The UAE corporate landscape is divided broadly between mainland companies, commercial free zone entities and companies incorporated in the financial free zones, namely the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM). For mainland UAE companies, the principal corporate forms are those prescribed under Federal Decree-Law No 32 of 2021 on Commercial Companies, as amended (the “Companies Law”), namely general partnership companies, limited partnership companies, limited liability companies (LLCs), public joint stock companies and private joint stock companies. The Companies Law is the principal statute governing companies established in the UAE mainland. In practice, the limited liability company is the most common vehicle for privately held commercial businesses, joint ventures and family-owned companies in the UAE mainland.

A private joint stock company is less commonly used and is generally adopted for larger private groups, holding structures, regulated businesses or pre-IPO structures where a share-based capital structure and board-led governance model are required, but where the company is not intended to be listed as a public joint stock company. A public joint stock company is the principal form used where a company seeks to conduct a public offering, including through an IPO, and list its shares on an onshore UAE securities market. Branches and representative offices of foreign companies are also recognised, although they do not have separate legal personality from the parent company.

Free zone entities are also widely used in the UAE and are typically incorporated as free zone companies, free zone establishments or branches, depending on the regulations of the relevant free zone. These entities are primarily governed by the rules of the relevant free zone authority, although certain UAE federal laws may still apply. DIFC and ADGM companies are subject to separate companies law and regulatory regimes. For example, the DIFC Registrar of Companies receives, reviews and processes applications for entities seeking to establish a presence in the DIFC, while ADGM-registered entities are subject to annual filing obligations administered by the ADGM Registration Authority.

The principal sources of corporate governance requirements for UAE mainland companies are the Companies Law (including any implementing regulations), the company’s memorandum of association, resolutions, and the rules of the relevant licensing authority. For private companies, governance is generally driven by the Companies Law and its constitutional documents, including provisions on management authority, shareholder approvals, quorum, voting thresholds, transfer of shares, accounts and auditors. Additional governance requirements may apply where the company operates in a regulated sector – inter alia, financial services, banking, insurance, virtual assets or other regulated activities.

For companies whose shares are publicly listed, the governance framework is materially more prescriptive. Publicly listed UAE companies are generally public joint stock companies and are subject to:

• the Companies Law;
• the federal capital markets framework;
• the Corporate Governance Guide for Public Joint Stock Companies, originally issued pursuant to Securities and Commodities Authority Chairman Decision No 3/RM of 2020, as amended; and
• the listing, disclosure and market rules of the relevant exchange, principally the Abu Dhabi Securities Exchange (ADX) or Dubai Financial Market (DFM).

Federal Decree-Law No 32 of 2025 has replaced references to the Securities and Commodities Authority with the Capital Market Authority (CMA), and Federal Decree-Law No 33 of 2025 now regulates the UAE capital market framework.

The governance requirements applicable to publicly listed companies include rules on:

• board composition;
• directors’ duties;
• independence;
• board committees;
• conflicts of interest;
• related-party transactions;
• internal controls;
• risk management;
• external audit;
• shareholder rights;
• market disclosures; and
• annual corporate governance reporting.

The listed-company regime is therefore substantially mandatory and materially more detailed than the governance framework applicable to regular (ie, non-regulated) private companies.

The principal source of corporate governance requirements for UAE mainland companies is the Companies Law. Among other matters, it regulates corporate forms, incorporation, management, shareholder meetings, board and manager responsibilities, accounts, auditors, distributions, mergers, acquisitions and company dissolution. It also contains specific provisions for LLCs, private joint stock companies and public joint stock companies.

A company’s memorandum of association is also an important governance source. It regulates matters such as the company’s objects, share capital, shareholder rights, transfer restrictions, management authority, reserved matters, quorum, voting thresholds and profit distributions. In private companies – particularly LLCs and private joint stock companies – the constitutional documents and any shareholders’ agreement often provide the practical governance framework between the shareholders, subject to mandatory provisions of UAE law.

For listed public joint stock companies, the principal governance sources are the Companies Law, the federal capital markets legislation, the Corporate Governance Guide for Public Joint Stock Companies and the rules of the relevant securities market. The Governance Guide applies to public joint stock companies within its scope and addresses board structure, independence, board committees, disclosure, internal controls, risk management, related-party transactions and governance reporting.

Additional governance requirements may arise from sector-specific regulation. For example, UAE Central Bank-regulated entities, insurance-related businesses, investment firms, virtual asset service providers, financial free zone entities and other regulated companies may be subject to additional requirements concerning board composition, senior management, internal controls, risk management, compliance, audit, outsourcing and regulatory reporting. Accordingly, the applicable governance framework depends on the company’s legal form, place of incorporation, licensing authority, regulatory status and whether its securities are publicly listed.

Companies with shares publicly listed on UAE securities markets are generally public joint stock companies. These companies are subject to enhanced governance requirements under the Companies Law, the UAE capital markets framework, the Corporate Governance Guide for Public Joint Stock Companies, and the listing, disclosure and market conduct rules of the relevant exchange. The capital markets framework was materially updated by Federal Decree-Law No 32 of 2025 concerning the CMA and Federal Decree-Law No 33 of 2025 concerning the regulation of the capital market, both of which entered into force on 1 January 2026.

The principal governance requirements for listed public joint stock companies include requirements relating to board composition, board election, independence, non-executive directors, board committees, board meetings, conflicts of interest, related-party transactions, internal controls, risk management, external auditors, shareholder meetings, shareholder rights and disclosure. The board is responsible for the company’s strategic direction, supervision of executive management, protection of shareholders’ rights, approval of internal control and risk management frameworks, and compliance with applicable laws and regulations.

Listed companies are also required to establish board committees – inter alia, an audit committee and a nomination and remuneration committee. The audit committee typically oversees financial reporting, external audit, internal audit, risk management, internal controls and related-party transaction review. The nomination and remuneration committee generally addresses board nominations, board composition, remuneration policy and related governance matters.

Disclosure is a central component of the listed-company governance regime. Listed companies must:

• publish periodic financial information and positions;
• disclose material information to the market;
• comply with rules on insider dealings and related-party transactions; and
• prepare annual corporate governance reports.

The Governance Guide also requires transparency around board and senior management matters, committee activities, remuneration, major shareholders, internal controls and risk management.

These requirements are generally mandatory for public joint stock companies within scope. The UAE framework is therefore more prescriptive for publicly listed companies than for private companies. Private companies may voluntarily adopt enhanced governance arrangements, such as board committees, reserved matters, independent directors or formal internal control frameworks, but these are generally contractual or sector-specific rather than general mandatory requirements.

