UAE: a business-focused approach to AI

The United Arab Emirates (UAE) has adopted a pragmatic and business-focused approach to the regulation of AI. The way this has been implemented to date stands in contrast to the sectoral approach of the UK and the comprehensive legislative framework adopted by the EU. The UAE has yet to implement a direct legislative framework dedicated to AI regulation. Instead, the regulatory landscape is shaped by a mixture of decrees, guidelines and initiatives from the UAE Government. The overarching aim of the current approach is to establish a flexible regulatory regime capable of evolving with the development of AI regulation, developing an ecosystem that encourages the development of best practice in AI technology and encouraging foreign direct investment into the country.

Strategic initiatives

To oversee and promote the integration of AI across a range of sectors, including logistics, energy, education, tourism, healthcare, and cybersecurity, the UAE has implemented several key initiatives, namely:

• Appointing a Minister of State for AI (a global first) in 2017, and further expanding the office to Minister of State for AI, Digital Economy and Remote Work Applications in 2020, to oversee the implementation of AI initiatives and provide oversight and strategic direction across the UAE. For details, see https://ai.gov.ae/about_us/;
• Launching the UAE National Strategy for Artificial Intelligence 2031 in 2018, to serve as the foundation of the UAE's AI ambitions. It envisions the UAE as a global leader in AI by integrating the technology across various sectors;
• Establishing the UAE Council for Artificial Intelligence and Blockchain (AI Council | Artificial Intelligence Office, UAE) to recommend policies that will cultivate an AI-conducive ecosystem, bolster sector research, and facilitate public-private and international partnerships to accelerate AI integration;
• Issuing the Federal Decree Law No. (25) of 2018 on Projects of Future Nature (https://uaelegislation.gov.ae/en/legislations/1980) to grant interim licences for innovative projects that utilise modern technologies or AI, in the absence of specific regulations;
• Creating Reglab to act as a regulatory sandbox to test and adapt technological developments, facilitate the development of new legislation or amendment to existing legislation, regulate advanced technologies, products and applications, with the overarching aim of providing a secure legislative framework within which investment in future sectors can be encouraged;
• Setting up, in January 2024, the Artificial Intelligence and Advanced Technology Council to regulate investments, research and projects in relation to AI and which in March 2024 announced the creation of MGX, a technology investment company to enable the advancement and deployment of leading edge technologies and whose founding partners are Mubadala and G42;
• Establishing various specialised economic zones that promote and assist the establishment and operation of entities in the technology sector, including Dubai Silicon Oasis in Dubai, twofour54 and Masdar City in Abu Dhabi; and
• the UAE Cabinet has recently sanctioned the nation's inaugural global AI Policy. This policy outlines the UAE's stance on artificial intelligence from both domestic and international viewpoints. It aligns with and builds upon existing efforts like the UAE Strategy for AI and the initiatives of the UAE Council for AI, which primarily aim to expedite AI integration within the region. The policy sets out the guiding principles for the UAE in respect of: (i) foreign policy, encouraging the UAE's further participation in international AI forums and supporting the development of international AI rules; and (ii) governance of AI development in the UAE on the basis of the 'ACCESS' principles, being Advancement, Collaboration, Community, Ethics, Sustainability and Safety.

Voluntary guidelines

The UAE has also introduced a suite of non-binding guidelines and principles which set out best practice and ethical standards for AI system design and deployment in both public and private sectors. These documents, including the AI Ethics Guide, AI Adoption Guideline in Government Services, Responsible Metaverse Self-Governance Framework, Deepfake Guide, and Generative AI Guide, address critical aspects of AI such as data quality, security, transparency, accountability, fairness, and human oversight. The aim of these guidelines is to harmonise technological progress with societal and ethical considerations. The UAE AI Seal brand has been created to endorse and recognise AI companies that meet high standards of quality and ethics, offering a 'UAE Seal of Approval' for safe and verified AI technology.

The impact of data protection rules

Other than as noted above, the only specific regulatory controls impacting AI systems are a series of amendments to the data protection regime in the Dubai International Financial Centre (DIFC), a financial free zone in the Emirate of Dubai, UAE.

Article 10 of the DIFC Data Protection Regulations 2020 (the Regulations) introduce specific obligations for entities deploying or operating autonomous and semi-autonomous systems that process personal data. These obligations include providing explicit notifications, ensuring ethical, fair, transparent, secure and accountable design, and appointing an Autonomous Systems Officer.

For this purpose, "systems" is broadly defined as any machine-based system operating in an autonomous or semi-autonomous manner, that can process personal data for human-defined or self-defined purposes and generate output as a result of such processing. The Regulations also categorise the purposes for processing personal data by such systems as either

(i) human-defined, i.e., purposes that are externally pre-defined by humans and hard coded into the system, or

(ii) self-defined, that is, purposes that the system is able to generate itself on the basis of human-defined principles and within human-defined constraints.

The Regulations require that entities using such systems comply with the general principles and requirements for processing personal data under Regulations, as well as additional transparency, accountability and certification requirements that may be established by the Commissioner of Data Protection from time to time. The Regulations also prohibit the use of such systems for high risk processing activities, unless the Commissioner has established audit and certification requirements applicable to such systems and the system complies with all such requirements.

Challenges for the current regime

The UAE currently addresses the complexities of AI, largely through the means of existing technology-neutral legislation in a number of areas including copyright, patents, trade secrets, competition, cybercrime, and consumer protection. However, these existing laws were not drawn up to address the nuanced and intricate challenges presented by AI, such as the allocation of liability, addressing the possibility of algorithmic bias, and the intricacies of consumer consent. The challenges and risks associated with regulating AI in the UAE are multifaceted. The absence of a universally accepted definition of AI makes it more difficult to draw up standardised regulations. In fact, the sheer complexity and diversity of AI applications, coupled with the rapid and unpredictable pace of technological change, present significant regulatory hurdles. The challenge – something which the UAE shares with all other jurisdictions - is to devise something that would encapsulate all pertinent issues and strike a fair balance between the interests of a diverse array of stakeholders, including developers, users, consumers, regulators, and the general public.

Although no comprehensive and cohesive legal framework is yet in place, the UAE has shown, through progress made and initiatives taken so far, a willingness to address this, and to learn from other approaches where appropriate. For example, the influence of the EU's General Data Protection Regulation – which is often considered the benchmark for privacy laws - on the Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data is clear. It remains to be seen whether the UAE will adopt a similar stance in relation to the proposed EU AI Act or chart its own course.

AI investment focus

AI investment in the UAE is currently focused on several key areas, including the development of data centres, smart city initiatives, healthcare, and government services. Major investments are being directed toward building robust AI infrastructure, such as state-of-the-art data centres, which are crucial for supporting the vast computational needs of AI technologies. For instance, companies like G42 and Amazon Web Services (AWS) have established significant data centre operations in the UAE to cater to both local and regional AI demands.

AI investment is also being channelled into smart city projects like the Dubai Smart City initiative, which uses AI to enhance urban management, transportation, and public safety. The healthcare sector is another priority, with investments in AI-driven diagnostics, telemedicine, and personalised medicine.

The next wave of AI investment in the UAE is expected to expand into sectors such as education, where AI can offer personalised learning experiences, and agriculture, where AI-driven solutions can optimize resource use and boost productivity. Additionally, as the UAE positions itself as a global AI hub, there will likely be further investments in AI research and development, fostering innovation and attracting global talent to the region.