Introduction

On 14 June 2026, H.H. Sheikh Mohammed bin Rashid Al Maktoum approved the establishment of the UAE Artificial Intelligence and Data Authority (the “Authority”). The Authority is a single national body reporting directly to the UAE Cabinet, with responsibility for artificial intelligence, data governance, and digital government across the federation.

This is a significant institutional development. It is not, however, the introduction of a standalone artificial intelligence law. Organisations operating in the UAE should understand both what has changed and what remains to be determined.

What Has Changed

The Authority consolidates functions previously held by three separate bodies:

The Office of Artificial Intelligence, Digital Economy and Remote Work Applications; the Digital Government Sector within the Telecommunications and Digital Government Regulatory Authority (“TDRA”); and the UAE Data Office.

The Authority will be chaired by Omar Sultan Al Olama, Minister of State for Artificial Intelligence, Digital Economy and Remote Work Applications. By merging overlapping mandates into a unified structure under Cabinet, the UAE has signaled that it views AI strategy, data policy and digital government as a single governance challenge rather than parallel workstreams.

Mandate and Scope

Based on official announcements, the Authority’s mandate includes:

developing and leading the national AI strategy; increasing the digital economy’s contribution to GDP; managing government data to improve quality, availability, and cross-entity sharing; operating AI-powered national data platforms; setting standards and guidelines for data management, AI deployment, digital transformation, and government services; ensuring compliance across federal entities; supporting cybersecurity and government information security; and strengthening international coordination and partnerships.

At this stage, the publicly stated mandate is primarily federal-government-facing. It should not be assumed that the Authority already exercises direct regulatory or enforcement powers over the private sector. Whether such powers will follow—and in what form—remains an open question.

Why It Matters: From Strategy to Coordinated Implementation

The UAE has, for several years, pursued an ambitious AI and digital economy agenda. The UAE Strategy for Artificial Intelligence supports the UAE Centennial 2071 programme, and in April 2026, the Cabinet announced an objective to transition 50 per cent of federal government sectors, services, and operations to agentic (autonomous) AI within two years.

Until now, that agenda was delivered through a combination of national strategies, sector-specific rules, emirate-level initiatives, and free-zone frameworks. This approach allowed flexibility and rapid adoption but risked fragmentation, inconsistency, and gaps—particularly as AI systems become more complex and their data requirements more demanding.

The Authority represents a shift from strategy and experimentation toward coordinated institutional governance. Centralising AI, data and digital government policy in a single body creates the conditions for unified standards, consistent oversight and integrated compliance—even before new legislation is introduced.

The Current Legal Position: No Horizontal AI Statute

The UAE does not currently have a single comprehensive horizontal AI law comparable to the EU AI Act. The legal and regulatory framework for AI and data in mainland UAE comprises several layers:

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”), in effect since January 2022, which applies to personal data processing in onshore UAE (excluding DIFC and ADGM); federal cybercrime legislation; sector-specific regulatory requirements (e.g., Central Bank, Securities and Commodities Authority, and Department of Health guidelines on AI/technology adoption); free-zone data protection regimes in DIFC and ADGM, which operate independently of the federal PDPL; the UAE Charter for the Development and Use of Artificial Intelligence, a non-binding instrument emphasising transparency, accountability, human oversight, safety, privacy, and compliance with existing legislation; and emirate-level initiatives and smart-city strategies.

Notably, the implementing regulations for the PDPL have not been formally issued as of the date of this article, and the enforcement regime remains uncertain. Practitioners should continue to monitor regulatory developments closely.

Distinguishing the Authority from a Comprehensive AI Law

The creation of an institutional authority is distinct from the promulgation of a binding legislative framework. The Authority may in due course develop regulations, mandatory standards, certification requirements, or procurement frameworks, but the legal instruments, scope, obligations, and enforcement mechanisms have not yet been published. Organisations should treat this as a signal of regulatory direction, not the enactment of immediate new compliance obligations.