There have been recent developments affecting the UAE corporate governance and capital markets framework. The most significant recent development is the enactment of Federal Decree-Law No 32 of 2025 concerning the CMA and Federal Decree-Law No 33 of 2025 concerning the regulation of the capital market. These laws took effect on 1 January 2026 and replaced the former federal securities framework under Federal Law No 4 of 2000. The CMA is the legal successor to the former Securities and Commodities Authority (SCA), and references to the SCA in legislation are replaced with references to the CMA.

These reforms are relevant to corporate governance as listed companies, issuers and market participants now operate under a revised statutory capital markets framework. The new regime is expected to affect regulatory supervision, market conduct, offerings, licensing, disclosure and enforcement. From a governance perspective, listed companies should ensure that their board and compliance functions monitor the transition from the former SCA framework to the new CMA framework and assess whether existing policies, market disclosure procedures and compliance manuals require updates.

A further important development was the 2024 amendment to the Corporate Governance Guide through SCA Board Decision No 2/RM of 2024. The amendments came into effect in January 2024 and focused on strengthening internal controls, governance structure, reporting and compliance. They increased the emphasis on board responsibility for effective risk management and internal control systems, and placed greater importance on governance reporting and compliance oversight.

There was also a 2025 amendment (ie, SCA Board Chairman’s Resolution No 24 of 2025) allowing, under strict conditions, the combination of the roles of board chairman and chief executive officer or company manager for public joint stock companies. This is a significant governance development because the traditional governance position generally favoured separation between board chairmanship and executive management. Where a combined role is adopted, enhanced safeguards, shareholder approval and disclosure of the rationale and governance impact should be considered.

Accordingly, recent developments affect board structures, disclosure and shareholder rights. Listed companies should expect closer scrutiny of board oversight, internal control systems, risk management frameworks, governance reporting, related-party transactions, market disclosure procedures and shareholder approvals.

The governance and management of companies in the UAE broadly follow internationally recognised corporate governance structures. The principal bodies involved are:

• the shareholders (acting through the general assembly);
• the board of directors (or, in certain structures such as LLCs, a sole manager or board of managers); and
• the executive management team (including roles such as the general manager, CEO and other senior officers).

At the highest level, shareholders exercise ultimate authority over the company, including in relation to fundamental matters such as amendments to the constitutional documents, appointment and removal of directors, approval of financial statements, and decisions affecting the company’s capital or existence. The board of directors is responsible for the overall management and strategic direction of the company, subject to any matters reserved to the shareholders under applicable law or the company’s constitutional documents. The board typically retains responsibility for governance, oversight and key decision-making, while delegating day-to-day operational matters to executive management.

Executive management, led by the general manager or CEO, is responsible for the day-to-day operation of the business and implementation of the strategy set by the board. Their authority is usually derived from board resolutions, powers of attorney or the company’s constitutional documents.

In practice, there is a degree of flexibility in how powers are allocated and exercised. Decision-making authority is commonly delegated downwards (for example, from shareholders to the board, and from the board to management), while certain matters may be escalated upwards where required (for example, in cases of deadlock at board level or where reserved matters require shareholder approval). The precise allocation of powers will depend on the company’s legal form (eg, mainland LLC, joint stock company, or free zone entity such as in the DIFC or ADGM) and its constitutional arrangements.

Decision-making authority in UAE companies is typically divided between shareholders (general assembly), the board of directors (or managers) and executive management. The allocation of powers is governed both by law and by the company’s constitutional documents (eg, memorandum of association).

As a general principle, shareholders retain authority over fundamental and structural matters. These typically include approval of financial statements, declaration and distribution of profits, appointment and removal of directors or managers, appointment of auditors, and amendments to the company’s constitutional documents. Shareholders also approve major corporate actions such as changes to the company’s capital, mergers, dissolution or liquidation. In joint ventures and other negotiated structures, shareholders frequently agree on a list of “reserved matters” requiring enhanced approval thresholds (eg, unanimity or supermajority).

The board of directors (or board of managers, in the case of LLCs) is responsible for the overall management and strategic direction of the company. It exercises all powers necessary to achieve the company’s objects, except for those expressly reserved to shareholders by law or constitutional documents. The board typically approves business plans, budgets, financing arrangements, material contracts and investments, and oversees risk, compliance and governance matters. That said, certain significant transactions (such as disposals of substantial assets, long-term indebtedness, or transactions outside the ordinary course of business) may either be restricted or require prior shareholder approval, depending on the legal form of the company and its constitutional documents.

Executive management (such as the CEO or general manager) is responsible for the day-to-day operations of the company and implementation of the strategy set by the board. Their authority is usually broad in practice, particularly where the constitutional documents do not expressly limit their powers, but remains subject to oversight by the board and any specific delegations or restrictions imposed by it.

UAE law also provides for form-specific nuances. For example, in LLCs, managers are typically vested with full management powers unless restricted by the memorandum of association, while the general assembly retains authority over key corporate decisions. In joint stock companies, the board’s powers are more structured and subject to specific statutory limitations, with certain material actions requiring shareholder approval. In partnership-type structures (such as joint liability or limited partnership companies), management is often vested in the partners themselves, with unanimous consent required for key decisions unless otherwise agreed.

In addition to statutory rules, contractual arrangements play a significant role in practice. Shareholders’ agreements and constitutional documents commonly include detailed reserved matters, quorum requirements and escalation mechanisms. It is also typical for decision-making authority to be delegated downwards (eg, from shareholders to the board, and from the board to the general manager), while preserving escalation rights for material or deadlocked matters.

The decision-making process varies depending on the governing body and the company’s legal form, but is generally regulated by law and supplemented by the company’s constitutional documents.

Shareholders (General Assembly) typically adopt resolutions based on voting rights attached to shareholding, with voting power proportionate to the number or class of shares held. Decisions are taken at duly convened general assembly meetings, subject to quorum and majority requirements prescribed by law or the company’s constitutional documents. Ordinary matters are usually approved by a simple majority, while fundamental decisions (such as amendments to constitutional documents, capital changes or dissolution) often require a higher threshold (eg, supermajority). In some cases, written resolutions may also be permitted, provided statutory requirements are met.

The board of directors (or board of managers) generally makes decisions through board meetings, where each director has one vote. Resolutions are typically passed by majority vote, subject to quorum requirements. It is common for the chairman to have a casting vote in the event of a tie, if provided for in the company’s constitutional documents. Board decisions may also be taken by written resolution in lieu of a meeting, depending on the applicable legal framework and governance documents.

Executive management (including the general manager or CEO) does not typically operate through formal voting processes. Instead, decisions are made within the scope of authority delegated to them (whether under law, the company’s constitutional documents, board or shareholder resolutions, or powers of attorney). In practice, management acts autonomously in day-to-day matters, while material or non-routine decisions are escalated to the board or shareholders in accordance with internal approval frameworks.

