copyright Law makes no provision for AI authorship or computer-generated works. Its Article 1 defines an 'Author' as a person who creates a work, a definition that excludes machine-generated output from authorship protection.

Cited evidence in this module rests solely on tier 3/4 commentary despite primary official sources existing for this jurisdiction.

Claims and evidence (2)
- Derived: Probable The UAE Copyright Law makes no provision for AI authorship or computer-generated works, because its Article 1 defines an Author as a person who creates a work.Confidence: Probable (capped: best source is T3) · As of 30 Sep 2025 · EvidencedEvidence and sources[LexNova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

- The UAE Copyright Law makes no provision for AI authorship or computer-generated works, since 'Author' is defined as a person who creates a work.Confidence: Probable (capped: best source is T3) · As of 30 Sep 2025 · EvidencedEvidence and sources[LexNova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

### 07Sectoral & Public-Sector AIActive▾#

ADGM FSRA Guidance – Chapter 14, Algorithm Driven Solutions (Date not recorded).

4 instruments (4 current) · 5 obligations · 12 claims · 0 milestones

Binding law in force: Federal Decree-Law No. 45 of 2021 (PDPL) Article 18 grants data subjects a right to object to automated-processing decisions with legal or adverse impact, with a right to human review on request, and Article 21(a) requires a Data Protection Impact Assessment before systematic automated or profiling assessments with legal consequences or serious impact. DIFC Regulation 10 applies to any autonomous or semi-autonomous System processing personal data in the financial free zone, treating the Deployer as controller-equivalent and the Operator as processor-equivalent. At emirate level, Abu Dhabi Law No. (3) of 2024 establishes the Artificial Intelligence and Advanced Technology Council (AIATC) to regulate AI and advanced-technology activity.

Regulatory expectations: The Central Bank of the UAE's Guidance Note on the Consumer Protection and Responsible Adoption and Use of AI and ML by Licensed Financial Institutions sets non-binding principles covering governance, fairness and non-discrimination, transparency and explainability, human oversight, and data management and privacy. Under that Guidance Note, licensed financial institutions must not deploy or continue to use a discriminatory or manipulative AI/ML system, and senior management and the Board are held accountable for AI/ML outcomes. The Guidance Note places board-level accountability on licensed institutions for AI/ML systems generally and requires effective human oversight of AI/ML systems, particularly for decisions with significant consumer implications, cautioning against fully automated decision-making except for low-risk, non-material processes. The ADGM Financial Services Regulatory Authority's guidance similarly expects financial institutions to maintain governance structures for algorithm-driven solutions.

Non-binding sectoral framework: The Dubai AI Seal is a voluntary certification programme run by the Dubai Centre for Artificial Intelligence for AI companies licensed in Dubai; it is not a statutory requirement, but since October 2025 the Dubai Department of Finance has directed government entities to limit AI-related service and consultancy contracts to Seal-certified suppliers, making certification a de facto precondition for Dubai and wider UAE government project partnerships distinct from a general business licence.

Read full sub-brief · 318 words

Instruments (4)
- ADGM FSRA Guidance – Chapter 14, Algorithm Driven Solutions Date not recordedRegulatory expectation
- CBUAE Guidance Note on Consumer Protection and the Responsible Adoption and Use of AI and ML by Licensed Financial Institutions Date not recordedRegulatory expectation
- CBUAE Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E. Published 2026-02-11Regulatory expectation
- Dubai AI Seal Published 2025-10-19; valid from 2025-01-01Non-binding

Obligations

- Article 18Right to object to automated-decision outcomes with legal/adverse impact, with human review on request.Other · Applies to: Other · UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
- Article 21(a)DPIA required before systematic automated/profiling assessment with legal consequences or serious impact.Fundamental rights impact assessment · Applies to: Other · UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
- §2The non-binding CBUAE Guidance Note sets principles for licensed financial institutions on governance, fairness/non-discrimination, transparency/explainability, human oversight, and data management/privacy for AI and ML systems.Applies to: Other · CBUAE Guidance Note on Consumer Protection and the Responsible Adoption and Use of AI and ML by Licensed Financial Institutions
- n/aCBUAE Guidance Note sets non-binding principles for licensed financial institutions on AI/ML governance, fairness, transparency, human oversight and data privacy.Other · Applies to: Other · UAE Charter for the Development and Use of Artificial Intelligence
- Fairness and Non-Discrimination/Ethics principleLicensed financial institutions must not deploy or continue to use an AI/ML system that is discriminatory or manipulative.Risk management · Applies to: Deployer · CBUAE Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.

