PDPL Article 18 is the UAE's de-facto AI law
قانون حماية البيانات الشخصية الإماراتي — المادة 18
There is no comprehensive UAE AI Act. PDPL Article 18 is where most automated-decision exposure actually lives.
Updated May 2026
UAE PDPL (Federal Decree-Law 45/2021) governs the processing of personal data in the United Arab Emirates. Article 18 specifically restricts automated decision-making that produces legal or similarly significant effects on data subjects without human review — making it the federal-level statute every UAE AI deployment must clear, even though no "UAE AI Act" exists.
In force
Federal Decree-Law 45/2021
All entities processing UAE personal data
Federal floor; DIFC Reg 10 + ADGM regulations apply on top.
There is no UAE AI Act — set the expectation
A surprising number of UAE board decks reference a "UAE AI Act" effective in 2026. There is no such law. UAE AI governance is a patchwork: PDPL (federal), DIFC Reg 10, ADGM data and conduct regulations, CBUAE supervisory guidance, SCA frameworks, and Dubai-emirate instruments (Universal Blueprint for AI, the AI Seal).
This matters because non-existent statutes are not enforced — and pretending one is enforced wastes governance budget on the wrong artefacts. The real exposure is concrete and PDPL Article 18 is most of it.
What Article 18 requires for AI
Article 18 restricts decisions taken solely on automated processing that produce legal or similarly significant effects on a data subject. "Significant effects" reaches more than people expect: credit decisions, employment screening, insurance pricing, healthcare triage, tenancy decisions.
Compliance is not a one-line policy. It is a documented human-oversight design (who reviews what, on what cadence), a meaningful right-of-explanation workflow (not "the model said so"), and an audit trail that can answer a data-subject query without forensic reconstruction.
Sectoral overlays you cannot ignore
Healthcare: DHA / DOH / MOHAP requirements on patient data and clinical decisions.
Finance: CBUAE expectations on consumer protection, AML, fairness.
Free zones: DIFC Reg 10 and ADGM regulations operate in parallel to PDPL inside their respective jurisdictions.
In practice the binding stack for any UAE deployment is PDPL + sectoral + free-zone, mapped against the AI use-cases that actually exist in the business.
FAQ
Is there a UAE AI Act?▾
No. UAE AI governance is a patchwork: PDPL (federal), DIFC Reg 10, ADGM, CBUAE guidance, SCA frameworks, Dubai-emirate instruments. There is no single comprehensive AI statute.
Does PDPL apply if our data is hosted abroad?▾
PDPL applies based on the data subject (UAE personal data) and the entity processing it, not the hosting location alone. Cross-border transfer triggers additional obligations under the law and the executive regulations.
Who enforces PDPL?▾
The UAE Data Office (federal level) and, where applicable, the relevant sectoral regulator (DHA, SCA, CBUAE) or free-zone authority (DIFC, ADGM).
Related programs
The DVNC offers that map to this regulation.
Audit & Roadmap
Outsourced Private-Sector Chief AI Officer (paid entry).
From AED 25K
GovernanceDIFC Reg 10 Sprint
DIFC Regulation 10 readiness for fund admins, family offices, and DIFC entities.
From AED 60K
GovernanceAI Seal Sprint
Dubai AI Seal — eligibility, dossier, evidence pack, submission, remediation.
From AED 35K
Need this work done?
Book a Strategic Audit — the regulatory wedge is real, and the timing matters.