The AI Law the UAE Doesn't Have (Yet)

The UAE has no federal AI law. It does have a data protection law, in force since 2 January 2022, and four of its articles already cover what most AI systems do: make decisions about people. Most of the directors I work with in the Emirates have read a summary of that law. This page works from the official text.

Does the UAE Have an AI Law?

No. There is no federal AI statute, so there are no EU-style risk tiers or conformity checks. The national AI Strategy 2031 is a strategy. The 2024 AI Charter sets out twelve principles and is non-binding, as Latham & Watkins records. What binds a company today is data protection law. Which law depends on the licence: mainland, DIFC or ADGM.

What Does the PDPL Already Say About Automated Decisions?

The PDPL is Federal Decree-Law No. 45 of 2021. Four of its 31 articles bear on automated decisions about people. Two more, Articles 14 and 17, mention automated means and marketing profiling.

• Article 18, the right to object. A person may object to a decision that results from automated processing, and may ask for a human to review it.
• Article 21, the impact assessment. A company must assess the impact before processing that uses automated means, including profiling, to make "a systematic and comprehensive assessment of the personal aspects" of a person with "legal consequences or serious impact".
• Article 10, the data protection officer. A company must appoint one if its processing involves a systematic and comprehensive assessment of sensitive personal data, "including Profiling and Automated Processing".
• Article 13, the right to information. On request, a person is entitled to be told about "decisions made based on automated processing, including profiling".

Article 18 is the one to read in full. Its first and last paragraphs say:

“The Data Subject shall have the right to object to any decisions resulting from automated processing, including profiling, particularly those decisions which have legal impact on or adversely affect the Data Subject. [...] The Controller shall include the human element in reviewing automated processing decisions at the request of the Data Subject.”

The right falls away in three cases: the automated processing is agreed in the contract between the person and the company, another UAE law requires it, or the person gave prior consent under Article 6.

This matters most for credit scoring, hiring screens, fraud flags and insurance pricing. The text says "resulting from automated processing". It doesn't say "solely", as the EU rule does. So a human signature on a machine's recommendation may not take the decision outside Article 18. I have found no regulator or court ruling on the point. In practice, the company needs a working route for objections and a person with the authority to change the outcome.

Is the PDPL in Force, and What Is Still Missing?

The law has been in force since 2 January 2022. Three things are still missing, and together they explain why so many boards treat it as dormant.

• The Executive Regulations. Article 28 told the Cabinet to issue them within six months of the law being promulgated. That deadline passed in March 2022.
• The compliance clock. Article 29 gives companies six months from the date the regulations are issued to bring themselves into line, and the Cabinet may extend it by a similar period. The clock has not started.
• The fines. Article 26 leaves violations and penalties to a Cabinet decision. None has been published. The range of AED 50,000 to AED 5 million quoted on many websites is not in the law.

Smaller pieces also wait on the regulations: the deadline for reporting a data breach (Article 9), the technology and data-volume criteria for appointing a data protection officer (Article 10), and the conditions for sending data to countries without adequate protection (Article 23). Article 21, the impact assessment, does not refer to the regulations. Its triggers are already in the law.

Enforcement so far has been light. The Chambers 2026 guide reports "limited enforcement activity", and Ashurst wrote in July 2026 that the Data Office "never became fully operational". The same note suggests the new Authority may be what moves the regulations forward.

“The duties are already written. The fines are not.”

Six months is a short time to find every system that decides something about a person, assess it, and build a way for people to object. This is the gap I describe in Policy Is Not Control.

Which UAE Regime Applies to Your Company?

The UAE has three main data protection regimes. The federal law does not apply to companies in free zones that have their own data protection legislation (Article 2), which chiefly means DIFC and ADGM.

Regulation 10 is what DIFC describes as the first enacted regulation in the Middle East, Africa and South Asia on processing personal data through autonomous and semi-autonomous systems. It covers personal data only. The Autonomous Systems Officer has, in the regulation's words, "the same or substantially similar competencies, status, role and task" as a data protection officer, and one person can hold both roles. Mayer Brown has the detail.

Sector matters as much as geography. The PDPL does not apply to personal health data or to personal banking and credit data where those have their own legislation (Article 2). For its banking and credit data, a bank looks first to the Central Bank: its Consumer Protection Regulation, its Model Management Standards, and the guidance note on AI and machine learning issued on 11 February 2026, which Pinsent Masons describes as non-binding. The PDPL still covers the bank's other personal data. A hospital looks to its health regulator for patient data. For the wider region, see The Gulf Is Where AI Governance Gets Tested at Scale.

How Does Article 18 Compare With GDPR Article 22?

Closely. Four points differ. A company with a GDPR programme has most of what the PDPL asks for.

The lists of sensitive data also differ. The PDPL adds family and criminal record, which GDPR handles separately in Article 10, and leaves out trade union membership, among other differences. For the EU side in depth, see the EU AI Act guide.

What Should a UAE Board Do Now?

Five moves, in order. None of them waits on the regulations.

1. List the systems that decide things about people. Credit, hiring, pricing, fraud, eligibility. Mark each one that has a legal or serious effect on a person. That list is your Article 21 scope and your first priority under Article 18, which on the English text reaches any automated decision.
2. Run the impact assessment on each marked system. Article 21 sets the minimum content: what the processing is, why it is necessary, the risks, and the measures that reduce them.
3. Build the objection route. Article 19 requires a clear way to contact the company. Article 18 requires a human reviewer on request. Name the reviewer and give them authority to change the outcome.
4. Check the contract and consent wording. The Article 18 exceptions rest on what the contract says or on prior consent under Article 6. Record the ground for every cross-border transfer under Articles 22 and 23 while you are there.
5. Confirm your regime and your officer. Mainland, DIFC or ADGM, and which sector regulator. Appoint a data protection officer if an Article 10 trigger applies. In DIFC, decide whether any system counts as high-risk processing under Regulation 10.

I am not licensed to practise UAE law. This is a board-level reading of public texts. Confirm specifics with UAE-licensed counsel before you act.