Claims and evidence (12)
- The CBUAE's non-binding Guidance Note requires licensed financial institutions to maintain effective human oversight of AI/ML systems, particularly for decisions with significant consumer implications.Confidence: Probable (capped: best source is T3) · As of 11 Feb 2026 · EvidencedEvidence and sources[The Middle East Insider](https://themiddleeastinsider.com/2026/04/25/uae-ai-regulation-2026/) T3 · Retrieved · retrieved 4 Nov 2026If the processing includes a systematic and comprehensive assessment of the personal aspects of the Data Subject, using automated processing

- Abu Dhabi Law No. (3) of 2024 establishes the AIATC to regulate AI and advanced-technology activity in the emirate.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Latham & Watkins](https://www.lw.com/en/insights/ai-in-the-uae-understanding-the-regulatory-landscape-and-key-authorities) T3 · Retrieved · retrieved 4 Nov 2026The UAE Council for Artificial Intelligence and Blockchain, established in February 2018, promotes cross-sector AI adoption

- The CBUAE Guidance Note sets non-binding principles for licensed financial institutions' use of AI and ML systems, covering governance, fairness, transparency, human oversight and data privacy.Confidence: Probable · EvidencedEvidence and sources[Central Bank of the UAE](https://rulebook.centralbank.ae/sites/default/files/en_net_file_store/CBUAE_EN_6958_VER1.pdf) T1 · Surfaced · retrieved 4 Nov 2026Guidance Note outlines principals and guidelines for the use of Artificial Intelligence (AI) systems and Machine Learning (ML) technologies

- DIFC Regulation 10 applies to any autonomous or semi-autonomous System that processes personal data, with the Deployer as controller-equivalent and the Operator as processor-equivalent.Confidence: Probable (capped: best source is T3) · As of 1 Sep 2023 · EvidencedEvidence and sources[LexNova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) T3 · Retrieved · retrieved 11 Nov 2026“System” or “Systems” shall mean any machine-based system operating in an autonomous or semi-autonomous manner, that can

- UAE PDPL Article 18 grants data subjects a right to object to automated-processing decisions with legal or adverse impact, with a right to human review on request.Confidence: Probable (capped: best source is T3) · As of 20 Sep 2021 · EvidencedEvidence and sources[Legal Advice Middle East](https://legaladviceme.com/legislation/166/uae-federal-decree-law-45-2021-protection-personal-data) T3 · Retrieved · retrieved 4 Nov 2026The Data Subject has the right to object to decisions issued with respect to Automated Processing that have legal consequences

- UAE PDPL Article 21(a) requires a DPIA before systematic automated/profiling assessments with legal or serious impact.Confidence: Probable (capped: best source is T3) · As of 20 Sep 2021 · EvidencedEvidence and sources[The Middle East Insider](https://themiddleeastinsider.com/2026/04/25/uae-ai-regulation-2026/) T3 · Retrieved · retrieved 4 Nov 2026If the processing includes a systematic and comprehensive assessment of the personal aspects of the Data Subject, using automated processing

- CBUAE's Guidance Note on AI/ML places board-level accountability for AI/ML systems on licensed financial institutions.Confidence: Probable · As of 1 Feb 2026 · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://www.dataguidance.com/sites/default/files/data_protection_regualtions_final.pdf) T1 · Retrieved · retrieved 4 Nov 2026Senior management and Boards of Directors bear responsibility and accountability for AI/ML systems, outcomes, model selection, deployment

- CBUAE guidance cautions against fully automated AI/ML decision-making lacking human oversight, except for low-risk non-material processes.Confidence: Probable (capped: best source is T3) · As of 11 Feb 2026 · EvidencedEvidence and sources[The Leveraged Years](https://www.theleveragedyears.com/ai-regulation-news/difc-regulation-10-autonomous-systems-enforcement-2026) T3 · Retrieved · retrieved 4 Nov 2026the guidance cautions that the latter approach should only be taken for “low-risk, non-material processes with appropriate controls in place”

