UAE | Herbert Smith Freehills

Policy

AI regulation

AI-related law and regulation

Sector-specific AI regulations

Case law

11 Mar 2025 Insight

Reports and highlights

The United Arab Emirates (UAE) has a complex legal and regulatory system, consisting of multiple jurisdictions, each with its own limited or substantial legal systems. This snapshot covers Mainland UAE (also referred to as the onshore jurisdiction) – the regulatory system for the UAE and each of the individual Emirates excluding the Financial Free Zones – and Financial Free Zones (also referred to as the offshore jurisdictions), which consist of the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC). While there are more than forty other free zones in the UAE, only ADGM and DIFC have their own comprehensive legal systems; the rest have legal systems limited to commercial and administrative regulations relating to their purpose.

The UAE generally seeks to establish itself as a global leader in AI as outlined in their National Strategy for Artificial Intelligence. This aims to transform the UAE into a hub for global innovation and application through its eight strategic objectives described below.

The UAE published its National Strategy for Artificial Intelligence in 2018. It sets out a goal to become the world leader in AI by 2031, outlining the following eight objectives:

To build a reputation as an AI destination.
To increase the UAE's existing competitive assets in resources & energy, logistics & transport, and tourism & hospitality sectors, including emerging priority sectors, through deployment of AI.
To develop a fertile ecosystem for AI.
To adopt AI across customer services to improve lives and government.
To attract and train talent for future jobs enabled by AI.
To bring world-leading research capabilities to work with target industries.
To provide the data and supporting infrastructure essential to become a test bed for AI.
To ensure strong governance and effective regulation.

Helpful resources include the UAE AI government website which contains a library of AI guides, frameworks, and other educational material.

Currently, there is no AI-specific legislation or regulation in the UAE. However, the UAE has issued guidelines in respect of AI including:

The AI Ethics Guide was launched in December 2022 and outlines the guidelines for the ethical design and implementation of AI systems in both public and private sectors.
The AI Adoption Guideline in Government Services (2023), which was released in March 2023, aims to raise awareness, enhance the impact of AI, and maintain an up-to-date repository of clear use cases for AI deployment in government services.

From consumer protection law to online safety, AI continues to stretch existing legal frameworks. See the latest updates below.

Mainland UAE

The UAE Data Office, which is yet to be established, will act as the UAE federal regulator for the UAE's key data protection law, Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (the Personal Data Protection Law). This provides a legal framework for data processors and controllers to ensure confidentiality of personal data and to protect the personal data and privacy of UAE residents; it applies extraterritorially to any data controller or process that has, or processes, personal data of UAE residents.

In addition to the Personal Data Protection law, Article 380 of the UAE Penal Code criminalises the unlawful dissemination of telephone calls, messages, information, data or other issues which came to a person's knowledge by virtue of their work, including in the context of AI.

DIFC

The DIFC's Data Protection Law of 2020 does not explicitly refer to AI, but applies to any processing of personal data by automated means, including that which is processed by AI. Article 38 provides 'data subjects' with protection against decisions based solely on automated processing which produces legal consequences or other seriously impactful consequences concerning that individual; the individual can also require such decision to be reviewed manually.

The DIFC's Data Protection Regulations of 2020 - which are supporting regulations of the DIFC's Data Protection Law of 2020 - address "Personal Data Processed Through Autonomous and Semi-Autonomous Systems" via regulation number 10, which includes AI systems. It is supported by a guidance note that the DIFC's Commissioner of Data Protection issued in 2023.

ADGM

The ADGM's Data Protection Regulations 2021 do not explicitly refer to AI, but apply to any processing of personal data by automated means, which would include personal data processed by AI. The ADGM's Office of Data Protection has issued multiple guidelines on data protection.

The UAE Penal Code applies to both the DIFC and ADGM, both of which have their own data protection laws. As a result, Article 380 of the UAE Penal Code (referenced above) could criminalise the disclosures of, or transfers to other jurisdictions of, personal data by AI in a manner which does not comply with the DIFC's and ADGM's data protection laws.

Mainland UAE

The UAE issued two laws in 2021:

Federal Decree-Law No. 38 of 2021 on Copyright and Neighbouring Rights, under which definition of 'work' may include AI-generated content - subject to fulfilling a number of innovation standards.

Federal Law No. 11 of 2021 on the Regulation and Protection of Industrial Property Rights, which excludes 'software' from the patent protections it provides. Whilst there is no clear definition given to 'software', it may include AI platforms and applications - which are, therefore, not protected by this law.

Article 379 of the UAE Penal Code also criminalises the divulging of 'secrets' that a person has obtained “by virtue of his profession, craft, position or art”, which can be interpreted to include intellectual property in the form of know-how and other unregistrable intellectual property. This could prove to be an issue in scenarios where AI was given access to such 'secrets' and divulges, unlawfully, the same.

As noted above, the UAE Penal Code applies to both the DIFC and ADGM.

DIFC

Neither the DIFC Law No. 4 of 2019 (as amended) on Copyright and Neighbouring Rights, nor the DIFC Intellectual Property Law on patent protections, provides protection to AI software.

Read our series on AI and IP here.

In 2021, the UAE issued Federal Decree Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, which sets out a legal framework in relation to the misuse and abuse of online technology. While this law does not explicitly refer to AI, its scope covers all forms of electronic information systems.

The UAE AI Office has also issued the Deepfake Guide (2021), which provides detailed information on deepfakes, sets out protective measures against deepfakes, and advises on the methods of reporting deepfakes to the relevant authorities.

Read our guide on AI, online harms, and advertising here.

Financial services

The Dubai Financial Services Authority published its 2025-2026 Business Plan on 4 February 2025, and identifies innovation as a strategic focus area. They announce their intention to provide further direction to the market on regulatory expectations related to AI to ensure a safe and responsible adoption in financial services.

Separately, the DIFC unveiled their flagship Future of Finance report series, with the first publication on global finance and investment in relation to technological shifts and new global flows. In this report then note that one of the biggest challenges to AI adoption in the financial sector is inconsistent standards and regulation. They further state that the transformative potential of AI "can only be realised with clear and robust regulation".

Explore the latest landmark rulings as AI-related disputes make their way through the courts.

Mainland UAE

Mainland UAE is a civil law jurisdiction, so case law does not play a considerable role in the UAE's legal framework. As such, there is no relevant AI case law under the laws of Mainland UAE.

DIFC and ADGM

The DIFC and ADGM are common law jurisdictions where case law forms a large part of their legal framework. However, there is no relevant AI case law at present. The DIFC is heavily influenced by UK case law and therefore relevant UK case law may be influential in the DIFC.

Pursuant to Application of English Law Regulations 2015 of ADGM, the common law of England (including case law), to the extent not explicitly excluded or covered by ADGM laws, applies directly in ADGM. As such, AI-related UK case law may be directly applicable.

Key contacts

Chris Walters

Partner, Head of Middle East Corporate, Dubai

Anna Szyndler

Partner, Dubai

Julian Grant

Of Counsel (Australia), Dubai

Legal Notice

The contents of this publication are for reference purposes only and may not be current as at the date of accessing this publication. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action based on this publication.

Stay in the know

We’ll send you the latest insights and briefings tailored to your needs

Subscribe now