Is there an AI law in the UAE we have to comply with?

No comprehensive one, and the instruments usually quoted as if there were are not binding. A national charter sets out ethical principles and a national strategy sets direction; both are real and neither creates an obligation for a private company. What does bind you is the general law, principally data protection, plus whatever your trade licence permits you to do. The practical consequence is that an AI governance workstream here is data-protection work with a newer name on it, and it should be staffed and scoped that way rather than as something novel.

Our trade licence does not list AI. Does that matter before we build?

It can, and it takes a day to check first. The government publishes an Artificial Intelligence and coding licence, issued on the Dubai mainland and by several free zones, and the DIFC runs its own for developers. Whether you need one depends on what you are doing: using an AI tool inside your existing licensed activity is a different question from selling an AI product. The reason to establish it in week one is sequencing rather than risk. A licence amendment is a matter of days to weeks, and discovering the need after a build is complete is the expensive version of the same conversation.

We are registered in the DIFC. Which data rules apply to us?

The centre’s own, not the federal law your mainland suppliers are probably quoting at you. The DIFC and the ADGM each run a separate data protection regime, so a company inside one of them answers to that regime and to its own commissioner. The consequence that surprises people is the internal one: neither centre treats the UAE mainland as an adequate destination, so sending customer records from a DIFC entity to its own mainland parent is a cross-border transfer needing a proper basis. It is entirely answerable. It just has to be answered before a system is designed around it.

Can we send our data to a hosted model outside the country?

Often yes, on safeguards, and there is no list to look the destination up in. Under the federal regime a transfer out is permitted where the right protections are in place, but there is no published adequacy list to shortcut the analysis, so each destination is answered on what the vendor will commit to rather than on where it sits. That makes the processing location a procurement question: a provider who will name the region in a contract is answerable, and one who will not is a finding. Where a field genuinely cannot leave, we place that step on infrastructure you control and leave the rest hosted.

What do we actually receive at the end of the engagement?

A position on the regime and the licence, a measured audit of where the time goes, and a ranked roadmap with costs against it, including the cost of running each thing rather than only building it. Then, where the engagement includes it, one use case piloted on your own data with a gate it is allowed to fail. What you will not receive is a return percentage, because we would be inventing it, and a page that publishes one has told you something about itself rather than about your business.

How is this different from an AI development company?

By what the first month produces. A development engagement starts from a decision that has already been taken and turns it into software. This starts before the decision, and one of its legitimate outputs is that nothing should be built yet. The two are not alternatives so much as a sequence, and we do both, which is the honest reason to say that the team writing the roadmap is the team that would ship it. How the wider automation programme fits together is on AI automation services.

When would you tell us to buy something instead of building it?

Whenever a product already does the job at a price a build will not beat, which is more often than this industry admits. The test is whether your version of the problem is genuinely unusual: if what you need is what everybody in your sector needs, somebody has already built it and is spreading the cost across all of them. Building earns its price where the process is your actual advantage, where the data is yours alone, or where every product in the category processes data somewhere your regime will not send it. We say which of those applies, and sometimes none does.

AI consulting · UAE

AI consulting that says where to start.

Your licence, your data regime and where a model would process the data settle which use cases are even buildable. Webzenia answers those three first, then ranks what is left.

Tell us what the decision is waiting on

What gets answered first

Three questions we answer first.

Three answers that shorten the list before anyone scores it. What your licence covers, which regime holds your data, and where the model would run.

What your licence allows

A Dubai Industrial City manufacturer on a free zone licence whose board has asked the question usually holds a licence that says nothing about software. That is a sequencing problem, not a blocker, and week one is a better place to find it than month four.

What is worth doing first

Each use case is scored on what it returns against what it costs to run. The constraint is scored beside the return, because one the regime rules out is not low priority. Which processes deserve it is on automating workflows.

Which rules apply to you

The mainland, the DIFC and the ADGM are three regimes and not one, and the instruments this field quotes as AI governance bind nobody. What binds is data protection and your licence, and knowing which one holds you changes where a model may process anything.

Where the value usually is

Six places AI pays for itself.

Six shapes, scored on what they return and what they need. Each one carries the condition that would take it off your list.

