> For the complete documentation index, see [llms.txt](https://docs.solcis.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.solcis.ai/references/ai-regulatory-landscape/the-middle-east/ai-compliance-in-the-uae.md).
# AI compliance in the UAE
AI compliance in the UAE: enforce your controls on what your AI systems do, with data and evidence held in-country, across federal PDPL, DIFC, ADGM and CBUAE requirements.
*You bring your adopted compliance controls. Solcis Compliance Studio maps them to whichever UAE regime applies, and the Solcis Policy Engine enforces them on what your AI systems do, with data and evidence held in-country.*
AI compliance in the UAE means enforcing your adopted controls on what your AI systems do, with each control traceable to the clause it satisfies, independently verifiable evidence of every decision, and data and evidence held in-country. It aligns with the UAE's National AI Strategy 2031 and supports your compliance with whichever regime applies: federal PDPL, the DIFC and ADGM data protection regimes, or CBUAE requirements for licensed financial institutions. It is the jurisdiction-specific case of [runtime AI compliance](/references/concepts/runtime-ai-compliance.md).
## Key takeaways
* Which regime applies depends on where your entity is registered – mainland UAE (federal PDPL), the DIFC, or the ADGM – and whether it is licensed by the CBUAE. There is no single national privacy law for every entity.
* The UAE has no federal AI law. The one binding, AI-specific rule is DIFC Data Protection Regulation 10, which governs personal data processed through autonomous and semi-autonomous systems. CBUAE's 2026 AI guidance is the main AI-specific reference point for financial institutions, but it is non-binding.
* Federal PDPL has been in force since January 2022, but its Executive Regulations have not been issued, so it is not yet enforced in practice.
* Sovereign AI is a deliberate national strategy, backed by the National AI Strategy 2031, the AI Charter, and UAE-built models such as Falcon and Jais.
* Cloud sovereignty governs where data and infrastructure sit; AI compliance governs what AI systems are allowed to do. Both are required.
* In-country infrastructure, from Core42 to the telco Oracle Alloy clouds to the hyperscaler regions, is where the evidence is hosted. The Solcis Policy Engine enforces your adopted controls, and Solcis Compliance Studio holds and reports the resulting evidence.
## What's shaping AI compliance in the UAE?
AI compliance in the UAE is shaped by a national sovereign AI drive, a regulatory landscape split by jurisdiction, and the first AI-specific rules in the free zones and the financial sector.
The UAE was an early mover. It launched its [National Strategy for Artificial Intelligence](https://u.ae/en/about-the-uae/strategies-initiatives-and-awards/strategies-plans-and-visions/Ai/uae-strategy-for-artificial-intelligence) in October 2017, followed by the UAE Council for Artificial Intelligence and Blockchain in February 2018 and the [UAE Charter for the Development and Use of AI](https://u.ae/en/about-the-uae/strategies-initiatives-and-awards/policies/Ai/The-UAE-Charter-for-the-Development-and-Use-of-Artificial-Intelligence), setting out 12 non-binding principles, in June 2024. In June 2026 the Cabinet approved a new federal [Artificial Intelligence and Data Authority](https://uaecabinet.ae/en/news/mohammed-bin-rashid-approves-establishing-artificial-intelligence-and-data-authority), absorbing the UAE Data Office, the AI Office and TDRA's digital government functions.
That ambition runs on a partnership cloud model. [Core42](https://www.core42.ai/products/sovereign-public-cloud)'s *Insight* platform layers sovereign controls on top of Microsoft Azure infrastructure, and the Abu Dhabi Government's sovereign cloud agreement with Microsoft and Core42 is [designed to process more than 11 million daily digital interactions](https://www.mediaoffice.abudhabi/en/technology/abu-dhabi-government-accelerates-digital-strategy-with-landmark-microsoft-g42-partnership/). Adoption is already commercial, not aspirational. [ADNOC's US$340 million, three-year contract with AIQ](https://aiq.ae/newsroom/news-and-press-releases/AIQ-announces-340-million-contract-for-large-scale-deployment-of-agentic-AI-across-ADNOC-operations) deploys agentic AI across its upstream operations, and in February 2026 [G42 began recruiting AI agents into enterprise roles](https://www.g42.ai/resources/news/ai-agents-can-now-apply-jobs-g42), with humans retaining oversight and final accountability.