- ADGM FSRA guidance expects financial institutions to maintain governance structures for algorithm-driven solutions.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Virtual Data Protection Officer (vdpo.org)](https://vdpo.org/pages/law.php?country_id=23&law_id=31) T3 · Retrieved · retrieved 4 Nov 2026A financial institution should have appropriate governance structures to support sound development and usage of algorithm driven solutions

- The Dubai AI Seal is a mandatory certification for AI companies seeking Dubai/UAE government project partnerships, distinct from a general business licence.Confidence: Probable · As of 1 Jan 2025 · EvidencedEvidence and sources[Dubai Government Media Office (Dubai Protocol)](https://www.protocol.dubai.ae/en/media-listing/news-events/dubai-centre-for-artificial-intelligence-launches-ai-seal-to-certify-trusted-ai-companies/) T1 · Retrieved · retrieved 4 Nov 2026Companies that wish to be selected as partners in the UAE and Dubai government projects must be AI Seal certified

- CBUAE's AI/ML guidance note requires LFIs to avoid discriminatory/manipulative AI and holds senior management and the Board accountable for AI/ML outcomes.Confidence: Confirmed · As of 11 Feb 2026 · EvidencedEvidence and sources[Central Bank of the United Arab Emirates (CBUAE)](https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence) T1 · Retrieved · retrieved 11 Nov 2026Senior management and the Board of Directors of LFIs should be responsible and accountable for AI and ML systems

- The Dubai AI Seal is a voluntary AI certification programme that Dubai government entities are directed to require of their AI service suppliers.Confidence: Probable · As of 19 Oct 2025 · EvidencedEvidence and sources[Dubai Future Foundation](https://www.dubaifuture.ae/latest-news/dubai-ai-seal-sets-industry-standard-for-trusted-ai-with-strong-global-response/) T1 · Retrieved · retrieved 11 Nov 2026Dubai Centre for Artificial Intelligence has announced strong global interest for "Dubai AI Seal", the city's first-of-its-kind certification programme

### 08Safety & Incident ReportingActive▾#

Commercial use of a System for High Risk Processing Activities under DIFC Regulation 10 is prohibited unless Commissioner certification/audit requirements are met and an Autonomous Systems Officer is appointed.

0 instruments (0 current) · 0 obligations · 1 claim · 0 milestones

Binding law in force: Commercial use of a System for High Risk Processing Activities under DIFC Regulation 10 is prohibited unless Commissioner certification and audit requirements are met and an Autonomous Systems Officer is appointed, embedding a pre-deployment safety-assurance gate for high-risk AI processing in the DIFC.

Cited evidence in this module rests solely on tier 3/4 commentary despite primary official sources existing for this jurisdiction.

Claims and evidence (1)
- Commercial use of a System for High Risk Processing Activities under DIFC Regulation 10 is prohibited unless Commissioner certification/audit requirements are met and an Autonomous Systems Officer is appointed.Confidence: Probable (capped: best source is T3) · As of 7 Sep 2023 · EvidencedEvidence and sources[Directors' Institute](https://www.directors-institute.com/post/ai-data-governance-the-emerging-regulation-landscape-in-the-uae) T3 · Retrieved · retrieved 4 Nov 2026providing data subjects with a clear and explicit notice in accordance with the updated regulations that covers the potential impact

### 09Standards & ConformityActive▾#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

3 instruments (3 current) · 1 obligation · 10 claims · 1 milestone

Binding law in force: DIFC Regulation 10.3.3 prohibits commercial use of a System for High Risk Processing Activities unless certification, purpose-limitation and Autonomous Systems Officer conditions are satisfied, and Regulation 10.3.1 requires Systems impacting data subjects to be designed in accordance with ethicality, fairness, transparency, security and accountability principles. Regulation 10.3.3(d) requires appointment of an Autonomous Systems Officer for high-risk processing deployments, a role that may be combined with the Data Protection Officer function. Certification under Regulation 10 is system-specific, not entity-specific, and may only be issued by a DIFC Accredited Certification Body, which must assess whether the System is or will be monitored by an Autonomous Systems Officer and satisfies Regulation 10.3.3's requirements before certifying. Regulation 10's audit and certification requirements reached full enforcement on 1 January 2026.

