The UAE does not currently have a single comprehensive federal AI statute. Its framework combines binding federal personal data and cyber law, national AI policy instruments, emirate and free-zone rules, and sector supervision. The UAE Charter and National AI Security Policy set important governance expectations, while regulated firms may face more specific requirements in jurisdictions such as the DIFC.
The federal privacy law governs electronic personal data processing inside and outside the UAE, including lawful processing, data security, individual rights, transfers, and controller and processor duties. Some free zones maintain separate data regimes.
The charter establishes national principles for safety, privacy, fairness, transparency, human oversight, accountability, accessibility, and compliance with applicable law.
The policy defines minimum AI security requirements across governance, inventories, secure development, model and data protection, operational safety, adversarial attacks, monitoring, incident response, and performance evaluation.
Organizations operating in the DIFC must assess its separate data protection regime, including accountability, lawful processing, rights, transfers, security, and requirements relevant to automated processing.
The policy sets minimum security expectations for AI adoption, covering governance, inventories, secure development, model and data protection, human oversight, resilience, monitoring, incident response, and adversarial attacks.
The DFSA has set out supervisory expectations for how authorized financial firms in the DIFC identify, govern, test, monitor, and control AI risks.
The charter establishes national principles for safe, fair, transparent, privacy-respecting, human-centered, and accountable AI development and deployment.
No comprehensive federal AI statute is in force. Binding obligations arise from federal privacy, cyber, consumer, employment, and sector law, plus emirate and free-zone regimes. National AI instruments provide policy and security benchmarks.
No. Federal law is central, but financial free zones such as the DIFC and ADGM maintain separate data protection and regulatory frameworks. Scope depends on establishment, activity, customers, and data flows.
A firm should identify its regulator and legal jurisdiction first. The DFSA has published AI risk-management expectations for DIFC firms, while other federal, emirate, free-zone, and sector requirements may apply elsewhere.
Nomos maps rules and changes to a specific business profile.