Regulation is split by jurisdiction. [Federal Decree-Law No. 45 of 2021 (PDPL)](https://uaelegislation.gov.ae/en/legislations/1972/download) applies to mainland UAE, while the [Dubai International Financial Centre (DIFC)](https://www.difc.com/business/operating-in-difc/data-protection) and the [Abu Dhabi Global Market (ADGM)](https://www.adgm.com/operating-in-adgm/office-of-data-protection) run their own, entirely separate data protection regimes for entities registered inside them, under their own regulators.
The first AI-specific rules sit on top of these. [DIFC Data Protection Regulation 10](https://www.mayerbrown.com/en/insights/publications/2026/01/ai-regulation-in-the-difc-personal-data-processed-through-autonomous-and-semi-autonomous-systems), in force since September 2023, is binding and governs personal data processed through autonomous and semi-autonomous systems. The Central Bank of the UAE (CBUAE) issued a non-binding [guidance note on the responsible adoption and use of AI and machine learning](https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence) by licensed financial institutions in February 2026, expecting documented governance, AI model inventories, bias testing, and human oversight scaled to risk.
With rules varying across jurisdictions, the first step is identifying which regulators and rules apply to your AI systems.
## Which regulations and regulators bear on AI systems in the UAE?
Your entity's registration – mainland, DIFC or ADGM – and whether it is CBUAE-licensed determine which of these regimes applies. The table sets out what each requires and what it means for an AI system operating inside it.
| Regulation / regulator | What it requires | Relevance to AI systems |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Federal Personal Data Protection Law (PDPL)** (Decree-Law 45/2021, mainland UAE) | In force since [2 January 2022](https://uaelegislation.gov.ae/en/legislations/1972/download). Sets processing principles, consent and transparency requirements, and applies to controllers and processors in the UAE and to those outside it processing data of people in the UAE. It excludes government data, health and banking data covered by their own legislation, and free zones with their own data protection laws. Its Executive Regulations have [not yet been issued](https://www.morganlewis.com/pubs/2026/06/uae-establishes-federal-authority-for-artificial-intelligence-and-data), and supervision is moving to the new AI and Data Authority. | Article 18 gives individuals a right to object to decisions based solely on automated processing, including profiling, with human review on request. Article 21 requires a DPIA for automated profiling with legal or serious effects. Practical enforcement awaits the Executive Regulations. |
| **DIFC Data Protection Law** (DIFC Law No. 5 of 2020, [amended 2025](https://www.twobirds.com/en/insights/2025/united-arab-emirates/difc-enacts-amendments-to-data-protection-law)) and **Regulation 10** | Applies to entities incorporated in the DIFC and to processing within it. The 2025 amendment added a private right of action in the DIFC Courts. Regulation 10 (in force September 2023) treats deployers of autonomous and semi-autonomous systems as controllers, and requires notice to users, human-defined purposes, a register of system use cases, and certification or an Autonomous Systems Officer for high-risk processing. Enforced by the DIFC Commissioner of Data Protection. | The UAE's only binding AI-specific rule. A DIFC-registered entity's AI system is covered by this law and Regulation 10 instead of federal PDPL – a separate, parallel obligation, not an extension of it. |
| **ADGM Data Protection Regulations 2021** | Applies to controllers and processors established in the ADGM. [Enacted on 11 February 2021](https://www.adgm.com/media/announcements/adgm-enacts-its-new-data-protection-regulations-2021), in force from 14 August 2021 for new entities and 14 February 2022 for existing ones. Enforced by ADGM's [Office of Data Protection](https://www.adgm.com/operating-in-adgm/office-of-data-protection), with fines of up to US$28 million. | An ADGM-registered entity's AI system answers to this regime, including its automated decision-making rights and DPIA requirements for high-risk processing, not federal PDPL or DIFC law. |
| **CBUAE AI guidance and enabling-technologies guidelines** (CBUAE-licensed financial institutions) | The non-binding [AI and ML guidance note](https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence) (issued 11 February 2026, announced 23 February 2026) expects risk-proportionate AI governance, an AI model inventory, bias testing at least annually, human oversight scaled to risk, human review on request, a human kill switch, and due diligence on third-party AI. It builds on the joint [Guidelines for Financial Institutions adopting Enabling Technologies](https://rulebook.centralbank.ae/en/rulebook/guidelines-financial-institutions-adopting-enabling-technologies) (CBUAE, SCA, DFSA and FSRA, November 2021). | The clearest reference point for how an AI system's actions should be governed inside a regulated financial institution, including the expectation that a person can stop the system. |
*The UAE's AI compliance landscape: federal PDPL, the DIFC and ADGM regimes, and CBUAE guidance for licensed financial institutions.*
The UAE has no federal AI law. Other instruments are narrower or voluntary: the Dubai Electronic Security Center's [Dubai AI Security Policy](https://www.desc.gov.ae/dubai-electronic-security-center-launches-the-dubai-ai-security-policy/) (September 2024), the voluntary [Dubai AI Seal](https://dub.ai/en/ai-seal/) certification, and Abu Dhabi's AI and Advanced Technology Council, which has not yet issued regulations.