Across all levels, the decision-making process is often further refined through contractual arrangements (such as shareholders’ agreements), which may impose enhanced quorum requirements, veto rights or escalation mechanisms, particularly in joint venture or closely held company structures.

The structure of boards of directors in the UAE varies depending on the company’s legal form and the applicable regulatory framework, but generally follows a single-tier board model.

In joint stock companies (particularly public joint stock companies), the board of directors is a formal governing body composed of a specified number of directors (typically within a statutory range), elected by the shareholders for a fixed term. The board must include a mix of executive, non-executive and independent directors, with independence requirements and governance standards more strictly regulated – particularly for listed entities. The board is usually supported by specialised committees, such as audit, nomination and remuneration committees, which play a key role in oversight and governance.

In LLCs, which are the most common corporate form in the UAE, there is greater flexibility. Management may be vested in a sole manager or multiple managers, and where there are several managers a “board of managers” may be established. Unlike joint stock companies, there is generally no mandatory requirement for independent directors or formal board committees, and the structure is largely driven by the memorandum of association and any shareholders’ agreement.

In free zone jurisdictions such as the DIFC and ADGM, board structures are more closely aligned with common law jurisdictions. Companies are typically required to have at least one director, and governance frameworks often encourage (and in some cases require) the inclusion of independent directors and the establishment of board committees, particularly for regulated entities.

Across all structures, the board operates collectively, with authority exercised through resolutions passed at meetings or by written resolution. The specific composition, appointment process, term and internal governance of the board are determined by a combination of statutory requirements and the company’s constitutional documents.

The roles of board members in the UAE generally align with internationally recognised governance principles, although the level of formality and regulation varies depending on the company’s legal form and whether it is listed or regulated.

At a general level, all directors owe duties to the company, including duties of care, diligence and loyalty, and are collectively responsible for overseeing the company’s management, setting its strategic direction and safeguarding its interests. Directors are expected to act in good faith, avoid conflicts of interest and ensure compliance with applicable laws and the company’s constitutional documents.

The chairman of the board plays a central leadership role, and is responsible for organising and presiding over board meetings, setting the board agenda, and ensuring that the board functions effectively. The chairman often acts as the primary interface between the board, shareholders and executive management, and may have a casting vote where provided for in the company’s constitutional documents.

Executive directors are typically involved in the day-to-day management of the company in addition to their board responsibilities. They provide operational insight to the board and are typically part of the senior management team (eg, CEO or general manager).

Non-executive directors are not involved in the daily operations of the business and instead provide independent oversight, strategic input and constructive challenge to executive management. Their role is particularly important in monitoring performance, risk and governance.

In larger or regulated entities – particularly public joint stock companies and entities in financial free zones such as the DIFC and the ADGM – independent directors are typically required. These directors are expected to be free from relationships that could impair their judgement, and play a key role in enhancing transparency, protecting minority shareholders and strengthening governance standards.

In joint stock companies, boards are also commonly supported by board committees, such as audit, nomination and remuneration committees, each with specific delegated responsibilities. Members of these committees – often led by independent or non-executive directors – focus on specialised areas such as financial reporting and controls, board composition and succession, and executive compensation.

Overall, while roles may overlap in smaller or closely held companies, there is an increasing trend in the UAE towards clearer delineation of responsibilities and stronger governance frameworks, particularly in regulated and investor-driven environments.

Board composition requirements in the UAE depend on the company’s legal form and whether it is subject to regulatory oversight, with more prescriptive rules applying to public and regulated entities and greater flexibility for private companies.

In public joint stock companies, the composition of the board is subject to detailed statutory and regulatory requirements. These typically include a minimum and maximum number of directors, election by shareholders for a fixed term, and compliance with corporate governance regulations issued by the regulator. Boards are generally required to include a mix of executive, non-executive and independent directors, with independent directors forming a specified proportion of the board. Additional requirements may apply in relation to gender diversity, expertise and the establishment of board committees (such as audit and remuneration committees), which must themselves meet independence and composition criteria.

In contrast, LLCs are subject to far fewer mandatory composition requirements. UAE law allows significant flexibility in structuring management, which may consist of a sole manager or multiple managers forming a board of managers. There are no statutory requirements for independent directors, board committees or specific expertise, and the composition is largely determined by the memorandum of association and any shareholders’ agreement. In mainland LLCs, where the number of shareholders reaches 15 or more, a supervisory board is required to be appointed to oversee management. In practice, composition in LLCs is often driven by commercial considerations, particularly in joint venture arrangements where shareholders seek board representation and veto rights.

In financial free zones such as the DIFC and ADGM, companies operate under frameworks more closely aligned with common law legal frameworks. While private companies generally retain flexibility, regulated entities (such as financial services firms) are subject to more robust governance requirements, including expectations around board size, independence, expertise and the establishment of board committees. Regulators in these jurisdictions place particular emphasis on the fitness and propriety of directors, as well as the overall effectiveness of the board.

Across all types of entities, it is common for constitutional documents and shareholders’ agreements to supplement statutory requirements by prescribing board composition, nomination rights, quorum thresholds and reserved matters. There is also a growing trend in the UAE towards enhanced governance standards, including increased focus on independence, diversity and sector-specific expertise, particularly in investor-backed and regulated environments.

The appointment and removal of directors or officers in the UAE are governed by a combination of statutory provisions and the company’s constitutional documents, with the level of formality depending on the company’s legal form.

In joint stock companies, directors are typically elected by shareholders at a general assembly for a fixed term, often through a cumulative voting mechanism designed to enhance minority representation. Shareholders also have the authority to remove directors, usually by way of an ordinary resolution, subject to any statutory protections or procedural requirements. Vacancies arising during a director’s term may be filled by the board on an interim basis, subject to ratification by shareholders at the next general assembly.

In LLCs, managers (who perform a function broadly equivalent to directors) are appointed either in the memorandum of association or by a resolution of the shareholders. They may be partners or third parties. Removal is typically effected by shareholders’ resolution. In practice, the appointment and removal process in LLCs is often more flexible and heavily influenced by shareholders’ agreements, particularly in joint venture structures.

In financial free zones such as the DIFC and ADGM, directors are generally appointed by shareholders (or incorporators, at the formation stage) and may be removed by shareholder resolution in accordance with the company’s articles. Regulated entities are subject to additional requirements, including regulatory approval for appointments and, in some cases, removals.

As to eligibility, UAE law imposes certain restrictions on who may act as a director or manager. These typically include requirements that the individual has full legal capacity and has not been convicted of offences involving dishonesty or breach of trust. Individuals who are disqualified under insolvency or bankruptcy laws, or who are otherwise prohibited by a competent authority, may also be restricted from acting as directors. In regulated sectors – particularly in financial services – directors are subject to “fit and proper” assessments by the relevant regulator, which consider factors such as integrity, competence, experience and financial soundness.

