The UAE has positioned itself as a pioneer in AI governance. In 2017, it became the first nation to appoint a Minister of State for Artificial Intelligence. The UAE’s National AI Strategy 2031 outlines a bold vision to become a global leader in AI by embedding it across key sectors like healthcare, education and transportation.

While the authors see AI-relevant amendments being made to existing regulation, there is currently no specific UAE law governing artificial intelligence (AI), but rather a patchwork of policies, initiatives and guidelines to take note of.

Healthcare

The UAE is leveraging AI and machine learning to revolutionise its healthcare sector, enhancing both patient care and operational efficiency. AI technologies are being integrated into various aspects of healthcare, from diagnostics to treatment plans. For instance, Emirates Health Services employs AI algorithms for early cancer detection, heart rate monitoring and diabetes management. The UAE has also employed AI in programmes to assist with managing COVID-19 by restricting movement through the “Oyoon” programme. This system monitored residents’ permits using facial, voice and licence plate recognition.

The UAE Ministry of Health and Prevention (MOHAP) employs AI for the diagnosis of diseases (such as tuberculosis) using chest X-ray algorithms. These innovations not only improve the accuracy of diagnoses but also enable personalised treatment plans, significantly boosting patient outcomes

The advantages of AI in healthcare are perceived to include reduced errors, faster medicine development and automation of administrative tasks, benefiting both patients and staff.

The UAE’s commitment to AI in healthcare is further supported by robust legal frameworks, such as Federal Law No 2 of 2019, which ensures the secure and ethical use of health data.

Aviation

The UAE is leveraging AI in its aviation sector to enhance efficiency, safety and the overall passenger experience. The UAE’s aviation authority, the GCA, has permitted exploration of the use of AI in air traffic management.

Key uses of AI in aviation include:

• flight optimisation – AI is used to optimise flight routes, reducing fuel consumption and improving on-time performance;
• predictive maintenance – AI algorithms predict when aircraft parts need maintenance, minimising downtime and enhancing safety;
• passenger experience – AI-driven chatbots and personalised services improve customer service, and facial recognition and biometrics streamline passenger processing at airports;
• air traffic management – AI helps in trajectory prediction and conflict detection, ensuring safer and more efficient air traffic control; and
• drone technology – AI-powered drones are used for runway inspections and aircraft maintenance.

AI significantly enhances the aviation sector by optimising flight routes, improving safety through predictive maintenance and elevating passenger experiences with personalised services and streamlined processes. It also reduces costs by optimising operations and maintenance, improves air traffic management and introduces innovative applications like AI-powered drones for inspections. These advancements collectively lead to a more efficient, safe and customer-friendly aviation industry.

Regarding legal frameworks, the UAE has established comprehensive regulations to govern AI use. Federal Decree-Law No 45 of 2021 on Personal Data Protection and the National Artificial Intelligence Ethics Guidelines are key components of this framework. These regulations ensure that AI applications comply with data protection standards and ethical guidelines.

Education

Several schools across the UAE have partnered with technology companies to integrate digital education programmes into their teaching curricula. The primary objectives are to cut costs and promote education among the population. The UAE Ministry of Education also plans to introduce AI-generated tutors, using technology similar to ChatGPT, into classrooms.

The advantages of using AI in education include:

• personalised learning – AI assesses the individual needs of each student by tracking performance and requirements, optimising the information schools have on their students;
• accessibility – AI provides education for those living in isolated communities;
• collaborative learning – AI facilitates collaborative learning when students or teachers are not physically present in the same location; and
• efficient grading – AI streamlines the grading of tests and homework.

Moreover, the UAE is pioneering AI in the education sector through initiatives like the establishment of the Mohamed bin Zayed University of Artificial Intelligence and the integration of AI tools in classrooms to enhance learning outcomes. These efforts are part of the UAE’s broader vision – in turn as part of the UAE’s National AI Strategy 2031 – to position the country as a global leader in AI.

Workplace

AI is being rolled out in the workplace and in government services across the UAE, offering numerous benefits. These include the replacement of repetitive tasks, the use of AI in recruitment with predictive analytics software for processing and filtering candidates, the adoption of AI-enabled chatbots to augment customer support, the use of AI tools to operate as invisible teammates to upskill workers and the use of AI analytics to allow companies to better understand and unlock value in their data.

The advantages of using AI in the workforce sector include:

• efficiency – AI replaces repetitive tasks, freeing up employees to focus on more complex and creative work;
• enhanced recruitment – AI-driven predictive analytics software streamlines the recruitment process by efficiently processing and filtering candidates;
• improved customer support – AI-enabled chatbots provide instant and consistent customer support, enhancing customer satisfaction;
• upskilling workers – AI tools act as invisible teammates, helping workers develop new skills and improve productivity; and
• data insights – AI analytics enable companies to better understand and unlock value in their data, leading to more informed decision-making.

Automotive

AI is revolutionising the automobile sector, enhancing convenience and safety. Key areas benefitting from AI include maintenance, car connectivity, autonomous driving, electrification and sensors. Innovative AI applications in the automotive industry include autonomous taxis, AI-controlled pedestrian crossings and accident management by warning drivers of hazards.

The advantages of AI in the automotive sector include:

• improved predictive maintenance – AI supports real-time alerting systems by monitoring and maintaining vehicles using historical and contextual data;
• enhanced navigation – AI allows for improved safety features in vehicles through real-time object recognition;
• better cruise control – AI enhances the functionality and responsiveness of cruise control systems;
• fleet management – AI optimises fleet operations, improving efficiency and reducing costs;
• effective voice command capability – AI improves voice command systems, making them more intuitive and responsive;
• enhanced customer communication – AI streamlines customer interactions and support; and
• automated manufacturing – AI-supported robots in the assembly line enhance production efficiency and quality.