Answering and routing enquiries

The repeated questions answered and the rest routed to the right desk. Needs a body of answers that are already correct somewhere. Ruled out where the answers live in four people’s heads and disagree

Output

a resolved share you can watch

Needs answers first

Reading documents automatically

Invoice number, date, VAT amount, tax registration number and total, read off the document and written into the system. Needs a consistent enough document set. Ruled out where every supplier sends a different layout and volume is low

Output

fields, not files

VAT and TRN

Forecasting, and what it needs

Demand, churn or cash, predicted from what has already happened to you rather than from a benchmark. Needs a couple of years of clean history. Ruled out where the trading pattern changed so recently that the history describes a different business

Output

a forecast with an error bar

Document search, and what it needs

Answers pulled from your own contracts, manuals and policies, with the source shown. Needs the documents findable and current. Ruled out where nobody can say which version is authoritative, because a confident answer from the wrong revision is worse than none

Output

answers with citations

Cites its source

Agents that run a whole process

A sequence that reads, decides, acts and reports, with a person on the exceptions. Needs the process to have a definition somebody agrees with. Ruled out where the steps are genuinely contested, since an agent will simply automate the disagreement

Output

a run log, and exceptions

Checking things from an image

Counting, checking or grading from an image, on a line or a site. Needs consistent capture before it needs a model. Where the answer is a trained model rather than a bought one, that is on custom AI development

Output

a decision per image

Capture first

The three regimes

Which data rules apply to you.

Most companies here answer this wrongly, and the answer changes which use cases are buildable. This is a reference table, not a recommendation.

	The mainlandThe federal regime	DIFCIts own law	ADGMIts own regulations
Which law applies	The federal Personal Data Protection Law, Decree-Law 45 of 2021.	The DIFC Data Protection Law, which the centre amends on its own timetable.	The ADGM Data Protection Regulations, separate again.
Who supervises it	The federal data protection regulator.	The centre’s own commissioner.	The centre’s own commissioner.
The usual basis	Consent, for most commercial processing, in force since January 2022.	A basis set by that law, which is not read across from the federal one.	A basis set by those regulations, again not read across.
Sending data out	Permitted on safeguards, with no adequacy list to look a country up in.	Permitted to a destination on its own adequacy list, or on safeguards.	Permitted to a destination on its own list, or on safeguards.
Sending it to mainland	Not a question that arises.	A cross-border transfer: the mainland is not on the centre’s adequacy list.	A cross-border transfer, on the same reasoning.
A hosted model	Answered on safeguards and on what the vendor will commit to in writing.	Answered against that centre’s list first, then on safeguards.	Answered the same way, against a different list.

Why this decides the shortlist.

Because a use case that needs data somewhere your regime will not send it is not a low-priority item, it is off the list, and finding that out during a pilot is expensive. The row that surprises people most is the fifth: an Al Maryah Island advisory firm on an ADGM licence sending client records to its own mainland back office is making a cross-border transfer between two UAE addresses. None of it is exotic and all of it is answerable, but it is answered before the ranking, not after. There is no binding AI statute to look it up in, which is why the regime and the licence do the work.

The UAE context

What shortens the list.

Webzenia has worked with Gulf clients since 2018. Every governance claim on this search points at an instrument that binds nobody.

01of 03
No AI statute binds youThe instruments people cite
There is no binding AI law here.
A charter of principles and a national strategy are both real and neither binds a private company. What binds an AI build is data protection and your licence. So an AI governance workstream in this market is data-protection work wearing a newer label, and it should be staffed as such.
Our methodGovernance scoped against the instrument that actually applies, named in the document.
02of 03
The activity may not be listedAn AI and coding licence exists
Your licence may not cover AI work.
The government publishes an Artificial Intelligence and coding licence, issued on the mainland and by several free zones, with the DIFC running its own. A JLT commodities trader under DMCC on a general trading licence has a sequencing question, and it is answered in days rather than months.
Our methodLicence read in week one, with the amendment route named if one is needed.
03of 03
Three regimes, not oneAnd not adequate to each other
DIFC and mainland follow different data laws.
A DIFC-registered asset manager is not under the federal law its mainland suppliers keep quoting, and the mainland is not on the centre’s adequacy list. Two UAE addresses can be a cross-border pair, which decides where a model may process before anything is ranked.
Our methodThe regime is established from the licence, not assumed from the postal address.