In addition to statutory restrictions, constitutional documents and shareholders’ agreements often impose further eligibility criteria (such as professional qualifications or shareholder nomination rights), particularly in regulated or investor-driven environments.

Rules relating to director independence and conflicts of interest in the UAE depend on the company’s legal form and whether it is subject to regulatory oversight, with more prescriptive requirements applying to public and regulated entities.

Across all company types, UAE law imposes duties on directors and managers to act in the best interests of the company and to avoid conflicts of interest. Where a director has a personal interest in a transaction or arrangement involving the company, they are generally required to disclose that interest to the board and, in many cases, refrain from participating in deliberations or voting on the relevant matter. Certain transactions involving conflicts may also require shareholder approval, particularly where they are material or fall outside the ordinary course of business.

In public joint stock companies, corporate governance regulations require a defined proportion of the board to comprise independent and non-executive directors. Independence is assessed by reference to the absence of relationships or interests that could impair a director’s judgement, such as material business relationships with the company, significant shareholding, or close ties to management. Independent directors play a key role in board committees – particularly audit and remuneration committees – where independence requirements are typically stricter.

In LLCs, there are no formal statutory requirements mandating independent directors. That said, managers remain subject to general duties of loyalty and good faith, and conflict-of-interest principles apply in a similar manner. In practice, independence is less formalised in LLCs – particularly in closely held or joint venture structures – where board representation is often aligned with shareholder interests. In such cases, conflicts are typically managed through contractual mechanisms, including reserved matters, disclosure obligations and approval thresholds.

In financial free zones such as the DIFC and ADGM, independence and conflict management frameworks are more closely aligned with common law legal frameworks. Regulated entities are subject to detailed governance rules, including requirements for independent directors, formal conflict-of-interest policies, and ongoing disclosure obligations. Regulators in these jurisdictions place particular emphasis on transparency, board effectiveness and the proper management of conflicts.

Overall, while the concept of director independence is well established in the UAE, its practical application varies significantly depending on the type of entity.

The principal legal duties of directors and officers in the UAE are derived from statute and widely recognised fiduciary and governance principles, which broadly align with international standards.

At a fundamental level, directors and managers are required to act in the best interests of the company and in furtherance of its objects. This includes a duty to exercise their powers in good faith and within the scope of the authority granted to them under law and the company’s constitutional documents.

They are also subject to a duty of care, skill and diligence, requiring them to act with the level of care that a reasonably prudent person would exercise in comparable circumstances. This encompasses informed decision-making, appropriate management oversight, and ensuring that the company complies with applicable laws and regulations.

One of the key obligations is the duty of loyalty, which includes avoiding conflicts of interest and not exploiting corporate opportunities for personal benefit. Directors must disclose any personal interest in transactions involving the company and, where applicable, refrain from participating in related decisions. They are also prohibited from competing with the company or engaging in activities that could prejudice its interests, unless authorised.

Directors and officers are further subject to duties relating to confidentiality and use of information, and must not misuse company assets, information or their position for personal gain or to the detriment of the company.

In addition, UAE law imposes specific statutory responsibilities, including maintaining proper accounting records, preparing and presenting financial statements, safeguarding the company’s assets, and ensuring compliance with corporate, tax and regulatory requirements. In certain circumstances such as insolvency or serious misconduct, directors may incur personal liability, including civil and, in some cases, criminal consequences.

Under UAE law, directors and officers owe their duties primarily to the company itself, as a separate legal entity. Their obligations are not owed directly to individual shareholders, but rather to the company as a whole, including (indirectly) its body of shareholders collectively.

In discharging their duties, directors are required to act in the best interests of the company, which is generally understood to mean promoting the company’s success and safeguarding its long-term viability. This includes acting in good faith, exercising powers for proper purposes, and avoiding conflicts of interest.

Directors are generally expected to act in the best interests of the company and, where relevant, to have regard to the interests of a broader range of stakeholders. For example, in situations of financial distress or potential insolvency, directors are expected to consider the interests of creditors and avoid actions that could prejudice their position.

A breach of directors’ duties in the UAE may be enforced through a combination of shareholder action, company action and, in certain cases, regulatory intervention, depending on the nature of the breach and the type of company.

As a general principle, the company itself is the primary party entitled to bring a claim against its directors or officers for breach of duty, typically acting through a resolution of the shareholders. In practice, this may involve the company pursuing compensation for losses suffered as a result of mismanagement, breach of duty or misuse of powers.

Shareholders may also have standing to take action in certain circumstances. This includes bringing claims against directors where a shareholder has suffered personal loss. Shareholders may also resolve to pursue liability claims against board members or remove them from office.

In regulated sectors, regulators may also take enforcement action against directors, including imposing fines, suspensions or disqualification from acting as a director, particularly where the breach involves regulatory non-compliance or misconduct.

The consequences of a breach can be significant. Directors may be held personally liable to compensate the company (or, in certain cases, shareholders or third parties) for losses arising from their breach. They may also be subject to removal from office and, in serious cases, disqualification from acting as a director in the future.

In addition, certain breaches (particularly those involving fraud or misappropriation of assets) may give rise to criminal liability, including fines and, in some cases, imprisonment. Liability exposure may also increase in situations of insolvency, where directors can be held accountable for wrongful or negligent conduct that prejudices creditors.

In addition to core breaches of directors’ duties, a range of other bases for claims or enforcement may arise under UAE law, depending on the nature of the misconduct and the company’s legal form.

From a civil liability perspective, directors and officers may be exposed to claims for negligence, mismanagement or breach of statutory obligations (for example, failure to maintain proper accounts, unlawful distributions, or acting beyond the scope of authority).

There is also potential exposure under insolvency and bankruptcy laws, where directors may be held liable for conduct that contributes to the company’s financial distress, including wrongful trading, dissipation of assets, or failure to take appropriate action once insolvency becomes apparent.

In regulated sectors – particularly financial services – directors and senior officers may face regulatory enforcement for governance failures, including breaches of licensing conditions, risk management obligations or internal control requirements. Regulators may impose administrative penalties, including fines, restrictions on functions, or disqualification.

As regards limitation of liability, UAE law generally prohibits the exclusion or limitation of liability for directors in respect of fraud, gross negligence, or breaches of core fiduciary duties. Any provision in a company’s constitutional documents purporting to exempt a director from liability for such acts is likely to be unenforceable.

