Regulation
The new Federal Authority for AI and Data: what it changes for UAE tech companies
The UAE merged its AI office, digital government sector, and data office into one Federal Authority for AI and Data in June 2026. Here is what the consolidation means for compliance and AI development.
On 14 June 2026, the UAE approved the creation of the Federal Authority for Artificial Intelligence and Data. The authority consolidates three bodies into one: the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, the digital government sector of the TDRA, and the UAE Data Office.
Omar Sultan Al Olama, Minister of State for Artificial Intelligence, chairs the new authority, which reports directly to the Cabinet.
This is the single most consequential regulatory move in UAE technology in years. Here is what it changes and what it does not.
What the new authority does
Its mandate is broad. It sets national AI and data policy direction, proposes legislation, establishes standards for data and AI management, ensures compliance across federal entities, runs AI-powered national data platforms, and builds national R&D capability.
For the private sector, two parts of the mandate matter most.
First, the PDPL enforcement gap may finally close. The UAE’s Personal Data Protection Law (Federal Decree-Law 45 of 2021) has been in force since January 2022. But its implementing regulations were never issued, and no supervisory authority was clearly designated for private sector oversight. That created a long period of uncertainty. Companies knew the law existed but had no concrete picture of how it would be enforced.
The market expectation is that the new authority takes ownership of the implementing regulations and brings meaningful enforcement. Nothing is guaranteed, but the structural conditions for progress are, for the first time, actually in place.
Second, standards. The authority’s mandate to set data and AI management standards will directly shape how products are built and audited in the UAE. If you build AI that processes personal data, the standards that land here become your compliance baseline.
The layered reality underneath
The UAE still does not have a single horizontal AI law. That is deliberate. Regulation is layered across:
- The federal PDPL for onshore personal data.
- Free zone regimes. The DIFC and ADGM run their own data protection frameworks. The DIFC’s Regulation 10, which imposes specific duties on entities deploying autonomous or semi-autonomous systems that process personal data, reached full enforcement in January 2026.
- Sectoral regulators. Financial services, healthcare, and child-facing digital services each add their own layer.
- Policy charters. The UAE Charter for AI (2024) and the AI Strategy 2031 set the direction.
A draft federal AI law is anticipated during 2026 or 2027, but until it lands, compliance means mapping which regimes apply to your specific deployment.
What this means for your product
For companies building AI in the UAE, the practical picture is now clearer than it has been at any point since the PDPL was passed.
Start with a data map. Know where personal data comes from, where it goes, and which law applies to each flow. If you operate in DIFC or ADGM, your primary data regime is the free zone law, not just the federal law.
Check Regulation 10 exposure. If your AI systems are autonomous or semi-autonomous and process personal data, the DIFC rules now apply with full enforcement. That means documented governance, human oversight where required, and the ability to explain decisions.
Watch for the implementing regulations. The single biggest compliance event to track is the authority issuing the PDPL implementing regulations. When they land, expect the concepts that have been theoretical, such as cross-border transfer rules and breach notification mechanics, to become concrete.
The strategic angle
The creation of the authority does something else as well. It signals to international investors and AI companies that the UAE intends to be a governed AI jurisdiction, not an unregulated one. The message is: build here, follow clear rules, and get a regulatory partner rather than a blocker.
That positioning is part of the same strategy as the agentic AI government plan. The UAE wants to be the country where agentic AI is both adopted and properly governed. Regulation is the confidence-building layer.
The bottom line
For most companies, the immediate compliance burden has not changed overnight. The PDPL still applies, the free zone regimes still apply, and no new AI law exists yet.
What changed is clarity. There is now one authority with the mandate to finalize the rules and enforce them. Companies that treat compliance as an engineering input, data governance, audit trails, human oversight, rather than a legal checkbox, will be positioned well when the enforcement era begins.
If you are unsure where your AI product stands under the current rules, the safest move is to get a structured review now, before the implementing regulations raise the bar.