Moreover, the UAE is pioneering AI in the automotive sector through initiatives that integrate AI tools into various aspects of vehicle manufacturing and operation.

In April 2019, the UAE Cabinet adopted the National Artificial Intelligence Strategy 2031, aimed at positioning the UAE as a global leader in AI by 2031. The strategy outlines eight strategic objectives including building the UAE’s position as an AI destination and global hub, increasing the competitive edge of the AI sector and employing AI in customer services to improve quality of life.

The UAE has also empowered the Artificial Intelligence and Advanced Technology Council (AIATC) to focus on positioning the UAE as a hub for AI investments, partnerships and talent. The AIATC oversees financing, investment and research plans for AI and advanced technology

In 2023, the UAE government launched an updated AI strategy, “UAE Artificial Intelligence Strategy 2031”, which aims to position the UAE as a global leader in AI by 2031. This strategy focuses on enhancing AI integration across various sectors, including healthcare, education and government services, while also addressing ethical considerations and potential risks associated with AI technologies.

Additionally, the UAE’s National Program for Artificial Intelligence, known as BRAIN, consolidates resources to highlight advances in AI and robotics, emphasising the UAE’s objective to become a leading participant in the responsible use of AI globally.

Moreover, the UAE has established the role of Chief Executive Officer for Artificial Intelligence in ministries and federal entities to promote best practices, strategic planning, and governance frameworks for AI adoption. These efforts are part of the UAE’s broader vision to create a knowledge-based economy and prepare a future-ready workforce.

There is currently no specific AI law in the UAE. However, a number of key initiatives are being implemented to guide the adoption of AI (see 5.1 Regulatory Agencies).

The authors are also seeing AI-relevant adjustments being made to existing regulation, and comment on this in the following (see 3.7 Proposed AI-Specific Legislation and Regulations, for example, on the AI amendment to the Dubai International Financial Centre (DIFC) Data Protection Law).

The authors anticipate the implementation of further adjustment to existing law to accommodate the particularities of AI and the development of AI specific-regulation. That development is likely to be supported by the UAE Regulations Lab, launched in 2019, which focuses on drawing up new business-enabling regulations following the testing and evaluation of innovations enabled by new technologies.

While there is no specific AI law, as identified in 2.2 Involvement of Governments in AI Innovation, the National AI Strategy sets out clear objectives, and the bodies identified in 5.1 Regulatory Agencies have issued policy statements and guidance that seek to safeguard the development and adoption of AI, and will shape relevant AI regulation. See, for example, Smart Dubai’s AI Ethics Principles and Guidelines.

Please see 3.1 General Approach to AI-Specific Legislation and 2.2 Involvement of the Governments in AI Innovation.

This issue is not applicable in the UAE.

Federal Decree-Law No 45 of 2021 on the Protection of Personal Data (PDPL) is the primary regulation on data protection in the UAE. The PDPL deals with the rights of data subjects, such as the right to rectification and deletion of data more generally. Although it does not explicitly reference AI models, appropriate measures and procedures must be in place to ensure the erasure or correction of incorrect personal data.

Purpose limitation and data minimisation are key principles under the UAE data protection regime. An organisation must only process personal data for specific and lawful purposes, and only collect data relevant to the needs of the organisation (“purpose limitation”). After data use, all personal data collected should be deleted, and not kept and used for any other additional purposes (“data minimisation”). To avoid violating these provisions, it is recommended that personal data be anonymised, pseudonymised, securely encrypted or archived in a manner that ensures that the data is put beyond further use.

DIFC Data Protection Law No 5 of 2020 (DIFC DPL) was amended in September 2023 specifically to regulate autonomous and semi-autonomous systems, including AI and generative machine-learning technology. Article 38 of the DIFC DPL provides that a data subject must have the right to object to any decision based solely on automated processing, including profiling, which produces legal consequences concerning them, or other seriously impactful consequences, and to require such decision to be reviewed manually.

Regulation 10 of the DIFC DPL:

• requires persons be aware when their data is processed by an autonomous and semi-autonomous system such as AI;
• prohibits use of the system unless it is capable of processing personal data only for purposes that are human-defined or human-approved;
• imposes obligations on the deployers and operators of such systems, such as the requirement for the processing of personal data by the systems, to be compliant with the DIFC DPL; and
• requires the systems be built with unbiased algorithmic decisions, fairness, transparency, security and accountability.

“System” under Regulation 10 means any machine-based system operating in an autonomous or semi-autonomous manner that can process personal data for purposes that are human-defined or purposes that the system itself defines (or both) and generates output as a result of or on the basis of such processing.

While Regulation 10 does not expressly reference AI, it is evident from the guidance that the definitions used are adapted on the basis of the OECD guidelines and the draft Regulation of the European Union on harmonised rules on AI (the “EU AI Act”).

The DIFC has further strengthened its position as a pioneer in AI regulation. In addition to the 2023 amendments to the DIFC DPL, the DIFC has introduced a new AI and emerging technology regulatory sandbox in 2024. This sandbox allows companies to test innovative AI solutions in a controlled environment, helping to inform future regulatory approaches.

Regarding copyright, Federal Decree-Law No 38 of 2021 now protects “smart applications, computer programmes, databases and similar works” generated by or with AI. Despite their non-human origin, AI-generated works may qualify for copyright protection under UAE copyright law.