Notwithstanding the above, in practice, companies may adopt mechanisms to mitigate (but not eliminate) liability exposure. These include obtaining directors’ and officers’ (D&O) insurance, as well as providing contractual indemnities in favour of directors, subject to legal limitations. Such indemnities typically exclude wilful misconduct, fraud or other non-indemnifiable acts.

The approval and regulation of remuneration for directors and officers in the UAE depend on the company’s legal form and whether it is subject to regulatory oversight, with more prescriptive requirements applying to public and regulated entities.

In joint stock companies, directors’ remuneration is subject to shareholder approval at the general assembly. The board may propose remuneration (including fees, bonuses or other benefits), but this must be approved by shareholders, usually on an annual basis. Additional compensation for executive roles (eg, where a director also serves as CEO) may be structured separately.

In LLCs, there is greater flexibility. Remuneration of managers is generally determined by shareholders’ resolutions or contractual arrangements. While there are no statutory caps, remuneration remains subject to general duties (including acting in the company’s best interests and avoiding conflicts of interest).

Failure to comply with applicable approval requirements may result in a range of consequences. These include the invalidity or unenforceability of the relevant payments, an obligation on the recipient to repay improperly received amounts, and potential liability for directors involved in approving or receiving such remuneration. In more serious cases (particularly where there is misconduct or breach of duty) regulatory sanctions or other legal consequences may arise.

In terms of disclosure, public joint stock companies are subject to relatively extensive transparency requirements. This typically includes disclosure of directors’ remuneration in the financial statements, which are presented to shareholders and made available to the market. Disclosure may cover aggregate remuneration, board fees and other benefits. In contrast, disclosure requirements for LLCs are limited and generally confined to what is agreed contractually or required for accounting purposes.

The relationship between a company and its shareholders in the UAE is based on the principle that the company is a separate legal entity, distinct from its shareholders. Shareholders do not manage the company directly but exercise their rights collectively through the general assembly, primarily in relation to fundamental or reserved matters. In return, they benefit from economic rights (such as dividends) and governance rights (such as voting and information rights), subject to the company’s constitutional documents and applicable law.

This relationship is governed by a combination of statutory provisions, the company’s constitutional documents (eg, memorandum of association) and, where applicable, contractual arrangements such as shareholders’ agreements. UAE law sets out core shareholders’ rights, including the right to attend and vote at general assemblies, receive dividends (where declared) and inspect certain company records. These rights may be supplemented or refined contractually, particularly in joint venture or closely held companies, where shareholders often agree on enhanced protections such as veto rights, reserved matters and exit mechanisms.

The extent of regulation varies depending on the company’s legal form. In public joint stock companies, shareholder rights and protections are more extensively regulated, including rules on general assemblies, disclosure, minority protection and related-party transactions. In LLCs, there is greater contractual flexibility, and the relationship between the company and its shareholders is more heavily shaped by the memorandum of association and any shareholders’ agreement.

As regards transparency, the availability of public records of shareholders depends on the type of company and jurisdiction. For public joint stock companies, shareholder information is generally maintained through share registers and, in the case of listed companies, through market infrastructure, with certain disclosures made publicly in accordance with securities regulations. In contrast, for LLCs and most private companies, shareholder registers are maintained internally or with the relevant licensing authority, but are not typically publicly accessible.

In financial free zones such as the DIFC and ADGM, companies are required to maintain registers of shareholders, and certain corporate information may be publicly available through public registries.

As a general principle, shareholders in the UAE do not participate in the day-to-day management of a company. Management authority is vested in the board of directors or managers, depending on the company’s legal form, while shareholders exercise their influence indirectly through their rights at the general assembly.

Shareholders are primarily involved in fundamental or reserved matters, such as appointing and removing directors or managers, approving financial statements, approving dividends, and approving significant corporate actions (eg, amendments to constitutional documents, capital changes, mergers or liquidation). Outside these matters, operational and strategic decisions are typically delegated to the board and/or executive management.

As a matter of law, shareholders cannot generally interfere directly in management or bind the company through individual actions. That said, they may influence management in several ways. First, through the appointment and removal of directors or managers, shareholders can shape the composition of the governing body responsible for decision-making. Second, certain matters are reserved to shareholders under applicable law, while additional approval rights and controls may also be agreed contractually, particularly through shareholders’ agreements and constitutional documents. These arrangements commonly include lists of “reserved matters” requiring shareholder approval before the company may take certain actions, such as entering into significant transactions, incurring debt above an agreed threshold or changing its business activities.

In joint ventures, it is common for shareholders to agree on enhanced governance rights, including veto rights, quorum requirements and escalation mechanisms. While these do not amount to direct management, they effectively allow shareholders to approve or block key decisions and thereby exert significant influence over the company’s direction.

Shareholder meetings are generally required under UAE law, although the level of formality and frequency depends on the company’s legal form and applicable regulatory framework.

In both joint stock companies and LLCs, an annual general assembly is typically required to be held within a specified period following the end of the financial year. The purpose of this meeting is to consider and approve key matters such as the company’s financial statements, directors’ or managers’ reports, auditor’s report, dividend distribution and the appointment or reappointment of auditors.

The calling and conduct of shareholder meetings are governed by statutory provisions and the company’s constitutional documents. Key requirements generally include the following.

• Notice: meetings must be convened with prior notice to shareholders, specifying the date, time, location and agenda. Only matters included on the agenda may be considered, subject to limited exceptions.
• Quorum: a minimum level of shareholder participation is required for the meeting to be valid. Quorum thresholds vary depending on the type of company and the nature of the resolution.
• Voting: resolutions are typically passed by a specified majority of votes, with voting rights proportionate to shareholding (unless otherwise provided). Higher approval thresholds apply to fundamental decisions.
• Representation: shareholders may attend in person or appoint proxies, subject to any restrictions in the law or constitutional documents.
• Minutes and record-keeping: proceedings must be properly documented and resolutions recorded in accordance with applicable requirements.

In public joint stock companies, the framework is more formalised, with detailed rules governing notice periods, disclosure, participation and regulatory oversight. In LLCs, the process is generally more flexible and may, in some cases, allow for written resolutions in lieu of meetings, depending on the constitutional documents and applicable law.

Shareholders in the UAE may bring claims against the company and/or its directors on a number of legal bases, depending on the nature of the alleged wrongdoing and whether the loss is suffered by the company or by the shareholders personally.

A key distinction is between claims brought on behalf of the company and claims brought by shareholders in their own capacity. As a general principle, where the alleged wrongdoing results in loss to the company (for example, mismanagement, breach of duty or misuse of assets), the claim is one for the company to pursue against its directors. That said, shareholders may, in certain circumstances, initiate such claims where the company fails or refuses to act, particularly in joint stock companies.