Pending reform: The DIFC has opened a 30-day public consultation, closing 18 July 2026, proposing amendments to Regulation 10 and a new Regulation 11 establishing an accreditation and certification framework for AI systems.

Non-binding standards metadata: The Dubai AI Seal is a voluntary certification programme operated by the Dubai Centre for Artificial Intelligence; while not a statutory conformity regime, since October 2025 it has functioned as a mandatory precondition for AI companies seeking partnerships on Dubai and wider UAE government AI projects, distinct from a general business licence and from DIFC Regulation 10's statutory certification regime.

Read full sub-brief · 225 words

Instruments (3)
- DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01Binding
- DIFC Data Protection Regulations – Regulation 10 (Autonomous and Semi-Autonomous Systems) In force since 2023-09-01Binding
- Dubai AI Seal Published 2025-10-19; valid from 2025-01-01Non-binding

Obligations

- 5.1.6; Reg 10.3.3A System used for High Risk Processing Activities may only be certified by an Accredited Certification Body; certification is system-specific, not entity-specific.Conformity assessment · Applies to: Notified body

Milestones

- 1 Jan 2026DIFC Regulation 10 full enforcement MetDIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)

Claims and evidence (10)
- DIFC Regulation 10.3.3 prohibits commercial use of a System for High Risk Processing Activities unless certification, purpose-limitation and Autonomous Systems Officer conditions are satisfied.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Directors' Institute](https://www.directors-institute.com/post/ai-data-governance-the-emerging-regulation-landscape-in-the-uae) T3 · Retrieved · retrieved 4 Nov 2026providing data subjects with a clear and explicit notice in accordance with the updated regulations that covers the potential impact

- DIFC Regulation 10.3.3(d) requires appointment of an Autonomous Systems Officer for high-risk processing deployments, with dual-hatting with the DPO permitted.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[The Leveraged Years](https://www.theleveragedyears.com/ai-regulation-news/difc-regulation-10-autonomous-systems-enforcement-2026) T3 · Retrieved · retrieved 4 Nov 2026the guidance cautions that the latter approach should only be taken for “low-risk, non-material processes with appropriate controls in place”

- DIFC Regulation 10.3.1 requires Systems impacting data subjects to be designed in accordance with ethicality, fairness, transparency, security and accountability principles.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Virtual Data Protection Officer (vdpo.org)](https://vdpo.org/pages/law.php?country_id=23&law_id=31) T3 · Retrieved · retrieved 4 Nov 2026A financial institution should have appropriate governance structures to support sound development and usage of algorithm driven solutions

- A DIFC Accredited Certification Body must assess whether a high-risk System is or will be monitored by an Autonomous Systems Officer and meets Regulation 10.3.3's requirements before issuing system-specific certification.Confidence: Probable · EvidencedEvidence and sources[Abu Dhabi Global Market (ADGM)](https://adgmen.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER2021.pdf) T1 · Surfaced · retrieved 4 Nov 2026There is no horizontal AI Act with prohibited uses or risk-tier conformity assessments

- DIFC Regulation 10 reached full enforcement of its audit and certification requirements in January 2026.Confidence: Probable (capped: best source is T3) · As of 1 Jan 2026 · EvidencedEvidence and sources[The Leveraged Years](https://www.theleveragedyears.com/ai-regulation-news/difc-regulation-10-autonomous-systems-enforcement-2026) T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

- An Accredited Certification Body certifies individual Systems, not entities, against Regulation 10.3.3's high-risk-processing requirements.Confidence: Probable · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/regulation-10/difc-reg-10-accreditation-and-certification-framework.pdf) T1 · Retrieved · retrieved 4 Nov 2026An Accredited Certification Body shall assess that the Systems used for High Risk Processing is or will be monitored by an Automated Systems Officer