What the engagement covers

Everything you receive.

Six deliverables. The first one can remove use cases from the list, which is why it is first rather than an appendix.

Your rules and licence, read first

Which of the three data regimes your entity sits under, what your licence currently permits, and which of your candidate use cases that removes before anything is scored

Output

a one-page position you can hand to a board or a lawyer

First, not last

Where your time and money go

Where time and money actually go, measured rather than described, with the candidate use cases written against the processes they would touch and the data each one would need

Output

a list with evidence under it

A ranked, costed roadmap

Each use case scored on return, effort and constraint, sequenced into pilot, scale and operate, with the cost to run it beside the cost to build it. No return percentage, because we would be inventing one

Output

a plan with figures and an order

Run cost included

Choosing the model and hosting

The shortlist scored on what it costs, what it can do, and where it processes your data, which is the row most scorecards leave off. A vendor who will not commit to a processing location in writing is a finding

Output

a decision with reasons

Where it processes

A pilot on your own data

The top use case built and run against your own records rather than a demo set, with evaluation gates, a cost ceiling and a way back. A pilot that cannot fail is a presentation

Output

a result, and a recommendation that may be no

Real data

Training so your team can run it

The people who will run it trained on it while it is being built, with the runbook and the decisions written down. What the wider programme looks like across a business is on AI automation in Dubai

Output

an owner who is not us

Named owner

Our stack

Chosen on where your data goes.

Six layers, and the first question asked of every one of them is the same. Select one to see why it earns its place, and where we argue against it.

Azure AI

Why Azure AI

A named region you can point at, with a contract that says what happens to the data in it, which is what turns a transfer question into a document rather than an argument.

How we excel

We choose on the region and the contract before the benchmark, because a model that scores marginally better in a place your regime will not send data to is not on the shortlist at all.

Named regionWritten commitmentProcesses in

A regional deploymentA place

A global endpointSomewhere

A reseller wrapperUnstated

A local modelYour rack

How the engagement runs

How the roadmap gets built.

Three phases, and the first is the one no competitor page has. It can take use cases off the list, which is the point of doing it first.

01Weeks 1 to 2Scoped

Settle what you may build

Which data regime the entity sits under, what the licence currently lists, and where each candidate use case would have to process data. Anything the answers rule out comes off the list now, with the reason written next to it, so nobody spends a quarter discovering it during a pilot. Where a licence amendment is the unlock, that route is named rather than implied.

Regimeread from the licence
Removalslisted with reasons
Routenamed where one exists

02Weeks 2 to 5Costed

Measure, then rank

Time and money are measured on the processes themselves rather than described in a workshop, and each surviving use case is scored on return, effort and the data it would need. The output is sequenced into pilot, scale and operate with the cost of running it beside the cost of building it. There is no return percentage anywhere in it, because we would be inventing it.

Measurednot described
Scored onreturn, effort, constraint
Coststo run, and to build

03Month 2 onwardProved

Pilot the top one

One use case, built against your real records rather than a demo set, with evaluation gates, a cost ceiling and a way back. The team who will run it is trained while it is being built. If the pilot says the return is not there, that is the finding and we report it rather than proposing a second phase to rescue the first.

Datayours, not a demo set
Gatesevaluation and cost
Findingreported either way

The regime and the licence are read before anything is ranked.

Settled first

Regime firstRun cost includedNo invented return

Our commitment

Four things we commit to.

This category sells confidence and rarely a method. These are the four things we hold ourselves to.

We will tell you to buy instead
Where a product already does the job at a price a build will not beat, that is the recommendation, and it goes into the roadmap rather than a footnote. It costs us the larger engagement, which is the point of writing it down.
We prove one before scaling
One pilot, on your own data, with a gate it can fail. If the return is not there we say so and stop, rather than proposing a second phase to justify the first.
We price building and running
Build cost, model and hosting cost at your expected volume, and the cost of somebody maintaining it. A roadmap that prices only the build understates the decision, and running cost is where most AI budgets are actually lost.
We scope only what your rules allow
The data regime and the licence are established before the roadmap is written, and a use case that fails either comes off the list with the reason recorded. You get that as a position you can show a board, not as an assurance in a meeting.