Shareholders may also bring direct claims where they have suffered personal loss as a result of unlawful conduct. This may include claims arising from:

• breaches of the company’s constitutional documents;
• invalid or improperly passed shareholder resolutions;
• dilution of rights or unequal treatment of shareholders;
• misrepresentation or failure to disclose material information in connection with share subscriptions or transactions; and
• abusive conduct by those in control of the company.

In addition, shareholders may challenge corporate decisions or transactions that are contrary to law. In such cases, courts may annul the relevant decisions or grant other appropriate remedies.

Claims may also arise in the context of related-party transactions, particularly in public joint stock companies, where regulatory frameworks impose specific approval and disclosure requirements designed to protect minority shareholders.

In regulated environments, shareholders may also have recourse to more structured remedies, including unfair prejudice claims and regulatory complaints.

Remedies available to shareholders may include damages, annulment of resolutions, injunctive relief and, in some cases, the removal of directors or other corrective measures.

Shareholders in publicly traded companies in the UAE are subject to a range of disclosure and transparency obligations, primarily aimed at ensuring market integrity and protecting investors.

In listed public joint stock companies, shareholders are generally required to notify the market and the relevant regulator when their shareholding reaches, exceeds or falls below specified ownership thresholds. These disclosure obligations apply to both direct and indirect holdings and are intended to provide visibility over significant shareholdings and changes in control. Ongoing disclosure is also required in respect of subsequent increases or decreases in holdings beyond prescribed thresholds.

In addition, shareholders (particularly controlling shareholders) may be subject to further obligations under securities regulations, including rules relating to market conduct, insider trading and, in certain cases, mandatory takeover offers where specified thresholds of control are acquired.

The UAE regulatory framework places increasing emphasis, particularly in regulated markets, on responsible shareholder conduct, engagement with companies, and compliance with applicable market rules and disclosure standards.

As regards ultimate beneficial ownership (UBO), UAE law requires companies (including public joint stock companies) to identify and maintain records of their ultimate beneficial owners, including individuals who ultimately own or control a specified percentage of the company or otherwise exercise control. This information must be maintained in internal registers and submitted to the relevant authorities.

UAE companies are required to maintain accounting records that accurately reflect their transactions and financial position. Under UAE law, companies must keep accounting records for at least five years from the end of the relevant financial year. The accounts must be prepared in accordance with applicable accounting standards and must enable shareholders to verify the company’s financial position.

LLCs and joint stock companies are generally required to appoint one or more auditors and to prepare annual financial statements. For public joint stock companies, the board must prepare the annual accounts and present them, together with the auditor’s report, to the general assembly. UAE law contains detailed provisions on the approval of accounts, auditor reporting and submission of accounts to the competent authority and capital markets regulator.

Listed companies are subject to additional periodic financial reporting and disclosure obligations under the capital markets framework and the rules of the relevant market, including the ADX or DFM. These generally include audited annual financial statements, interim financial statements and disclosure of material information that may affect the price or trading of securities. Companies incorporated in the DIFC or ADGM are subject to separate accounting and filing requirements. For example, ADGM companies and LLPs must generally file annual accounts with the ADGM Registration Authority, unless an exemption applies.

Public joint stock companies and listed companies are required to disclose their corporate governance arrangements through annual corporate governance reporting and other market disclosures. The Corporate Governance Guide requires listed public joint stock companies to report on the board, board committees, senior management, internal controls, risk management, external auditors, related-party transactions, remuneration, shareholder rights and compliance with applicable governance requirements.

Recent amendments have increased the focus on internal controls, risk management and governance reporting. In particular, the 2024 amendments to the Governance Guide introduced more detailed expectations concerning internal controls, governance oversight, reporting and compliance mechanisms.

Private companies are generally not subject to the same level of public corporate governance disclosure. Their governance arrangements are mainly contained in their constitutional documents and shareholders’ agreements, which are not usually publicly available in full. However, additional disclosure requirements may apply where the company is regulated, incorporated in a financial free zone (ie, DIFC or ADGM), subject to financing arrangements, or required to submit information to a licensing authority, registrar or sector regulator.

Mainland UAE companies are incorporated and licensed through the competent economic department or licensing authority in the relevant Emirate, such as the Department of Economy and Tourism in Dubai or the relevant Department of Economic Development in other Emirates. The UAE Ministry of Economy identifies the company registrars within the UAE, including the economic departments of the Emirates and relevant free zone registrars.

The incorporation process generally requires:

• selecting the legal form and licensed activity;
• reserving the trade name;
• obtaining initial approval;
• preparing the memorandum and articles of association or other constitutional documents;
• providing shareholder and manager/director information;
• identifying the registered office; and
• obtaining the relevant licence.

The Ministry of Economy notes that mainland companies may be established through the relevant Department of Economic Development or through digital platforms.

Free zone companies are incorporated through the registrar or authority of the relevant free zone. DIFC entities are registered through the DIFC Registrar of Companies, while ADGM entities are registered through the ADGM Registration Authority. The applicable filing requirements depend on the relevant jurisdiction, legal form and activity. The applicable filing requirements depend on the relevant free zone, legal form and licensed activity, and may include licence renewals, confirmation statements, changes to registered particulars, financial statements or accounts, beneficial ownership information and other event-driven filings. By way of example, in the DIFC and ADGM, companies are generally required to file an annual confirmation statement with the Registration Authority.

Typical filings include incorporation documents, constitutional documents, shareholder and director/manager particulars, licence applications, registered office details, changes to shareholders, directors, managers or authorised signatories, share capital changes, licence renewals, annual filings and beneficial ownership information. Under Cabinet Decision No 109 of 2023 on regulating beneficial owner procedures, legal persons are required to maintain and submit beneficial owner information and partner or shareholder registers to the relevant registrar, and to update changes within the prescribed period.

Public availability depends on the relevant registry. Basic licence information may be available through official licence search portals and the UAE National Economic Register, which allows businesses to view certain licence details maintained by government authorities. In the DIFC and ADGM, public registers are also available which provide access to certain company information, including details relating to current and former shareholders and directors. That said, constitutional documents and beneficial ownership records are generally not publicly available.

Failure to make required filings may result in administrative penalties, licence suspension, inability to renew the licence, restrictions on amendments or other regulatory action, depending on the applicable registry and breach.

Registrars have supervisory powers to receive, maintain and update corporate information, review filings, require corrections, impose or recommend administrative measures, suspend or refuse licence renewals, and share information with competent authorities. Under the beneficial ownership framework, registrars also play a role in maintaining beneficial ownership data and supporting AML/CFT transparency requirements.