- The Dubai AI Seal is a mandatory certification for AI companies seeking Dubai/UAE government project partnerships, distinct from a general business licence.Confidence: Probable · As of 1 Jan 2025 · EvidencedEvidence and sources[Dubai Government Media Office (Dubai Protocol)](https://www.protocol.dubai.ae/en/media-listing/news-events/dubai-centre-for-artificial-intelligence-launches-ai-seal-to-certify-trusted-ai-companies/) T1 · Retrieved · retrieved 4 Nov 2026Companies that wish to be selected as partners in the UAE and Dubai government projects must be AI Seal certified

- DIFC opened a 30-day public consultation (closing 18 July 2026) proposing amendments to Regulation 10 and a new Regulation 11 establishing an accreditation and certification framework for AI systems.Confidence: Probable (capped: best source is T1) · As of 18 Jun 2026 · EvidencedEvidence and sources[Hadef & Partners](https://hadefpartners.com/news-insights/insights/ai-and-data-privacy-proposed-changes-to-the-difc-data-protection-regulations/) T3 · Retrieved · retrieved 11 Nov 2026The proposed changes focus principally on Regulation 10, which addresses Personal Data processed by autonomous and semi-autonomous systems, and introduce a new Regulation 11
- [DIFC Authority](https://www.difc.com/whats-on/news/difc-consultation-amended-data-protection-regulations) T1 · Surfaced · retrieved 18 Jun 2026The DP Regulations were updated in 2023 to introduce safeguards for the rapidly expanding use of Personal Data in advanced, AI enabled Systems

- A high-risk-processing System in DIFC may only be certified by an Accredited Certification Body under Regulation 10's certification framework.Confidence: Probable · As of 27 Aug 2024 · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/regulation-10/difc-reg-10-accreditation-and-certification-framework.pdf) T1 · Retrieved · retrieved 11 Nov 2026An Applicant Accredited Certification Body must demonstrate that decisions shall be accessible and easily understood, as well as made publicly available

- The Dubai AI Seal is a voluntary AI certification programme that Dubai government entities are directed to require of their AI service suppliers.Confidence: Probable · As of 19 Oct 2025 · EvidencedEvidence and sources[Dubai Future Foundation](https://www.dubaifuture.ae/latest-news/dubai-ai-seal-sets-industry-standard-for-trusted-ai-with-strong-global-response/) T1 · Retrieved · retrieved 11 Nov 2026Dubai Centre for Artificial Intelligence has announced strong global interest for "Dubai AI Seal", the city's first-of-its-kind certification programme

### 10Authorities & EnforcementActive Derived: Probable▾#

Abu Dhabi Law No. (3) of 2024 establishing the Artificial Intelligence and Advanced Technology Council (AIATC) (In force since 2024-01-22).

4 instruments (4 current) · 1 obligation · 13 claims · 0 milestones

Binding law in force: The DIFC Commissioner of Data Protection may issue administrative fines up to the maxima set out in DIFC Data Protection Law Schedule 2, of roughly USD 10,000 to USD 100,000 per contravention, for breaches including of Regulation 10. A July 2025 amendment to the DIFC Data Protection Law raised the maximum fine specifically for failing to carry out a Data Protection Impact Assessment before High Risk Processing Activities from USD 20,000 to USD 50,000, and Regulation 10's audit and certification requirements reached full enforcement on 1 January 2026. At emirate level, Abu Dhabi Law No. (3) of 2024 establishes the Artificial Intelligence and Advanced Technology Council (AIATC) as a binding emirate-level AI regulatory and investment body.

Enforcement gap in federal law: Although the PDPL (Federal Decree-Law No. 45 of 2021) provides for administrative penalties under Article 26, a Cabinet decision specifying the relevant violations and penalty amounts could not be confirmed as published in the Official Gazette; figures circulating in secondary commentary are accordingly unverified, and the PDPL's administrative penalty regime appears to remain inoperative pending that publication. This status is disputed in the underlying record and should be read as unresolved rather than confirmed either way.

