The UAE has no comprehensive federal AI statute, yet binding AI rules already apply in the DIFC free zone and central bank guidance covers the financial sector. DIFC Regulation 10, in force since September 1, 2023, imposes duties on autonomous and semi-autonomous systems processing personal data inside the DIFC. The central bank issued AI guidance for every licensed financial institution in February 2026, in May 2026 the Cabinet approved drafting a federal law on AI in the health sector, and in June 2026 the government approved a federal Artificial Intelligence and Data Authority to consolidate oversight.
Key points
- DIFC Regulation 10 is binding inside the DIFC, including an Autonomous Systems Officer requirement for high-risk processing.
- The Central Bank's February 2026 guidance note sets board accountability, model inventories, annual bias testing, and consumer opt-out expectations for licensed financial institutions.
- The federal PDPL (Federal Decree-Law No. 45/2021) is the national data protection backbone for AI systems.
- The UAE AI Charter (2024) is formally non-binding but shapes procurement and vendor diligence.
- A federal Artificial Intelligence and Data Authority was approved on June 14, 2026, merging the AI Office, the UAE Data Office, and TDRA's digital government sector.
- On May 18, 2026 the Cabinet approved the drafting of a federal law to regulate smart health applications and AI in the health sector, covering development, licensing, accreditation, and operation. No text has been published.
Laws and instruments
DIFC Regulation 10
DIFC data protection regulations, Regulation 10
An AI-specific regulation imposing duties on operators of autonomous and semi-autonomous systems processing personal data in the DIFC, including designated accountability for high-risk processing.
Effective: In force since September 1, 2023; certification for high-risk processing under way in 2026
Federal Personal Data Protection Law
Federal Decree-Law No. 45/2021
The UAE's federal data protection statute, the binding national layer for AI systems processing personal data.
Effective: In force since January 2022
CBUAE AI/ML Guidance Note
Central Bank of the UAE, February 11, 2026
Supervisory guidance for all licensed financial institutions covering board accountability, mandatory model inventories with risk ratings, annual bias testing, and opt-out rights for high-impact AI decisions. Formally guidance, treated as expectation.
Effective: Issued February 11, 2026
Timeline
- September 1, 2023
DIFC Regulation 10 in force.
- July 2024
UAE Charter for the Development and Use of AI issued, with twelve principles.
- April 14, 2025
The Cabinet approves a Regulatory Intelligence Office and an AI-assisted legislative system meant to speed up lawmaking.
- January 2026
A National AI System appointed as an advisory member of the Cabinet.
- February 11, 2026
Central Bank AI/ML guidance note for licensed financial institutions.
- May 18, 2026
The Cabinet approves drafting a federal law on smart health applications and AI in the health sector.
- June 14, 2026
Federal Artificial Intelligence and Data Authority approved.
Who it applies to
Depends on where you sit: firms in the DIFC face Regulation 10 directly; licensed financial institutions face central bank expectations; everyone processing personal data faces the PDPL. There is no economy-wide AI statute.
Penalties
Regulatory enforcement by zone and sector: DIFC Commissioner action, central bank supervisory measures, and PDPL sanctions, rather than a single AI fine schedule.
Recent developments
UAE approves a federal Artificial Intelligence and Data Authority
The UAE approved a single federal authority, reporting to the Cabinet, that merges its AI Office, the UAE Data Office, and the digital government functions of its telecom regulator, the clearest signal yet that its layered governance model is formalizing. It follows the central bank's February guidance on AI for licensed financial institutions.
Common questions
Does the United Arab Emirates have a comprehensive AI law?
No. The UAE has no comprehensive federal AI statute, yet binding AI rules already apply in the DIFC free zone and central bank guidance covers the financial sector. DIFC Regulation 10, in force since September 1, 2023, imposes duties on autonomous and semi-autonomous systems processing personal data inside the DIFC. The central bank issued AI guidance for every licensed financial institution in February 2026, in May 2026 the Cabinet approved drafting a federal law on AI in the health sector, and in June 2026 the government approved a federal Artificial Intelligence and Data Authority to consolidate oversight.
What are the penalties for AI violations in the United Arab Emirates?
Regulatory enforcement by zone and sector: DIFC Commissioner action, central bank supervisory measures, and PDPL sanctions, rather than a single AI fine schedule.
Who does AI regulation in the United Arab Emirates apply to?
Depends on where you sit: firms in the DIFC face Regulation 10 directly; licensed financial institutions face central bank expectations; everyone processing personal data faces the PDPL. There is no economy-wide AI statute.
Cite this page
Artificial Intelligence Regulations, "AI Regulation in the UAE," reviewed October 26, 2026, https://artificialintelligenceregulations.com/jurisdictions/united-arab-emirates.html.
Entries state the position as of the review date and link to the primary text for verification.