Other relevant regulations include Federal Law No 2 of 2019 on Information and Communication Technology in Health Fields (the “Health Data Law”); Federal Decree-Law No 3/2003 on Organizing Telecommunications (the “Telecoms Law”); and Federal Decree-Law No 34 of 2021 on Combatting Rumors and Cybercrimes (the “Cybercrime Law”).

The UAE government is clearly considering the development of regulations and frameworks to govern the use of AI. The implementation of AI legislation in other countries, including the UK, EU countries and the USA, will no doubt be referenced in the introduction of AI-specific legislation in the UAE and influence the approach taken by UAE regulators when determining the key features of the legislation.

While there are still no landmark judicial decisions specifically addressing AI and intellectual property (IP) rights, the UAE courts have begun to consider AI-related issues in some recent cases. For instance, in a 2023 case in the DIFC Courts, the judge considered the admissibility of AI-generated evidence, setting a preliminary precedent for how AI-derived information may be treated in legal proceedings.

The majority of court judgments for onshore UAE cases are not publicly available, making it very difficult to extract clear statements of principle from cases, particularly as judgments are not intended to be authoritative statements of law.

The implementation of the National Strategy (see 2.2 Involvement of Governments in AI Innovation) is supervised by the Emirates Council for Artificial Intelligence and Digital Transactions.

Since the adoption of the National Strategy, the UAE has demonstrated its commitment to delivering the eight objectives by:

• appointing the UAE Minister of State for AI, who has issued guidance papers such as the December 2022 AI Ethics Principles and Guidance paper;
• devising the UAE National Program for Artificial Intelligence (BRAIN), which consolidates resources, emphasising the UAE’s aim to become a leading participant in the responsible use of AI globally – its AI Guide details the approach adopted by the UAE to AI and comments on the key considerations of relevance, namely AI governance, data governance, cybersecurity, ethics, bias and employment;
• setting up the Council for AI and Blockchain to focus on developing policies to create an AI-friendly ecosystem promoting collaboration between the public and private sectors, while also safeguarding ethical considerations such as privacy and non-discrimination;
• setting up the UAE Council for Artificial Intelligence and Digital Transactions to oversee AI integration in government departments and education and society in general – it also oversees the positive use of AI, privacy of user data, data security and integrity and efficient data sharing with competent authorities;
• creating the AIATC, focused on positioning the UAE as a hub for AI investments, partnerships and talent and also tasked with the supervision of financing, investment and research plans for AI and advanced technology;
• launching the UAE Regulations Lab (RegLab) in 2019, in partnership with the Dubai Future Foundation, to develop new business-enabling regulations following the testing and evaluation of innovations enabled by new technologies; and
• introducing Digital Dubai to develop and oversee the implementation of policies and strategies that govern all matters related to Dubai’s information technology, data, digital transformation and cybersecurity – Digital Dubai has issued an Ethical AI Toolkit to support industry, academia and individuals in the responsible use of AI systems, including AI Ethics Principles and Guidelines (the “AI Guidelines”) addressing fairness, transparency, accountability and “explainability”.

The Council for AI and Blockchain is dedicated to preventing harm associated with AI such as data leaks, infringement of privacy and ethical concerns. It also seeks to create an environment conducive to the innovation and advancement of AI while maintaining societal ethics.

RegLab focuses on mitigating any potential risks and developing regulations around AI use.

AIATC and the financial free zones of DIFC and the Abu Dhabi International Financial Centre (ADGM) regulate the use of AI technologies in finance. Their aim is to prevent financial fraud and any personal data breach while promoting AI innovation in the financial sector.

The authors are not aware of AI-relevant enforcements, pending or otherwise.

In addition to the general guidance and policies issued by the bodies identified in 5.1 Regulatory Agencies, the following bodies will be relevant.

• The Ministry of Industry and Advanced Technology (MoIAT). This is the primary UAE government body responsible for setting standards across all sectors. MoIAT is tasked with ensuring that AI systems adhere to ethical standards and promote transparency and accountability.
• The GCC Standardization Organisation (GSO). This organisation defines and develops GSO standards related to AI and machine learning. These technical standards are not publicly available, but can be purchased from MoIAT or GSO’s online website.

Companies operating in the UAE are regularly required to meet international standards set by regulatory bodies such as the International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC) and the International Telecommunication Union (ITU).

UAE governmental authorities actively integrate AI across all functions, with continued developments aimed at positioning the UAE as a global leader in AI by 2031. The UAE Strategy for Artificial Intelligence seeks to enhance government performance through integrated smart digital systems, while the Council for Artificial Intelligence and Digital Transactions promotes a supportive ecosystem for AI adoption across public entities. Recent advancements include the Telecommunications and Digital Government Regulatory Authority (TDRA) integrating generative AI into its Unified Digital Platform and “U Ask” services, streamlining user access to government information and services.

In the legal sector, UAE courts increasingly utilise AI to improve case management, support real-time translation and operate virtual courtroom environments. Notably, the DIFC Courts issued guidelines on the use of AI-generated content in litigation, requiring transparency and responsible use, while the Abu Dhabi Judicial Department (ADJD) has implemented AI-based tools to monitor criminal proceedings and support electronic case processing at scale.

Biometric and facial recognition technologies are also widely adopted across public services, with government entities using them for employee verification and broader digital identity initiatives. More detail on facial recognition is provided in 11.2 Facial Recognition and Biometrics.

See 4.1 Judicial Decisions.

AI plays a significant role in national security matters in the UAE.

The UAE government employs AI in various aspects of national security to enhance capabilities in threat detection, intelligence analysis, border security, cybersecurity and defence.

For obvious reasons, specific details of AI applications in national security are not publicly disclosed.