Institutional landscape: The UAE Council for Artificial Intelligence and Blockchain is a non-statutory coordination body established in February 2018. Reports indicate that on 14 June 2026 the UAE Cabinet approved establishment of a federal Artificial Intelligence and Data Authority, merging the AI Office, the UAE Data Office and TDRA digital functions and intended to unify oversight of AI, data governance and digital government; however, this remains a reported Cabinet approval, and no founding legal instrument establishing the Authority had been published or independently verified at a primary source.

Read full sub-brief · 289 words

Instruments (4)
- Abu Dhabi Law No. (3) of 2024 establishing the Artificial Intelligence and Advanced Technology Council (AIATC) In force since 2024-01-22Binding
- DIFC Data Protection Law No. 5 of 2020 In force since 2020-07-01Binding
- Federal Decree-Law No. 45 of 2021 (PDPL) Valid from 2022-01-02Binding
- UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) In force since 2022-01-02Binding

Obligations

- Article 18(1)A data subject has the right to object to decisions issued with respect to automated processing, including profiling, particularly where such decisions have legal impact on or seriously/adversely affect the data subject.Applies to: Other · UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

Claims and evidence (13)
- The UAE Cabinet approved establishing a federal Artificial Intelligence and Data Authority on 14 June 2026, merging the AI Office, the UAE Data Office and TDRA digital functions.Confidence: Uncertain (capped: best source is T3) · As of 14 Jun 2026 · EvidencedEvidence and sources[Reconn Orbit](https://orbit.reconn.io/difc-regulation-10-complete-guide/) T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

- The DIFC Commissioner may issue administrative fines up to the maxima in DIFC DPL Schedule 2, roughly USD 10,000-100,000 per contravention, for breaches including of Regulation 10.Confidence: Probable · As of 1 Jul 2020 · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/regulation-10/difc-reg-10-accreditation-and-certification-framework.pdf) T1 · Retrieved · retrieved 4 Nov 2026An Accredited Certification Body shall assess that the Systems used for High Risk Processing is or will be monitored by an Automated Systems Officer

- The Cabinet decision specifying PDPL violations and penalties under Article 26 could not be confirmed as published in the Official Gazette, notwithstanding widely circulated unverified figures.Confidence: Disputed (capped: best source is T3) · As of 1 Sep 2026 · EvidencedEvidence and sources[Legal Advice Middle East](https://legaladviceme.com/legislation/166/uae-federal-decree-law-45-2021-protection-personal-data) T3 · Retrieved · retrieved 4 Nov 2026The Data Subject has the right to object to decisions issued with respect to Automated Processing that have legal consequences

- Derived: Probable A UAE federal Artificial Intelligence and Data Authority was reportedly approved on 14 June 2026, merging the AI Office, UAE Data Office and TDRA digital functions, but no establishing instrument has been verified at a primary source.Confidence: Uncertain (capped: best source is T3) · Not evidencedEvidence and sources[Reconn Orbit](https://orbit.reconn.io/difc-regulation-10-complete-guide/) T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

- The UAE Council for Artificial Intelligence and Blockchain is a non-statutory coordination body established in February 2018.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Latham & Watkins](https://www.lw.com/en/insights/ai-in-the-uae-understanding-the-regulatory-landscape-and-key-authorities) T3 · Retrieved · retrieved 4 Nov 2026The UAE Council for Artificial Intelligence and Blockchain, established in February 2018, promotes cross-sector AI adoption

- DIFC DPL Schedule 2 caps most per-contravention administrative fines at roughly USD 10,000-100,000, including for Regulation 10 (AI) failures such as missing a required DPIA before high-risk processing.Confidence: Probable · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/regulation-10/difc-reg-10-accreditation-and-certification-framework.pdf) T1 · Retrieved · retrieved 4 Nov 2026An Accredited Certification Body shall assess that the Systems used for High Risk Processing is or will be monitored by an Automated Systems Officer

- No Cabinet decision fixing PDPL Article 26 penalty amounts for AI-relevant automated-decision and DPIA duties could be confirmed as published, so stated fine figures circulating in secondary sources are unverified.Confidence: Uncertain (capped: best source is T3) · As of 1 Sep 2026 · EvidencedEvidence and sources[Legal Advice Middle East](https://legaladviceme.com/legislation/166/uae-federal-decree-law-45-2021-protection-personal-data) T3 · Retrieved · retrieved 4 Nov 2026The Data Subject has the right to object to decisions issued with respect to Automated Processing that have legal consequences