## What data-residency rules apply?
The UAE has no general data-localisation rule, but several sector rules require data to stay in-country:
* **Health data.** Federal Law No. 2 of 2019 on the use of ICT in health fields bars storing or transferring health data outside the UAE without health-authority approval, including in the free zones. Abu Dhabi's ADHICS health information security standard further restricts cloud use.
* **Financial data.** CBUAE's Consumer Protection Standards and its Retail Payment Services and Card Schemes Regulation require certain data to be stored in the UAE.
* **Personal data under PDPL.** Articles 22 and 23 allow cross-border transfers on the basis of adequacy, agreements, contracts or consent, but the controls that make these mechanisms work depend on the Executive Regulations.
## What's distinctive here?
Three things set the UAE's AI and data protection landscape apart from most jurisdictions.
**Three separate general regimes in one country.** Most jurisdictions run one national data protection law, sometimes with sector rules on top. The UAE runs three: federal PDPL, the DIFC's law, and the ADGM's regulations, each enforced by a different regulator for entities registered within its boundary. Being "in-country" does not mean being under one law. A DIFC-registered entity's AI system answers to the DIFC Commissioner of Data Protection, not the federal authority, even though both sit inside the same country.
**Binding AI rules started in a free zone.** DIFC Regulation 10 regulated personal data processed by autonomous systems in September 2023, before any federal AI rule and before the CBUAE's guidance. For financial institutions, the CBUAE's 2026 note goes further than most regulators' AI guidance by naming model inventories, annual bias testing, human oversight and a kill switch explicitly.
**Sovereignty built on global infrastructure.** Rather than build an isolated local stack, the UAE's main sovereign clouds add local governance to global providers' technology: Core42's *Insight* platform on Microsoft Azure, and du's and e& enterprise's clouds on Oracle Alloy.
## Why does sovereignty matter for AI systems in the UAE?
Sovereignty dictates where an AI system executes, keeping the underlying infrastructure and data under UAE jurisdiction.
In-country data and deployment sit inside a deliberate national program, not just a compliance response. The National AI Strategy treats AI infrastructure as a strategic asset, supported by UAE-built models with openly published weights: [Jais](https://www.g42.ai/resources/news/meet-jais-worlds-most-advanced-arabic-llm-open-sourced-g42s-inception), an Arabic-first model built by G42's Inception, MBZUAI and Cerebras, and TII's Falcon family, which added Arabic models with [Falcon Arabic](https://www.tii.ae/news/middle-easts-leading-ai-powerhouse-tii-launches-two-new-ai-models-falcon-arabic-first-arabic) in May 2025. Physical capacity is scaling fast: [Stargate UAE](https://www.g42.ai/resources/news/global-tech-alliance-launches-stargate-uae), a 1GW cluster within a planned 5GW UAE–US AI campus in Abu Dhabi, has its [first 200MW phase due in the third quarter of 2026](https://www.thenationalnews.com/business/2025/12/05/stargate-uaes-first-phase-to-be-completed-in-third-quarter-of-2026/), and Microsoft has committed [US$15.2 billion](https://blogs.microsoft.com/on-the-issues/2025/11/03/microsofts-15-2-billion-usd-investment-in-the-uae/) to the UAE between 2023 and 2029.
However, sovereignty here is usually a partnership arrangement, and ownership is worth checking directly rather than assumed from a brand name. Core42's Sovereign Public Cloud runs on Microsoft Azure infrastructure. du's and e& enterprise's sovereign clouds are dedicated [Oracle Alloy](https://www.oracle.com/europe/news/announcement/blog/oracle-alloy-enables-offer-sovereign-cloud-capabilities-2025-07-02/) environments inside the telcos' own data centres, not domestically built platforms. [Khazna Data Centers](https://khaznadatacenters.com/), which describes itself as the UAE's largest data-centre platform, is [majority owned by G42, with MGX and Silver Lake holding minority stakes](https://khaznadatacenters.com/press-release/khazna-welcomes-mgx-and-silver-lake-as-strategic-minority-investors/).
Sovereignty here means local operational control and jurisdiction, not domestically built software. That distinction matters directly for AI compliance. An autonomous AI system can cross infrastructure, access systems and transmit data. Local hosting keeps a workload within the UAE, but it does not by itself control the system's actions or prove it stayed within approved data and system boundaries. Runtime AI compliance adds that layer, governing and evidencing how an AI system accesses data, uses systems and acts within whichever UAE regime applies.
