The UAE has no comprehensive federal AI statute, but calling it unregulated misses how it actually binds companies. DIFC Regulation 10, fully enforced since January 1, 2026, is the region's first AI-specific regulation and imposes duties on autonomous systems processing personal data inside the DIFC free zone. The central bank issued AI guidance for every licensed financial institution in February 2026, and in June 2026 the government approved a federal Artificial Intelligence and Data Authority to consolidate oversight.
Key points
- DIFC Regulation 10 is binding inside the DIFC, including an Autonomous Systems Officer requirement for high-risk processing.
- The Central Bank's February 2026 guidance note sets board accountability, model inventories, annual bias testing, and consumer opt-out expectations for licensed financial institutions.
- The federal PDPL (Federal Decree-Law No. 45/2021) is the national data protection backbone for AI systems.
- The UAE AI Charter (2024) is formally non-binding but shapes procurement and vendor diligence.
- A federal Artificial Intelligence and Data Authority was approved on June 14, 2026, consolidating AI, data, and digital-government functions.
Laws and instruments
DIFC Regulation 10
DIFC data protection regulations, Regulation 10
The first AI-specific regulation in the region: duties on operators of autonomous and semi-autonomous systems processing personal data in the DIFC, including designated accountability for high-risk processing.
Effective: Fully enforced January 1, 2026
Federal Personal Data Protection Law
Federal Decree-Law No. 45/2021
The UAE's federal data protection statute, the binding national layer for AI systems processing personal data.
Effective: In force since January 2022
CBUAE AI/ML Guidance Note
Central Bank of the UAE, February 11, 2026
Supervisory guidance for all licensed financial institutions covering board accountability, mandatory model inventories with risk ratings, annual bias testing, and opt-out rights for high-impact AI decisions. Formally guidance, treated as expectation.
Effective: Issued February 11, 2026
Timeline
- July 2024
UAE Charter for the Development and Use of AI issued, with twelve principles.
- January 1, 2026
DIFC Regulation 10 fully enforced.
- January 2026
A National AI System appointed as an advisory member of the Cabinet.
- February 11, 2026
Central Bank AI/ML guidance note for licensed financial institutions.
- June 14, 2026
Federal Artificial Intelligence and Data Authority approved.
Who it applies to
Depends on where you sit: firms in the DIFC face Regulation 10 directly; licensed financial institutions face central bank expectations; everyone processing personal data faces the PDPL. There is no economy-wide AI statute.
Penalties
Regulatory enforcement by zone and sector: DIFC Commissioner action, central bank supervisory measures, and PDPL sanctions, rather than a single AI fine schedule.
Recent developments
UAE approves a federal Artificial Intelligence and Data Authority
The UAE consolidated its AI, data, and digital-government functions under a single federal authority, the clearest signal yet that its layered governance model is formalizing. The move follows the DIFC's AI-specific regulation reaching full enforcement in January and binding-in-practice central bank guidance for financial institutions in February.
Common questions
Does United Arab Emirates have a comprehensive AI law?
United Arab Emirates has a dedicated AI regime. The UAE has no comprehensive federal AI statute, but calling it unregulated misses how it actually binds companies. DIFC Regulation 10, fully enforced since January 1, 2026, is the region's first AI-specific regulation and imposes duties on autonomous systems processing personal data inside the DIFC free zone. The central bank issued AI guidance for every licensed financial institution in February 2026, and in June 2026 the government approved a federal Artificial Intelligence and Data Authority to consolidate oversight.
What are the penalties for AI violations in United Arab Emirates?
Regulatory enforcement by zone and sector: DIFC Commissioner action, central bank supervisory measures, and PDPL sanctions, rather than a single AI fine schedule.
Who does AI regulation in United Arab Emirates apply to?
Depends on where you sit: firms in the DIFC face Regulation 10 directly; licensed financial institutions face central bank expectations; everyone processing personal data faces the PDPL. There is no economy-wide AI statute.
Cite this page
Artificial Intelligence Regulations, "AI Regulation in UAE," reviewed July 16, 2026, https://artificialintelligenceregulations.com/jurisdictions/united-arab-emirates.html.
Entries state the position as of the review date and link to the primary text for verification.