Generative AI can create original content based on patterns learned from accumulated data. Like other AI forms, it raises ethical issues related to data privacy, security, misinformation, plagiarism and copyright infringement and the generation of harmful content.

Determining IP ownership is a challenge. The deep learning models used in generative AI, the lack of direct human intervention and the reliance on existing data all blur IP ownership.

As AI advances, IP laws can be expected to be supplemented and adjusted to address emerging issues. As an example, Federal Decree-Law No 38 of 2021 on Copyrights and Neighboring Rights has recently been updated to include “smart applications, computer programmes, databases, and similar” works in its definition of “Works” protected by the law. AI-generated works may qualify for copyright despite their non-human origin. Users of AI systems may be considered authors and bear responsibility for copyright infringement.

In connection with AI, the following need consideration:

• patents – novel AI algorithms or techniques may qualify for patent protection, although patents typically cover specific inventions or processes which may be a challenge for AI-developed assets;
• copyright – original AI models, software code and creative works generated by AI systems can be protected by copyright law, and this includes both the source code and any output produced by the AI model;
• trade secrets – keeping AI models and training data confidential is essential for safeguarding trade secrets; and
• trade marks – branding associated with AI products or services can be protected through trade marks, securing brand identity.

For data protection, see 3.6 Data, Information or Content Laws and 8.2 Data Protection and Generative AI.

Please see 3.6 Data, Information or Content Laws.

Most legal firms are actively exploring use cases and assessing AI’s costs and benefits. Deloitte’s recent survey found that 79% of respondents believe AI will have a moderate-to-significant long-term impact on how legal work is performed. While lawyers are already using AI for tasks such as marketing, contract review and e-discovery, there is considerable scope for wider adoption. Goldman Sachs predicts that 44% of legal tasks can be automated by AI.

Common law firm use cases include the following:

• contract review – AI tools can identify key contract aspects, support contract negotiation and proofread, monitor and manage contracts over their duration;
• process automation – AI tools can support document filing, extract relevant information on matter closure and provide reminders for contract expiry, document registration, etc;
• prediction tools – AI tools can process historical data to deliver outcome predictions and support fee estimation;
• generative models – generative models are being used to draft documents, check accuracy and enhance work quality;
• research systems – AI-powered search engines can materially speed and improve research; and
• client onboarding – AI tools can streamline background checks for regulatory compliance.

Potential AI issues are as follows:

• cost and obsolescence – AI development is expensive, and the sheer pace of AI development opens up the opportunity for expensive AI projects to become obsolete fast; and
• infallibility – generative AI can generate false information and magnify errors.

Aspects of the current law will clearly apply to AI-enabled technologies. Liability may arise as a result of a contract breach, in which case the terms of the contract will set the liability, and the general laws of contract will address the remedies that may be available. Liability may also arise due to tort, as codified in Articles 282–298 of Civil Code Federal Law No 5/1985, as amended by Federal Law No 1/1987 Concerning Civil Transactions Law of the UAE. Liability may also be imposed by more general regulations, such as Federal Law No 15/2020 on Consumer Protection (the “Consumer Protection Law”) and various laws addressing data protection.

In simple terms, tort is founded on the principle that harm or injury caused to a person by another requires compensation. When it comes to AI, while an AI-enabled device is capable of learning and processing experience and making independent decisions based on its machine learning, which may cause damage, it is not regarded as a legal person and has no independent legal status.

The common approach to the challenges raised in tortious liability for damage caused by AI focuses on the following.

• Vicarious liability – usually addressing the responsibility of employers for the actions and omissions of their employees and principals for their agents. The key is the existence of a special legal bond. If AI-enabled technology causes damage in a way that is similar to damage caused by an employee or an agent, then it can logically be seen that the operator of the AI-enabled technology should be found responsible on a vicarious liability basis.
• Strict liability – usually associated with damage caused by something dangerous in the use or under the responsibility of a person, and where the complainant is relieved of the need to prove wrongdoing and a causal link between the wrongdoing and the loss. With AI-enabled technology, AI-enabled devices can be seen to have the potential to be dangerous (an autonomous-driven vehicle is an obvious example). Strict liability for designated AI-enabled products may be attractive to legislators.
• Fault-based liability – a fall-back position based on the imposition of a reasonable standard of care to avoid doing harm. In the AI context, the implied duty of care could attach to the choice of technology, as well as to the supervision and maintenance of the relevant devices.

If an AI-enabled device causes harm, loss or damage under the Civil Code, it can be seen that liability may lie with the person “having control” of the device. This takes us into the complex area of responsibility and control. With an AI-enabled device, responsibility and control may conceivably be found in a number of hands – the person operating the device, the business who supplied the AI application, the business that developed the AI or the software coder who designed the underpinning algorithm.

Under the Civil Code, the position is that when several persons are responsible for a prejudicial act, each of them is responsible for their share in it. Accordingly, the Civil Code opens up the opportunity for an apportionment of damages between the potentially liable persons. However, what has not been tested is how the UAE courts would go about that apportionment.

The Consumer Protection Law may also be relevant, as well as the recent Federal Law No 14/2023 (the “Digital Transactions Law”), detailing the consumer rights to fair compensation for damages suffered as a result of the purchase or use of defective goods.

With regard to insurance, there are elements of existing cover that may apply to loss incurred as a result of AI-enabled technology. It is entirely predictable that the insurance industry will craft AI-specific coverage.

This question is addressed in 10.1 Theories of Liability and elsewhere in this chapter.

The design and development of the underpinning algorithm and data used to train and improve AI applications introduces the possibility of bias. The generative nature of AI development then opens up the possibility of bias being exaggerated and hard-wired into the application. The potential unfairness and discrimination that can stem from bias needs to be evaluated and addressed when developing AI tools and when adopting AI-supported functionality.

