Anyone planning an AI deployment in the UAE today faces an unusual picture: a new federal authority for AI and data, a federal data protection law whose implementing regulations had still not been issued according to the most recent legal analysis we found, and financial free zones with their own rules for years. This article summarises what the sources say, and how to design a deployment that holds up however all of this is settled.

First: one federal authority for AI and data

On 14 June 2026, His Highness Sheikh Mohammed bin Rashid Al Maktoum announced the creation of the Federal Authority for Artificial Intelligence and Data, a unified body reporting directly to the Cabinet. According to Morgan Lewis’s analysis (Ksenia Andreeva, 15 June 2026), it brings together the UAE’s Artificial Intelligence Office, the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the previously announced Emirates Data Office, and it sets national AI and data policy and proposes legislation and standards.

Second: the data protection law is still waiting on its regulations

Federal Decree-Law No. 45 of 2021 on the protection of personal data governs processing and transfers abroad, and does not impose blanket localisation. But Morgan Lewis noted in June 2026 that its implementing regulations “have still not been issued”, and that no supervisory authority has been unambiguously designated for the private sector. Some guides online say otherwise without citing a decision number, so check the Official Gazette before relying on any compliance date.

In practice: the mechanics of transfers abroad, the list of adequate countries and the body that will review your compliance are all still unclear. The answer may come from the new authority.

Third: the DIFC has regulated autonomous systems since 2023

Inside the Dubai International Financial Centre, the rules are clearer. In September 2023 the DIFC added Regulation 10 to its data protection regulations, covering personal data processed through autonomous and semi-autonomous systems, AI included. According to Baker Botts, most obligations fall on the “deployer” rather than the operator, and the regulation does not regulate the algorithms themselves but the behaviour of those who deploy them. If your entity is registered in the DIFC, these rules apply to you today.

How to design a deployment that holds up however this lands

  1. Work out which regime applies to you: the federal law, the DIFC or ADGM, plus any rules from your sector regulator. More than one can apply to a single organisation.
  2. Map the three data paths for every AI system: the prompts, the indexes and the logs. Any path that leaves the country is the one whose rules will change when the regulations arrive.
  3. Keep all three paths in-country if you can. It is the only option that needs no redesign, whatever shape the final transfer mechanics take.
  4. Make every decision the system takes traceable: who asked, what the system saw, what action it took. That is what any supervisor, federal or free-zone, will ask for.

Where we stand

Orchestra, our Arabic model, runs inside your data centre in the UAE or in an in-country private cloud, together with the indexes, the logs and the safety layer. So your deployment’s design does not depend on how the transfer mechanics are settled, and every action is recorded in a log that cannot be altered. More on our UAE page.

This article summarises public sources and is not legal advice. The regulatory picture is moving, so check the official texts and your legal counsel before acting.

Sources

Related pages

Download the one-page checklist: AI and data rules in the Gulf and Egypt, 2026 (PDF), or compare all seven countries on one page.