- Derived: Probable A federal Artificial Intelligence and Data Authority (AIDA) was reported approved in June 2026, but no founding instrument has yet been published.Confidence: Uncertain (capped: best source is T3) · As of 14 Jun 2026 · EvidencedEvidence and sources[artificialintelligenceregulations.com](https://artificialintelligenceregulations.com/jurisdictions/united-arab-emirates.html) T3 · Retrieved · retrieved 4 Nov 2026A federal Artificial Intelligence and Data Authority was approved on June 14, 2026, merging the AI Office, the UAE Data Office

- Abu Dhabi Law No. (3) of 2024 establishes the AIATC as a binding emirate-level AI regulatory and investment body.Confidence: Probable · EvidencedEvidence and sources[Law Library of Congress](https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulf-cooperation-council-member-states-part-one/) T2 · Surfaced · retrieved 4 Nov 2026the Government of the Emirate of Abu Dhabi enacted Law No. (3) of 2024, to establish the

- DIFC Regulation 10 moved to full enforcement of its audit and certification requirements on 1 January 2026.Confidence: Probable (capped: best source is T3) · As of 1 Jan 2026 · EvidencedEvidence and sources[Middle East AI News](https://www.middleeastainews.com/p/325-dubai-ai-companies-certified) T3 · Retrieved · retrieved 4 Nov 2026The DIFC now enforces Regulation 10 on autonomous systems, so entities using AI on personal data must run impact assessments

- Derived: Probable A July 2025 amendment to the DIFC Data Protection Law raised the maximum fine for failing to carry out a DPIA before High Risk Processing Activities from USD 20,000 to USD 50,000.Confidence: Probable · As of 15 Jul 2025 · EvidencedEvidence and sources[Baker McKenzie (Connect on Tech)](https://connectontech.bakermckenzie.com/dubai-international-financial-centre-updates-data-protection-law/) T3 · Retrieved · retrieved 1 Jul 2025failure to carry out a data protection impact assessment ("DPIA") prior to conducting high risk processing activities in accordance with Article 20: maximum fine increased from USD 20,000 to USD 50,000
- [DIFC Authority](https://assets.u.ae/api/public/content/bb94d503629243a7aa548a8cd387ea86?v=df38af26) T1 · Retrieved · retrieved 11 Nov 2026Schedule 2 contains a list of administrative fines that may be issued under Article 62(2) of this Law

- On 14 June 2026 the UAE announced establishment of a new federal Artificial Intelligence and Data Authority to unify oversight of AI, data governance and digital government.Confidence: Probable (capped: best source is T3) · As of 14 Jun 2026 · EvidencedEvidence and sources[Al Tamimi & Company](https://www.tamimi.com/law_update_articles/uae-establishes-new-federal-authority-for-ai-and-data-a-significant-step-in-the-evolution-of-digital-regulation/) T3 · Surfaced · retrieved 11 Nov 2026there is currently no standalone federal AI law regulating the development, deployment or use of AI systems

- Derived: Probable The PDPL's administrative penalty regime remains inoperative because the Cabinet decision specifying violations and penalties under Article 26 has not been published.Confidence: Probable (capped: best source is T3) · As of 1 Oct 2026 · EvidencedEvidence and sources[Trustable](https://trytrustable.com/uae-pdpl) T3 · Retrieved · retrieved 11 Nov 2026The Decree-Law leaves violations and administrative penalties to a Cabinet decision under Article 26.

### 11Sandboxes & Transitional ReliefActive▾#

DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) (In force since 2023-09-01).

1 instrument (1 current) · 0 obligations · 1 claim · 1 milestone

Regulatory expectations: The DIFC Commissioner of Data Protection operates the Regulation 10 Accelerator, a sandbox enabling testing of autonomous Systems against Regulation 10's privacy-by-design requirements.