Machine interpretation of demographically relevant statistics is inexorably linked to the quality and nature of the input data. Flaws in the base data can be exaggerated exponentially.

The dangers of bias are clear. Federal Decree-Law No 34/2023 on Combating Discrimination, Hatred and Extremism (the “Anti-Discrimination Law”) seeks to combat discrimination, hatred and extremism, prohibiting discrimination based on religion, belief, rite, community, sect, race, colour, ethnicity gender or race. The penalties for transgression include up to a year’s imprisonment and fines in the range of AED500,000 to AED1 million.

As has been seen, Article 38 (1) of the DIFC DPL provides that “the data subject shall have the right not to be subject to a decision based solely on automated processing including profiling which produces legal effects concerning him or her or significantly affects him or her”. More recently, the DIFC has introduced Regulation 10, an amendment to the current DIFC DPL that aims to introduce accountability and transparency measures into AI systems.

Also, as touched on in the foregoing, MoIAT is engaged in setting standards for AI technologies that seek to safeguard transparency and fairness. The UAE’s Ministry of AI, the UAE Artificial Intelligence and Blockchain Council and Smart Dubai also publish guidance designed to promote fairness and ethical behaviours in the adoption of AI technology.

The UAE is a keen adopter of facial recognition technology. In 2021, the UAE Cabinet approved the use of facial ID in certain sectors to verify the identity of individuals and cut paperwork. Facial recognition is now in widespread use. For example, Dubai International Airport uses CCTV cameras and AI-enabled facial recognition technology to enhance security. The airport’s smart gates are also equipped with facial and iris recognition technologies.

The primary pieces of legislation governing the use of facial recognition technology in the UAE are the Federal Data Protection Law and, where relevant, the DIFC DPL (together, the “Data Law”). The Data Law does not prohibit the collection or use of biometric data, although it places significant obligations and restrictions on data controllers handling such data.

Companies using facial recognition and biometric technology:

• are likely to be considered data controllers of their customers’ biometric data, and will need to comply with data protection principles and other obligations imposed on data controllers under the Data Law;
• should obtain specific, informed and freely given explicit consent from their customers for the collection and processing of their biometric data, and should consider offering alternative means of accessing services that do not involve biometric data;
• should provide clear and specific information to their customers about the purposes, scope and risks of biometric data processing, as well as their rights under the Data Law;
• should take appropriate measures to ensure the security and protection of the biometric data processed and avoid capturing irrelevant or incidental data relating to non-customers/non-consenting individuals; they should also implement measures to ensure that the data is anonymised or deleted when no longer needed for the purposes it is collected, or when consent is withdrawn; and
• should conduct a data protection impact assessment (DPIA) before biometric data is collected and processed – this is mandatory when processing sensitive data, such as biometric data, to evaluate the potential impact of the data processing on the privacy and rights of data subjects, and to identify and mitigate any risks.

Risk arises when the transparency and auditability of the automated decision-making (ADM) process is unclear – the so-called “black box” issue. The same issue impacts the ability of affected parties to challenge an ADM decision. It is necessary to accept that there is an identified concern with AI over the chance that AI models may have been trained on data repositories that introduce bias into the models.

The points raised in the context of the UAE data privacy regulations apply to ADM. See 3.6 Data, Information or Content Laws and 8.2 Data Protection and Generative AI.

Principle 3.3.2 of Smart Dubai’s Guidelines provides for the following.

• Developers should build systems whose failures can be traced and diagnosed.
• People should be told when significant decisions about them are being made by AI.
• Within the limits of privacy and the preservation of IP, those who deploy AI systems should be transparent about the data and algorithms they use.
• Responsible disclosures should be provided in a timely manner and provide reasonable justifications for AI systems outcomes. This includes information that helps people understand outcomes, like the key factors used in decision making.

Smart Dubai’s Ethical AI Toolkit states that traceability should be considered for significant decisions, particularly those that have the potential to result in loss, harm or damage, and that people should be informed of the extent of their interaction with AI systems.

Note, also, the requirement for disclosure in Regulation 10 of the DIFC DPL (see 3.6 Data, Information or Content Laws).

Legal and Regulatory Compliance

AI-specific regulation is being crafted and introduced internationally. AI solutions must comply with evolving legal and regulatory frameworks and be able to adapt to new legislation and the inevitable adjustment and definition of AI relevant legislation. As always, material challenges are posed by an uneven landscape of fluctuating regulation and a patchwork of country adoption (or not). The challenge is exacerbated for clients if they are operating in multiple jurisdictions.

AI contracts should:

• require compliance with all relevant law, regulations and guidance in existence at the commencement of the contract and as that law, regulation and guidance is amplified and amended over the life of the contract; and
• address liability for non-compliance with indemnification for any associated loss, damage, cost and fines.

Due Diligence

It is important for parties to carry out detailed due diligence on their AI solutions provider and on the AI solution being proposed. The adoption of due diligence questionnaires at the outset of engagements is now being seen.

Data Privacy and Security

The quantum of data used increases the risk of privacy breaches or data leaks, and the risk can be mitigated contractually by:

• establishing clear data-handling protocols, including encryption, anonymisation and access controls;
• specifying data ownership and breach notification procedures; and
• ensuring compliance with relevant regulatory data privacy and security requirements.

IP

Contracts should:

• clearly define IP rights, including ownership, licensing, and usage restrictions, where those rights need to address not only background IP but also foreground IP, including IP that may be generated by the AI solution; and
• provide for how IP infringement claims will be addressed and include provisions for third-party IP infringement claim indemnification.

