Contact usGet started

Frameworks · United Arab Emirates

AI regulators and frameworks in the United Arab Emirates

The UAE governs AI through data protection law and sector supervision rather than a single AI statute. Onshore, the federal Personal Data Protection Law gives people a right to object to automated decisions. Inside the DIFC, Regulation 10 sets binding rules for AI that processes personal data. The UAE AI Charter sets national principles, and the Central Bank's guidance note sets expectations for financial institutions.

Who regulates AI here

  • Central Bank of the UAESupervises banks, insurers and other licensed financial institutions, and in February 2026 issued its guidance note on the responsible use of AI and machine learning.
  • DIFC Commissioner of Data ProtectionEnforces the DIFC Data Protection Law, including Regulation 10 on AI and other autonomous systems that process personal data.
  • ADGM Office of Data ProtectionEnforces the ADGM Data Protection Regulations 2021 for organisations registered in Abu Dhabi Global Market.
  • Dubai Financial Services AuthorityRegulates financial services conducted in or from the DIFC, and has tracked rising AI adoption among the firms it supervises.
  • Digital Dubai AuthorityLeads Dubai's digital transformation, including the Dubai Government's use of data and AI.

United Arab Emirates

The UAE combines a national AI charter with data protection rules for autonomous systems in the Dubai International Financial Centre.

LawUAE PDPLUAE Personal Data Protection Law and automated processingThe UAE federal Personal Data Protection Law gives people a right to object to automated decisions. Who it covers, Article 18, impact assessments and AI.In force since 2 January 2022. Executive regulations set many operational details.LawDIFC Regulation 10DIFC Regulation 10 on autonomous and semi-autonomous systemsDIFC Regulation 10 sets rules for personal data processed by AI and autonomous systems in the DIFC. Who it covers, notices, certification and the ASO role.In force since September 2023, amendments consulted on in 2026Voluntary frameworkUAE AI CharterUAE Charter for the Development and Use of Artificial IntelligenceThe UAE Charter for the Development and Use of AI sets 12 national principles, from safety and bias to human oversight. What it covers and how to apply it.Issued June 2024, non-binding national principles

All United Arab Emirates frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in United Arab Emirates

Frameworks elsewhere

Guides

Questions

Does the UAE have an AI law?

Not a comprehensive one as of October 2026. Binding rules come from the federal Personal Data Protection Law, DIFC Regulation 10 inside the DIFC and sector regulators. In June 2026 the UAE announced a federal Artificial Intelligence and Data Authority reporting to the Cabinet, with a mandate to propose AI and data policy and legislation.

Does the federal PDPL apply in the DIFC and ADGM?

No. Companies in free zones with their own data protection law follow that law instead. The DIFC has the Data Protection Law, DIFC Law No. 5 of 2020, with Regulation 10 on autonomous systems, and ADGM has its Data Protection Regulations 2021.

Is the UAE AI Charter binding?

No. It is a national policy with 12 principles and no penalties. It sets the expectations many UAE government bodies and buyers bring to AI.

What does Article 18 of the UAE PDPL say about AI?

It gives people the right to object to decisions based on automated processing, including profiling, that have legal consequences for them or seriously affect them, and to ask for human review. It applies to AI systems that make or shape those decisions.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us