## Applying AI compliance in the UAE
Applying AI compliance in the UAE means applying the [properties of runtime AI compliance](/references/concepts/runtime-ai-compliance.md) to the UAE's regulatory inputs: federal PDPL, the DIFC's law and Regulation 10, the ADGM's regulations, and CBUAE's guidance.
* **Preventive enforcement at the action boundary.** The Solcis Policy Engine evaluates the intended action against the applicable controls before it executes wherever possible, returning `Allow`, `Deny` or `Escalate` with a severity rating.
* **Control-to-clause traceability.** In Solcis Compliance Studio, each adopted control is tied back to the exact clause it satisfies. That might be a Regulation 10 requirement, a PDPL automated-decision right, an ADGM data protection requirement, or a CBUAE governance expectation.
* **Runtime enforcement, inline.** Where the Solcis Policy Engine enforces inline, the control fires at the moment the AI system tries to act, and the decision is reached before the action proceeds.
* **Tamper-evident and independently verifiable evidence.** Each decision is recorded cryptographically at the moment it is made, in the Solcis Compliance Studio evidence ledger. An auditor, the DIFC Commissioner of Data Protection, or a CBUAE inspector can verify that the record is complete and unaltered using standard tooling, without trusting the organisation or Solcis. Verification establishes what the record says and that it has not changed, not that the underlying decision was correct.
To see these in action, consider a DIFC-registered wealth manager whose AI agent is approved, in its Regulation 10 use-case register, to prepare portfolio reviews for existing clients. The agent then attempts to use the same client data to generate and send personalised product offers – a purpose not recorded in the register. The firm has adopted a control, drawn from Regulation 10's requirements for human-defined purposes and a register of use cases, that an autonomous system may only process personal data for purposes recorded in that register.
When the agent attempts to send the offers, the Solcis Policy Engine escalates rather than letting the action complete, and a reviewer is brought in to approve and register the new purpose or stop the campaign. Solcis Compliance Studio then records a tamper-evident record of the escalation and the reviewer's decision – auditable evidence that the control was enforced and how the approval was resolved.
That record is trustworthy because it is cryptographically verifiable, not because of where it is hosted. Residency – where the evidence physically sits – is a separate question, covered next.
## Where can AI compliance be deployed in-country?
Deploying compliant AI systems means hosting them on approved, local platforms that meet the UAE's sector residency rules. Onshore hosting does not rule out offshore ownership, a distinction the table below sets out.
| Provider | Who they are | Relevance for deploying AI compliance in-country |
| --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [**Core42** (G42)](https://www.core42.ai/) | [Formed in October 2023 by merging G42 Cloud, Inception and Injazat](https://www.g42.ai/resources/news/g42-launches-core42-deliver-national-scale-enterprise-cloud-and-ai-capabilities) into a single national-scale cloud and AI business. Inception was later spun back out as its own G42 company; Injazat was not. Its Sovereign Public Cloud runs the *Insight* sovereign-controls layer over Microsoft Azure. In February 2026 it agreed with the CBUAE to [develop sovereign financial cloud infrastructure](https://www.thenationalnews.com/business/banking/2026/02/25/uae-central-bank-and-core42-to-develop-sovereign-financial-cloud-infrastructure/). | Sovereign controls over a global hyperscaler, positioned for government and regulated financial workloads. |
| [**Khazna Data Centers** (G42, majority-owned)](https://khaznadatacenters.com/) | The physical layer: 30 live data centres, six more under way, and 673MW of capacity across its portfolio. Founded in 2012; e& contributed its UAE data centres in 2022 for a 40% stake, then [sold that stake to G42 for US$2.2 billion](https://www.eand.com/content/dam/eand/assets/docs/latest-announcements/2025/eand-adx-announcement-khazna-en-25-02-25.pdf) in 2025, when MGX and Silver Lake came in as minority investors. A [200MW expansion with Microsoft](https://news.microsoft.com/source/emea/2025/11/microsoft-and-g42-accelerate-uaes-digital-future-with-major-data-centre-expansion/) was announced in November 2025, and Khazna is building the Stargate UAE cluster. | Not itself a deployment target for AI systems – it is the physical layer Core42 and other in-country platforms depend on for their own onshore compliance evidence. |