Reputational Risk

AI solutions can produce biased or harmful outcomes, leading to reputational damage for businesses; these risks can be mitigated in the contract by:

• requiring the AI solution provider to adhere to ethical guidelines; and
• requiring the implementation of robust monitoring and auditing mechanisms to detect and rectify biases or unintended consequences.

Performance and Accountability

The procurement of developing technology always comes with a risk of the delivered functionality not meeting the aspirations that commissioned it. The contract should:

• provide a clear acceptance testing methodology to address failure to achieve acceptance;
• include milestones and linked payment to ensure the development and delivery remain on track (consider liquidated damages);
• set out performance metrics, service levels and service credits; and
• set out the basis for maintenance including bug fixing, updates and support – the contract should also consider the likely impact of a predictable period of rapid development of the AI solution.

Malicious Use

The risk of malicious use can be addressed in the contract by:

• specifying prohibited uses; and
• requiring adherence to the client’s security measures to prevent unauthorised access or misuse.

Lack of Transparency in the Functional Operation of the AI Solution, Fairness and Bias

The lack of transparency and bias challenges can be addressed in the contract by:

• requiring transparency from AI suppliers over the adopted model architecture and decision-making processes;
• including provisions for regular audits and periodic meetings for the supplier to explain the AI behaviour;
• providing for fairness assessments and establishing bias mitigation strategies; and
• monitoring for discriminatory outcomes.

Scalability and Performance Degradation

The contract should:

• specify the predictable scalability requirements and performance expectations;
• plan for system upgrades and capacity adjustments; and
• detail the change-management mechanism that parties will adhere to in order to address the inevitable need for the agreement to flex and adjust.

AI tools are being used in the UAE to screen curriculum vitaes (CVs) and identify the most qualified candidates based on their skills, experience, preferences and availability for interviews, filling roles based on those findings. Predictive AI is also used to determine which employees are most likely to leave a company and to assess employee performance metrics.

However, the use of AI in recruitment and employee dismissals could cause potential harm to employees and give rise to liability. AI algorithms, based on past hiring practices, could develop biases reflecting human biases in recruitment processes. Additionally, these algorithms may not account for candidates with neurodivergence, race, cultural background or disabilities, risking the enforcement of discriminatory practices.

Under Federal Decree-Law No 33/2021 (the “UAE Labour Law”), discrimination based on race, colour, sex, religion, national origin, social origin or disability is expressly prohibited. The Anti-Discrimination Law also addresses algorithmic bias.

Moreover, the UAE’s National AI Strategy 2031 and the establishment of the AIATC aim to ensure ethical AI practices and robust governance in the employment sector.

The use of AI as a performance review tool has become increasingly prevalent in workspaces. With the introduction of AI, employers have a more time-efficient, accurate way of measuring performance while minimising human error. Through employee evaluation software, algorithms can effectively monitor employee performance by tracking general progress, setting personalised goals for individual employees and providing transparent, personalised feedback to help employees understand their strengths and areas for improvement.

However, there are potential risks with using AI for monitoring purposes. While the performance index itself might be easily quantifiable, AI software often lacks context and nuance when monitoring employee performance. For example, software that bases performance output on average toilet breaks might unfairly mark down disabled or pregnant workers, which could give rise to discrimination claims. Additionally, AI software still holds the risk of bias if used with biased or misinterpreted data. Employees might also fear invasion of privacy and an invasive use of data with tracking and monitoring software, leading to a general distrust of performance assessments.

Employers must ensure full transparency and adherence to data privacy laws when implementing AI monitoring tools to avoid legal risks. In the UAE, this includes compliance with Federal Decree-Law No 45 of 2021 on Personal Data Protection, which ensures the confidentiality of information and protects the privacy of individuals. Employers should also check data sets for bias and ensure performance monitoring tools do not negatively affect individuals based on gender, race or other protected characteristics, as this could be grounds for discriminatory claims.

The UAE’s National AI Strategy 2031 and the establishment of the AIATC further support ethical AI practices and robust governance in the employment sector.

The UAE has been an enthusiastic adopter of AI. A recent KPMG survey identified that 61% of their surveyed businesses were set to invest in AI in 2025. Digital platform companies in the UAE using AI include the following.

• Real estate: Emaar has adopted AI to improve property management and customer experience. AI has been deployed to assist with preventative maintenance and to provide virtual tours for prospective buyers.
• Food delivery platforms: developers are using advanced technology to improve food delivery using secure payment systems, chatbots and location tracking. AI analyses what users like, suggests personalised recommendations, helps predict delivery times, finds the best routes and offers popular dishes based on individual preferences.
• Car service platforms: the Dubai Taxi Corporation, a division of the Roads and Transport Authority, has unveiled various digital solutions as part of its strategic plan for digital transformation, including the AI-enabled customer voice recognition system to verify a customer’s identity, AI chatbots responding to customer inquiries, a voice virtual assistant at the call centre to respond to customer requests and inquiries, a system for taxi demand prediction to distribute vehicles according to the entered data and a driver face recognition system.
• Retail: Majid Al Futtaim has integrated AI into its business to optimise inventory management and improve customer interface.

AI is used in various functions, including but not limited to the following.