Instruments (1)
- DIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems) In force since 2023-09-01Binding

Milestones

- 1 Jan 2026DIFC Regulation 10 full enforcement MetDIFC Data Protection Regulation 10 (AI and Autonomous/Semi-Autonomous Systems)

Claims and evidence (1)
- The DIFC Commissioner operates the Regulation 10 Accelerator, a sandbox for testing autonomous Systems against Regulation 10's privacy-by-design requirements.Confidence: Probable (capped: best source is T3) · EvidencedEvidence and sources[Reconn Orbit](https://orbit.reconn.io/difc-regulation-10-complete-guide/) T3 · Retrieved · retrieved 4 Nov 2026Regulation 10.3.3(d) requires that any Deployer or Operator using a System for High Risk Processing Activities must appoint

### 12Commercial ActivityActive▾#

Over 325 companies had applied for the Dubai AI Seal as of Dubai AI Week 2025.

0 instruments (0 current) · 1 obligation · 2 claims · 0 milestones

Non-binding framework with binding procurement effect: By Dubai AI Week 2025, over 325 companies had applied for the Dubai AI Seal, the voluntary six-tier (E to S) certification programme for AI companies licensed in Dubai. Since October 2025, Dubai government entities have been directed to work only with Seal-certified AI suppliers on government AI projects, making certification a commercial precondition for public-sector AI contracting rather than a general market-entry requirement.

Obligations

- generalThe Dubai AI Seal certification (six tiers, E to S) is required for companies selected as partners on UAE/Dubai government AI projects; an October 2025 Dubai Department of Finance directive requires government entities to work only with certified AI suppliers.Applies to: Other · Dubai AI Seal

Claims and evidence (2)
- Over 325 companies had applied for the Dubai AI Seal as of Dubai AI Week 2025.Confidence: Probable · As of 1 Jan 2025 · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://www.dataguidance.com/sites/default/files/data_protection_regualtions_final.pdf) T1 · Retrieved · retrieved 4 Nov 2026Senior management and Boards of Directors bear responsibility and accountability for AI/ML systems, outcomes, model selection, deployment

- Over 325 companies applied for the Dubai AI Seal by Dubai AI Week 2025, and since October 2025 Dubai government entities are directed to work only with certified AI suppliers.Confidence: Probable · EvidencedEvidence and sources[DIFC Commissioner of Data Protection](https://www.dataguidance.com/sites/default/files/data_protection_regualtions_final.pdf) T1 · Retrieved · retrieved 4 Nov 2026Senior management and Boards of Directors bear responsibility and accountability for AI/ML systems, outcomes, model selection, deployment

No modules match. Filters combine as OR inside a group and AND across groups.

Reset all filters

## Authorities

Authority Type

UAE Cabinet Regulator

Artificial Intelligence and Advanced Technology Council (AIATC), Abu Dhabi Regulator

UAE Council for Artificial Intelligence and Blockchain Regulator

DIFC Commissioner of Data Protection Regulator

Central Bank of the UAE Regulator

ADGM Financial Services Regulatory Authority Regulator

Federal Artificial Intelligence and Data Authority Regulator

DIFC Commissioner of Data Protection Regulator

Artificial Intelligence and Advanced Technology Council Regulator

Central Bank of the UAE Regulator

Artificial Intelligence and Data Authority Regulator

Federal Authority for Artificial Intelligence and Data Ai office

DIFC Commissioner of Data Protection Data protection authority

## Enforcement actions

No enforcement actions recorded in this research.

## Cases

No cases recorded in this research.

## Consultations

Consultation Authority Status Opened Closes

[DIFC Consultation Paper No. 3/2026 – proposed amendments to Regulation 10 and new Regulation 11](https://www.difc.com/whats-on/news/difc-consultation-amended-data-protection-regulations) DIFC Commissioner of Data Protection Closed 18 Jun 2026 18 Jul 2026

What this record does not yet establish is set out on the [transparency register](/gaps/#gap-ae); its dated events are on the [regulatory calendar](/calendar/?jid=AE).

Think something on this page is wrong? [Report an error](/legal/#contact).

Technical provenance (record schema, run ID & build metadata) Schema version artificial-intelligence-record-v2.12 Research run ID aic-union-AE-2026-11-04 Page model module-card-page-v1 Renderer render_jid_aic_v13 Build date 12 Nov 2026