| [**e& enterprise**](https://www.eandenterprise.com/en/solutions/cloud-and-digital-infrastructure/onecloud.html) | Telco-owned. [Announced OneCloud powered by Oracle Alloy](https://www.eand.com/en/news/24-sep-25-eand-enterprise-plans-to-launch-onecloud-powered-by-oracle-alloy.html) in September 2025 – a dedicated OCI environment run from its own UAE data centres – with launch planned for early 2026. | Once available, a telco-operated alternative to Core42 for organisations that want their own dedicated OCI environment rather than a shared public cloud region. |
| [**du** (National Hypercloud)](https://www.du.ae/tech/nationalhypercloud-oracle) | Telco-owned. Launched its [National Hypercloud](https://www.du.ae/about/media-centre/newsdetail/du-launches-the-national-hypercloud) in July 2025 on a dedicated Oracle Alloy deployment inside its own UAE data centres. | A telco-run, Oracle Alloy-based option for hosting an AI system's data and evidence in-country, positioned for government and enterprise workloads. |
| [**Moro Hub** (DEWA)](https://www.morohub.com/en) | Government-utility owned. Its Dubai solar-powered data centre holds the [Guinness World Record](https://www.guinnessworldrecords.com/world-records/713557-largest-solar-powered-data-center) for the world's largest solar-powered data centre (first awarded November 2022, updated December 2024) and is Uptime Institute Tier III certified. | A government-utility-backed, Tier III-certified hosting environment, suited to Dubai government and utility-aligned AI systems. |
| **Hyperscaler regions** (Microsoft Azure, Oracle, AWS) *Onshore hosting, offshore ownership* | [Microsoft Azure](https://news.microsoft.com/en-xm/2019/06/19/microsoft-cloud-datacenter-regions-now-available-in-the-uae-to-help-fuel-the-middle-easts-future-economic-ambitions/) has run UAE North (Dubai) and UAE Central (Abu Dhabi) since June 2019, and underlies Core42's Sovereign Public Cloud. [Oracle](https://www.oracle.com/ae/cloud/cloud-regions/abu-dhabi/) has run UAE East (Dubai) since September 2020 and UAE Central (Abu Dhabi) since November 2021. [AWS](https://aws.amazon.com/blogs/aws/now-open-aws-region-in-the-united-arab-emirates-uae/) launched its UAE region on 29 August 2022. | None of these regions is UAE-owned. Local operators typically supply governance layers or dedicated environments on top of them. |
*The UAE's in-country AI hosting providers: Core42, Khazna Data Centers, e& enterprise, du, Moro Hub and the hyperscaler regions.*
## Frequently asked questions
Does UAE PDPL apply to AI systems?
Yes, where an AI system processes personal data of people in the UAE and the processing is not excluded – for example, government data, or health and banking data covered by their own laws. Article 18 gives individuals a right to object to decisions based solely on automated processing, with human review on request. PDPL's Executive Regulations have not yet been issued, so practical enforcement is still pending.
Is there an AI law in the UAE?
Not at federal level. The only binding AI-specific rule is DIFC Data Protection Regulation 10, which applies to DIFC-registered entities processing personal data through autonomous or semi-autonomous systems. Elsewhere, AI is governed through data protection law, sector regulation and non-binding guidance such as the UAE AI Charter and CBUAE's guidance note. The new federal AI and Data Authority can propose AI and data legislation.
How do DIFC and ADGM differ from federal PDPL for AI?
Each free zone runs its own data protection law and regulator. An entity registered in the DIFC or ADGM answers to that zone's law instead of federal PDPL. A group with entities in more than one zone answers to each zone's law separately for each entity. The DIFC also has Regulation 10, which adds AI-specific obligations the other regimes do not.
Can AI compliance run in-country in the UAE?
Yes, on Core42, du's National Hypercloud, Moro Hub, or the live Microsoft Azure, Oracle and AWS regions. e& enterprise's OneCloud was announced in September 2025 with launch planned for early 2026.
Does CBUAE's AI guidance apply outside banks?
It applies to CBUAE-licensed financial institutions, not every UAE business. A vendor supplying one of these institutions can still be drawn in contractually, since the guidance expects institutions to carry out due diligence on third-party AI and they remain responsible when AI work is outsourced.
Is the UAE Charter for AI legally binding?
No. It sets 12 non-binding principles and, alongside the National AI Strategy, is the main national reference point for responsible AI.
***
This page is general information about how Solcis supports work against UAE instruments. It is not legal or regulatory advice. Confirm your obligations with a qualified professional and the primary source. Last reviewed: 23 September 2026.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.solcis.ai/references/ai-regulatory-landscape/the-middle-east/ai-compliance-in-the-uae.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.