• Fraud detection, where AI can improve payment security and reduce risk related to corruption or fraud.
• Risk management, where AI allows rapid processing of vast amounts of data, while cognitive computing assists in analysing both structured and unstructured data.
• Customer service, with the adoption of AI-based chatbots to expedite services to clients by providing timely financial guidance, responding to questions on customer accounts, facilitating rapid money transfers between accounts and processing loan applications. AI-enabled voice monitoring is also used to improve fraud detection. AI-driven chatbots can also assist with marketing and sales opportunities by analysing customer data and recommending appropriate financial products. Emirates NBD has created the Middle East and North Africa (MENA) region’s first intelligent voice-based and chatbot virtual assistant for banking, “EVA”.
• Fintech, such as digital payments where AI is deployed to enhance the speed and lower the costs of digital payments.
• Anti money laundering automation.
• Credit scoring.

Applicable Regulations/Initiatives

The UAE Central Bank is launching a key digital finance initiative as part of its Financial Infrastructure Transformation Programme.

The Ministry of Finance, in collaboration with the Artificial Intelligence, Digital Economy, and Remote Work Applications Office and the Mohammed Bin Rashid Centre for Government Innovation (MBRCGI), is also launching a platform to develop financial legislation and policies using digital solutions. This “Rules as Code” platform aims to build a comprehensive digital infrastructure for the creation of AI-based laws and regulations.

The Guidelines for Financial Institutions Adopting Enabling Technologies have been issued jointly by the Central Bank of the UAE, the Securities and Commodities Authority, the Dubai Financial Services Authority of the Dubai International Financial Centre and the Financial Services Regulatory Authority of Abu Dhabi Global Market.

Risks to Financial Services Companies from the Use of AI in UAE

The principal risks are those generally identified as relevant to AI. However, from a financial services perspective the following are relevant:

• risks of biases in repurposed data – in the context of AI being used in customer services and more complex decision-making processes such as credit scoring and risk assessment, the potential for biased AI outcomes becomes a significant concern;
• credit scoring and loan approvals – financial institutions can use AI models to automate credit scoring and loan approvals, but if the AI models are trained on biased data sets or incorporate historical biases, it can lead to discriminatory practices;
• automated trading and investment – AI-driven investment tools might develop biases based on historical data that favours investments in certain sectors or regions, potentially leading to unequal opportunities in wealth accumulation for individuals based on their profile characteristics;
• fraud detection – AI systems used for detecting fraudulent activities can inadvertently target certain demographics if the training data wrongly associates fraud with particular patterns related to ethnicity, location, or the transaction types typically used by specific groups;
• personalised marketing – AI that tailors financial product advertisements might perpetuate economic disparities by primarily promoting more favourable financial products, such as low-interest loans, to wealthier individuals or specific demographic groups, and other individuals may be exposed to advertisements for higher-risk options; and
• customer service chatbots – chatbots and similar AI-powered applications can also display biases during interactions, where for example they may offer varying responses or levels of assistance depending on the user’s demographic information.

The Health Data Law is the most applicable regulation relating to the use of AI in healthcare (although it does not expressly mention AI). Its provisions relate to informed consent, privacy protection, anonymisation and accountability have implications for the development, deployment and use of AI technologies in healthcare.

MOHAP is primarily responsible for the supervision of the use of AI in healthcare. The UAE has implemented regulations and guidelines to ensure the ethical use of AI in the UAE healthcare sector. The Department of Health Abu Dhabi (DOH) has issued their Policy on Use of Artificial Intelligence in the Healthcare Sector of Abu Dhabi, the aim of which is to enhance the reach and performance of healthcare-related services while minimising potential risks to patient safety and ensuring safe and secure AI use in healthcare management.

The Dubai Health Authority has implemented AI to enhance patient care and streamline its operations.

To address the chance of misdiagnosis and enhance treatment planning, MOHAP requires that AI devices and technology have continuous cycles of improvements and updates. Another requirement for AI is to ensure that the technology being used is auditable. This requirement ensures that any hidden biases in training data used will be addressed.

UAE healthcare has also seen the adoption of holographic technology for surgery planning, creating three-dimensional landscapes of a patient’s organs to provide doctors with a deeper understanding of a patient’s anatomy and enable greater precision in surgery.

Another use of AI algorithms in healthcare is the prediction of diseases by using data-mining software to identify patients who are at risk of developing specific conditions. By analysing personal data, algorithms can effectively reduce the rate of hospitalisation and fast-track treatment.

In relation to machine learning, the PDPL, DIFC DPL, ADGM Data Protection Regulations (DPR) 2021 and Health Data Law are the most relevant data regulations.

The Roads and Transport Authority in Dubai uses AI to manage traffic flow and reduce congestion through the analysis of traffic data and adjustment of traffic lights.

The UAE aims to enhance its efficiency, safety and sustainability through integrating AI in its transportation infrastructure, especially in autonomous vehicles. Dubai has set an ambitious strategy for the transformation of 25% of the city’s transportation to autonomous driving by 2030.

The Regulation of Autonomous Vehicles

In April 2023, the Dubai Government issued Law No (9) of 2023 Regulating the Operation of Autonomous Vehicles in the Emirate of Dubai (the “AV Regulations”). The AV Regulations govern the licensing and regulatory framework, as well as operational standards for autonomous vehicles. The Road Transport Authority (RTA) governs the use of autonomous vehicles and serves as a licensing, regulatory and investigative body.

Frameworks for AI Algorithms, Data Privacy, Cybersecurity and Vehicle Performance

The National Strategy referred to in the foregoing touched on AI governance in autonomous vehicles by setting standards for the development of AI algorithms that control these vehicles, ensuring they are safe and effective under various traffic conditions.

Regulations concerning vehicle performance typically focus on ensuring that autonomous vehicles meet specific safety and operational standards before they are allowed on public roads. This includes rigorous testing and certification processes, similar to those used in aviation and other safety-critical industries.