The UAE’s AML/CFT framework applies primarily to financial institutions, designated non-financial businesses and professions, virtual asset service providers and other regulated persons. However, regular (ie, non-regulated) companies are also affected through beneficial ownership, licensing, sanctions, record-keeping and corporate transparency requirements. The current federal AML framework is prescribed in Federal Decree-Law No 10 of 2025 on anti-money laundering, combating the financing of terrorism and proliferation financing, together with its executive regulations and supervisory authority rules.

Generally, entities must identify, assess, document and update their money-laundering, terrorist-financing and proliferation-financing risks. They must also apply customer due diligence, monitor transactions, maintain records, implement internal policies and controls, appoint appropriate compliance personnel where required, and report suspicious transactions to the UAE Financial Intelligence Unit without delay where there are suspicions or reasonable grounds for suspicion.

Boards and senior management are expected to oversee AML/CFT compliance through a risk-based framework. In practical terms, this requires the board or senior management to:

• approve AML policies and procedures;
• ensure that adequate systems and controls are implemented;
• appoint and empower compliance personnel;
• receive compliance reporting;
• oversee remediation of deficiencies; and
• ensure that suspicious transaction reporting and sanctions screening procedures operate effectively.

The level of oversight expected will depend on the company’s regulatory status, size, activities, customer base and risk profile.

Sanctions compliance is also central to the UAE AML/CFT framework. The UAE implements financial sanctions under Cabinet Resolution No 74 of 2020, which concerns terrorism lists and the implementation of UN Security Council resolutions relating to terrorism financing, proliferation of weapons of mass destruction and related matters. The UAE Ministry of Economy states that, as a UN member, the UAE implements Security Council sanctions through this framework.

Directors and managers may face personal liability where AML/CFT non-compliance is attributable to their knowledge, involvement or breach of duties. Under the AML framework, supervisory authorities may impose administrative measures, including fines, restrictions on powers, suspension or replacement of management, suspension of activities and licence-related sanctions. Criminal liability may also arise where an offence is committed by a legal person and the person responsible for actual management was aware of the offence and the offence occurred because of a breach of their duties.

Under UAE law, LLCs and joint stock companies are generally required to appoint one or more auditors in connection with their annual financial statements. The auditor must audit the company’s accounts and prepare a report for the shareholders.

For public joint stock companies, the auditor is nominated by the board and appointed by the general assembly. The general assembly determines the auditor’s remuneration, and the auditor must be independent from the company and its board and management. The auditor is required to review the company’s accounts, report on the financial statements and raise relevant matters to the shareholders in accordance with UAE law and applicable governance and capital markets requirements.

The relationship between the company and the auditor is governed by statutory independence, appointment, reporting and rotation requirements. For public joint stock companies, UAE law imposes restrictions on the duration for which the same audit firm and responsible audit partner may audit the same company. The auditor must not perform work that compromises independence and must report irregularities or matters required by law or regulation.

Recent governance developments have also increased the auditor’s role in relation to internal controls and risk management for public joint stock companies. The 2024 amendments to the Corporate Governance Guide increased the focus on internal control systems, risk management frameworks and reporting, with external auditor involvement in assessing or reporting on the effectiveness of these frameworks.

Geopolitical risk is not typically addressed under a standalone corporate governance framework of general application in the UAE. However, it is addressed indirectly through broader requirements relating to risk management, internal controls, AML/CFT, sanctions, export controls, market disclosure, cyber-risk, business continuity, supply chain risk and sector-specific regulation. For listed public joint stock companies, the corporate governance framework requires a formal approach to internal controls and risk management, and recent amendments have strengthened board responsibility for the effectiveness of those systems.

At board level, geopolitical risk would usually be considered by the board itself, the audit committee, a risk committee or the relevant compliance function, depending on the company’s governance structure and regulatory profile. In practice, this may include oversight of high-risk jurisdictions, sanctions exposure, counterparty risk, supply chain disruption, foreign exchange restrictions, financing restrictions, export controls, political instability, insurance coverage and business continuity planning.

For listed companies, the board is expected to ensure that the company has an appropriate internal control and risk management framework. The audit committee typically has a central role in reviewing financial reporting, internal audit, internal controls and risk management. Senior management is responsible for implementing board-approved policies and controls, while the board retains ultimate oversight responsibility.

Sanctions compliance is more directly regulated. UAE companies are generally expected to:

• screen customers, counterparties and beneficial owners against applicable UAE and UN sanctions lists;
• comply with applicable asset freeze obligations without delay;
• avoid making funds or economic resources available to designated persons;
• submit required reports; and
• maintain appropriate records.

The UAE Central Bank describes targeted financial sanctions implementation as requiring awareness of sanctions lists, screening, freezing without delay and reporting.

Board-level oversight of sanctions compliance is therefore expected where the company has material sanctions exposure or operates in a regulated sector. This includes:

• approving sanctions policies;
• ensuring that screening systems are effective;
• assigning clear responsibility to compliance personnel;
• reviewing high-risk relationships;
• monitoring remediation of breaches; and
• ensuring that sanctions compliance is integrated into AML/CFT and counterparty due diligence procedures.

Where sanctions or AML breaches occur because directors or managers failed to implement adequate controls or ignored known risks, personal regulatory or criminal liability may arise.

ESG reporting requirements in the UAE are not governed by a single unified framework. Rather, ESG reporting obligations depend on the type of entity, the jurisdiction in which it operates, and sector. The entities which are required to report on ESG issues, and the key requirements for ESG reporting for such entities, are as follows:

Public joint stock companies listed on the ADX and DFM, as per the Public Joint Stock Companies Governance Manual introduced by the SCA (the “Governance Manual”) – now the CMA, Decision No 3/RM/2020 – are required to publish an integrated report, which must include a sustainability report alongside financial, management feedback, and governance reports within the first three months of the financial year, or at least ten days before the annual general assembly, whichever comes first. 

Companies operating in the ADGM, provided they meet particular financial threshold conditions that are based on turnover (more than USD68 million in a financial year) or assets under management (more than USD6 billion at any time during a financial year), are subject to ESG disclosures on a “comply or explain” basis. Such entities are required to disclose information necessary to understand the company’s development, strategy, performance and position by reference to ESG matters. The disclosure must be prepared by reference to an internationally recognised ESG framework (Carbon Disclosure Project, Global Reporting Initiative, etc) and is encouraged by the ADGM to be publicly available.

Entities that have not complied with the necessary ESG disclosures must provide an explanation for any non-compliance. In the DIFC, sustainability and ESG considerations are increasingly reflected through policy initiatives, sustainable finance frameworks and regulatory developments, particularly in relation to DFSA-regulated entities and investment products. The DIFC has publicly emphasised sustainability as a strategic priority and has adopted initiatives aligned with broader UAE and Dubai government programmes relating to climate action, renewable energy, sustainable development and net zero objectives. These initiatives are generally framed around ESG principles and are intended to encourage alignment with internationally recognised ESG standards and sustainable business practices.