Data Governance as the Foundation for AI Governance

The consolidation of data policy within the Authority underscores a fundamental point: AI governance is inseparable from data governance. Any regulatory framework addressing AI deployment must address the quality, provenance, security, availability, and lawful processing of the data on which AI systems rely.

For organisations operating in the UAE, the practical implication is that readiness for future AI regulation begins with data readiness—including compliance with the PDPL, robust data quality and lineage practices, defensible cross-border transfer mechanisms, and security measures proportionate to the sensitivity and volume of data processed.

Practical Impact for the Private Sector

Although the Authority’s stated mandate is currently focused on the federal government, private-sector organisations should not regard this as irrelevant. In practice:

Vendors and contractors supplying AI systems, cloud services, or data platforms to government are likely to face new procurement standards, certification, or audit requirements as the Authority operationalises its mandate. Organisations holding or processing government data may be subject to enhanced data-quality, sharing, and security expectations. Standards developed for the public sector frequently become de facto benchmarks that shape private-sector practice, investor expectations, and contractual requirements. Future regulatory instruments issued by the Authority may extend obligations to private-sector actors, particularly in higher-risk domains.

It is premature to state that new binding obligations have been imposed on the private sector. However, proactive preparation is commercially prudent.

Sectoral and Free-Zone Considerations

Sector-specific and free-zone regulatory frameworks remain in force. AI and data-related obligations in the financial sector (Central Bank, SCA, DFSA, and FSRA), healthcare (Department of Health and DHA), and telecommunications (TDRA) continue to apply alongside federal-level developments. DIFC and ADGM maintain independent data protection regimes.

The interaction between the Authority’s future outputs and existing sectoral and free-zone rules is not yet defined. Organisations subject to multiple regulatory regimes should monitor for any statements of coordination, primacy or mutual recognition.

What Remains Unclear

Key questions that have not yet been answered by official sources include:

the legal instrument(s) through which the Authority will exercise its mandate (federal decree, regulation, binding standards, guidance, or procurement frameworks); whether the Authority will have direct enforcement powers, and if so, over which entities (federal, private sector, or both); how the Authority will interact with existing federal, emirate-level, and free-zone regulators; whether future outputs will take the form of binding regulation, voluntary codes, certification schemes, or contractual procurement standards; and the timeline for publication of further instruments.

Practical Steps for Businesses

Organisations operating in the UAE—particularly those deploying AI, processing large volumes of data, or contracting with government entities—should consider the following steps:

Conduct an AI use-case inventory: Identify where AI is deployed across the organisation, including third-party tools and embedded AI features. Map data flows: Understand what personal and non-personal data feeds AI systems, where it is stored, how it is processed, and on what lawful basis. Review privacy and security controls: Ensure compliance with the PDPL (to the extent operational) and applicable sector-specific requirements. Audit vendor and procurement contracts: Assess whether existing arrangements with AI/data suppliers anticipate regulatory change, certification requirements, and audit rights. Establish AI governance policies: For higher-risk applications, include human oversight, bias testing, transparency, and record-keeping obligations. Monitor Authority publications: Subscribe to official channels for new standards, guidance, and consultation papers. Engage with consultation processes: Participate in industry consultations as they emerge.

Conclusion

The establishment of the UAE Artificial Intelligence and Data Authority is a clear institutional signal that AI, data, and digital government will be governed as an integrated discipline at the national level. It does not, in itself, create new legal obligations—but it creates the institutional infrastructure from which such obligations are likely to follow.

For boards and senior management, the message is straightforward: AI and data governance should be treated as a board-level priority, not solely a technology function. Organisations that invest now in responsible AI practices, data governance and regulatory preparedness will be better positioned to meet future requirements—and to demonstrate to government counterparts, investors and clients that they take these issues seriously.

Authors: Asad Ahmad, Regional Head of Regulatory and Khaled Abu Orabi, Senior Associate.