Ethical Considerations for ADM

The UAE is continuing to consider the development of ethical guidelines relating to the operation of autonomous vehicles and, in particular, how such vehicles should prioritise decision-making in unavoidable accidents.

International Harmonisation

The UAE is actively engaging with international bodies and participating in international discussions aimed at aligning its regulations and standards for autonomous vehicles and AI technologies while advancing its technological infrastructure.

In the UAE, there are no specific regulations that govern the use of AI in manufacturing products. The current regulation addressing product safety and liability will continue to apply to products manufactured in an AI-enabled fashion.

While there is currently an absence of AI-specific legislation, the National Strategy together with the guidance outlined in 5.1 Regulatory Agencies will be relevant.

There is no specific legislation that directly governs the use of AI in professional services. The current regulation addressing professional services will continue to apply to professional services that are AI-supported.

The considerations touched on in 9.1 AI in the Legal Profession and Ethical Considerations apply.

See 8.1 Specific Issues in Generative AI.

In many jurisdictions, whether AI can be considered an inventor or author for patent purposes has been a subject of debate. Traditional patent law usually requires a human inventor.

In the UAE, the position regarding AI inventors remains unclear, as the UAE Patent Office has not yet issued specific guidelines or decisions on this matter. However, UAE Federal Law No 38 of 2021 Concerning Copyright Rights and Neighbouring Rights (the “New Copyright Law”) generally requires a work to be original and the product of human creativity in order to qualify for protection. While AI systems can generate creative outputs, they are ultimately reliant on pre-existing data and algorithms. Consequently, the question arises as to whether AI-generated works can truly be considered original, or if they merely replicate existing material.

While there are no publicly available judicial or agency decisions by UAE authorities that explicitly address the status of AI as an inventor or co-inventor, UAE IP laws typically follow international standards, which generally do not recognise AI systems as inventors.

The UAE, like many other jurisdictions, allows for the protection of trade secrets and confidential information. AI technologies often involve complex algorithms, data sets and proprietary methodologies that can be considered trade secrets. By maintaining strict confidentiality and implementing appropriate security measures, companies can safeguard their AI technologies from unauthorised access, use or disclosure.

In the UAE, contractual arrangements such as non-disclosure agreements (NDAs) play an important role in protecting AI technologies and trade secrets by ensuring that employees, contractors and third parties maintain confidentiality. Companies should consider incorporating specific clauses into their contracts to address the ownership, non-disclosure and non-compete aspects related to AI. Additionally, contracts should outline the permitted use, access, and transfer of AI technologies and data, ensuring compliance with local laws and regulations.

In case of trade secret misappropriation or IP rights infringement, companies can seek legal remedies to enforce their rights and request compensation for damages. In the UAE, the courts provide a platform to protect trade secrets and IP through civil litigation and criminal penalties.

While there are currently no explicit provisions for the protection of AI-generated works in the UAE, there is potential for legal reforms reflecting the nation’s commitment to fostering innovation.

The New Copyright Law protects original literary and artistic works, including computer programmes. Under the New Copyright Law, the author is the person who creates the work, but AI-generated content is not explicitly addressed. This ambiguity poses challenges when it comes to determining ownership and protecting AI-generated works, as traditional copyright laws typically attribute authorship to human creators.

Using OpenAI, or any AI tool or platform, to create works raises several IP issues. The terms of use for these platforms often dictate the ownership of the output.

In the case of OpenAI and similar platforms, the user might retain IP rights to the unique output they generate if the platform’s terms of service allow it. However, where the AI contributes a substantial creative element, the question of authorship can be contentious. Users should be particularly cautious of the IP clauses within the terms of service agreements before using AI-generated output for commercial purposes.

There are also IP issues relating to the use of copyright works to train AI systems; for example, the works should be licensed by the rights holder for this type of use.

The last ten years or so in the EU have seen AI implicated in prosecutions for price-fixing activities, where AI has been used to monitor adherence to minimum re-sale price arrangements.

The relevant authorities are well aware of the potential anti-competitive use of AI-enabled tooling in the context of price setting, with tooling designed to monitor the pricing data of competitors and predict competitors’ reactions to market changes.

While the prosecutions referred to in the foregoing were AI-enabled infringements, it is uncertain how the relevant authorities would address a situation where the activities in question have been undertaken by an AI-enabled tool drawing on machine learning and taking an automated decision.

The UAE recently enacted Federal Decree-Law No 36/2023 on the Regulation of Competition (the “Competition Law”), which introduces provisions, controls and penalties designed to restrict anti-competitive behaviours. It will be important for companies using AI in price-setting to ensure compliance in order to avoid any antitrust violations.

No response has been provided in this jurisdiction.

No response has been provided in this jurisdiction.

The UAE has made significant strides in formulating AI strategies, frameworks and policies such as the UAE Strategy for Artificial Intelligence Ethics Guidelines and the AI Ethics Toolkit.

The principles and guidelines support industry, academia and individuals in understanding how AI systems can be used and provide a self-assessment tool for developers to assess their platforms. In addition, the UAE National Program for Artificial Intelligence has issued a guide for Best Practices for Data Management in Artificial Intelligence Applications.

The key issues for organisations to consider when implementing specific AI best practices are as follows:

• ethics – it is important for organisations to ensure that AI models adhere to ethical principles, such as transparency, fairness and accountability;
• regulatory compliance – organisations need to track adjustments to existing rules to address AI and keep a look-out for the inevitable enactment of AI-specific regulations;
• protection of IP – organisations should consider the IP aspects of AI use, including associated ownership and protection issues; and
• data privacy and security – since AI models rely heavily on data, organisations must ensure that AI implementation aligns with the applicable data privacy regulation and relevant industry best practice.