Entities whose activities result in greenhouse gas emissions, pursuant to Federal Decree-Law No 11 of 2024, are obligated to measure, retain emissions data, and submit periodic reports to the Ministry of Climate Change and Environment.       

The UAE is moving towards a more structured and enforceable ESG framework with legislative changes focused on all the components of ESG.               

On the environmental component of ESG, a material shift is reflected in the introduction of climate-related obligations under Federal Decree-Law No 11 of 2024 (as discussed previously; see 7.1 ESG Requirements). While the framework itself introduces structured emissions reporting requirements for greenhouse gas-emitting companies in the UAE, a key development in the consideration of ESG issues is also the imposition of sanctions for non-compliance ranging from AED50,000 to AED2 million for first violations, and double such sanctions amounts for repeated violations occurring within the first two years.

The social component of ESG is also developing, particularly through board diversity requirements for public joint stock companies. Under the Governance Manual (see again 7.1 ESG Requirements), listed companies must have at least one female board member and disclose that representation in the annual governance report. Boards are also required to adopt policies on gender diversity and procedures to achieve those objectives.

Governance is also a central area of ESG development. The Governance Manual imposes substantive governance requirements on listed companies, including minimum thresholds for board composition and structure. In particular, at least one third of the board must comprise independent directors, and the majority of the board must be non-executive. In addition, boards are required to establish formal internal control and risk management systems, adopt written policies addressing conflicts of interest and ethical conduct, and implement mechanisms for reporting violations, including whistle-blowing channels.

In parallel, whistle-blowing and anti-corruption frameworks continue to be developed across the mainland UAE, DIFC and ADGM. Further, continued shift is reflected in the increasing formalisation of whistle-blowing and internal accountability frameworks across the UAE. In the ADGM, the Whistleblower Protection Regulations 2024 introduce mandatory requirements for entities to implement structured whistle-blowing arrangements, including internal reporting channels, written policies, confidentiality safeguards and record-keeping mechanisms. Similarly, in the DIFC, the DFSA whistle-blowing regime (introduced under amendments to the Regulatory Law 2004) requires regulated entities to establish effective policies and procedures for the reporting, assessment and escalation of regulatory concerns, together with protections for whistle-blowers. Onshore, while there is no standalone whistle-blowing statute, equivalent outcomes are achieved through broader legislative frameworks. In particular, the UAE Penal Code (Federal Law No 31 of 2021) criminalises bribery and corruption and includes provisions addressing failure to report criminal conduct, alongside mechanisms that may incentivise early reporting.

While the UAE has introduced various AI-related strategies, policy initiatives and ethical guidance frameworks, there are currently no generally applicable UAE laws or regulations specifically prescribing board-level oversight structures for AI, such as mandatory board composition requirements, dedicated AI committees or formalised AI risk governance frameworks.

AI use-related risk and use cases are addressed through a combination of non-binding policy frameworks and existing legislation that apply to technology use more broadly. Such policy frameworks and legislation include the following.

The AI Ethics Guide

The AI Ethics Guide, issued by the UAE’s AI Office in December 2022, sets out key ethical principles for the responsible development and use of AI, including fairness, transparency, accountability, privacy and safety. It also requires organisations to identify and mitigate risks inherent in AI systems, assess the potential impact of incorrect automated decisions, and implement safeguards to address bias and the risk of loss, harm or damage, particularly where AI is used in significant or high-impact decision-making.       

The UAE Charter for the Development and Use of Artificial Intelligence

The UAE Charter for the Development and Use of Artificial Intelligence, introduced in June 2025, sets out core principles such as fairness, safety, transparency, human oversight and accountability, aimed at ensuring AI systems are deployed responsibly. These principles address risks associated with, for example, biased decision-making and privacy concerns.

The UAE National Strategy for Artificial Intelligence 2031

The UAE National Strategy for Artificial Intelligence 2031, introduced in October 2017, reinforces the need for strong governance and effective regulation, recognising that the increasing adoption of AI creates risks to society, cybersecurity vulnerabilities, and broader economic and operational exposure. The strategy envisages the development of governance frameworks, regulatory review mechanisms and international co-operation to ensure AI systems are deployed safely and responsibly.       

The DIFC Data Protection Regulations

The DIFC Data Protection Regulations, introduced in 2020, were amended in 2023 to address the use of autonomous and semi-autonomous systems (such as AI) in the context of personal data processing, highlighting both its growing importance and the associated risks. The framework requires organisations to adopt appropriate safeguards to protect personal data, and regulates how data is used in digital and communication services, including obligations around transparency and privacy-focused configurations to align with evolving AI applications.                     

Other Key Developments Regarding AI

Developments relating to AI governance and regulation continue to emerge in the UAE. In 2025, this included the introduction of mechanisms designed to support the integration of AI into the legislative process through the Regulatory Intelligence Office.

The UAE has also established dedicated governmental bodies and initiatives focused on AI development and governance, including the Ministry of State for Artificial Intelligence and the UAE AI Office, which have played a key role in developing national AI strategies, ethical guidance and broader governance initiatives. While the UAE has seen increasing policy and regulatory attention directed towards AI governance and responsible AI use, there is currently no generally applicable UAE legislation expressly requiring specific corporate governance structures for AI oversight, such as prescribed board composition requirements, dedicated AI committees or formalised AI governance frameworks.

In practice, responsibility for AI-related strategy, risk management and oversight would typically fall within the remit of the board of directors under general corporate governance principles, often supported through internal risk, audit, technology or compliance functions.

There is no standalone AI regime in the UAE that tackles liability exposures for boards and officers arising from AI use, or any specific enforcement authorities. AI-related liability issues are addressed through existing legislation, such as the following.       

Federal Decree-Law No 25 of 2025 (the “Civil Transactions Law”) provides a general framework for liability arising from negligent conduct, which may extend to situations where harm results from the design, deployment or oversight of AI systems.

Federal Decree-Law No 45 of 2021 on Personal Data Protection plays a key role in the AI context by requiring organisations to handle personal data in a lawful and controlled manner. It also obliges entities to put in place appropriate controls to reduce the risk of AI systems producing outputs that breach applicable laws.

Federal Decree-Law No 38 of 2021 on Copyright and Neighbouring Rights, together with Cabinet Decision No 47 of 2022, forms the core federal IP framework applicable to AI-related assets, including algorithms, inputs and outputs. This regime is particularly relevant in regulating the use of third-party intellectual property, which is often embedded in AI systems that rely on large datasets and existing content.

At present, there are no mandatory disclosure requirements relating to AI use, strategy, governance, risks, incidents or controls.