Regime first, costs to run, and buy when buying is right.

Common questions

AI consulting questions, answered.

No comprehensive one, and the instruments usually quoted as if there were are not binding. A national charter sets out ethical principles and a national strategy sets direction; both are real and neither creates an obligation for a private company. What does bind you is the general law, principally data protection, plus whatever your trade licence permits you to do. The practical consequence is that an AI governance workstream here is data-protection work with a newer name on it, and it should be staffed and scoped that way rather than as something novel.
FAQ · 01
It can, and it takes a day to check first. The government publishes an Artificial Intelligence and coding licence, issued on the Dubai mainland and by several free zones, and the DIFC runs its own for developers. Whether you need one depends on what you are doing: using an AI tool inside your existing licensed activity is a different question from selling an AI product. The reason to establish it in week one is sequencing rather than risk. A licence amendment is a matter of days to weeks, and discovering the need after a build is complete is the expensive version of the same conversation.
FAQ · 02
The centre’s own, not the federal law your mainland suppliers are probably quoting at you. The DIFC and the ADGM each run a separate data protection regime, so a company inside one of them answers to that regime and to its own commissioner. The consequence that surprises people is the internal one: neither centre treats the UAE mainland as an adequate destination, so sending customer records from a DIFC entity to its own mainland parent is a cross-border transfer needing a proper basis. It is entirely answerable. It just has to be answered before a system is designed around it.
FAQ · 03
Often yes, on safeguards, and there is no list to look the destination up in. Under the federal regime a transfer out is permitted where the right protections are in place, but there is no published adequacy list to shortcut the analysis, so each destination is answered on what the vendor will commit to rather than on where it sits. That makes the processing location a procurement question: a provider who will name the region in a contract is answerable, and one who will not is a finding. Where a field genuinely cannot leave, we place that step on infrastructure you control and leave the rest hosted.
FAQ · 04
A position on the regime and the licence, a measured audit of where the time goes, and a ranked roadmap with costs against it, including the cost of running each thing rather than only building it. Then, where the engagement includes it, one use case piloted on your own data with a gate it is allowed to fail. What you will not receive is a return percentage, because we would be inventing it, and a page that publishes one has told you something about itself rather than about your business.
FAQ · 05
By what the first month produces. A development engagement starts from a decision that has already been taken and turns it into software. This starts before the decision, and one of its legitimate outputs is that nothing should be built yet. The two are not alternatives so much as a sequence, and we do both, which is the honest reason to say that the team writing the roadmap is the team that would ship it. How the wider automation programme fits together is on AI automation services.
FAQ · 06
Whenever a product already does the job at a price a build will not beat, which is more often than this industry admits. The test is whether your version of the problem is genuinely unusual: if what you need is what everybody in your sector needs, somebody has already built it and is spreading the cost across all of them. Building earns its price where the process is your actual advantage, where the data is yours alone, or where every product in the category processes data somewhere your regime will not send it. We say which of those applies, and sometimes none does.
FAQ · 07

Keep exploring

Explore AI and Automation Services

Part ofAI and Automation Services

Custom AI Development

Built where your own data beats a hosted model.

AI Chatbot Development

Answers from your documents, in the Arabic customers write.

AI Voice Agents

Agents that answer your published line, in Arabic and English.

AI Dialers

Outbound calling built inside the telemarketing rules.

WhatsApp Automation

Threads that finish in writing, in Arabic and English.

Business Process Automation

Rewrite the process for this market, then automate it.

Workflow Automation

Wire the two systems either side of the hand-off.

CRM Development

A CRM that knows which of your companies is selling.

Zoho Implementation

The suite configured around where data sits and how invoices leave.

Next step

See what has to be settled first.

Describe the use case you are weighing up and where the entity is registered. We will say what the regime allows, what it would return, and whether to build it or buy it.

Tell us what you need.

Three questions we answer first.

What your licence allows

What is worth doing first

Which rules apply to you

Six places AI pays for itself.

Answering and routing enquiries

Reading documents automatically

Forecasting, and what it needs

Document search, and what it needs

Agents that run a whole process

Checking things from an image

Which data rules apply to you.

What shortens the list.

There is no binding AI law here.

Your licence may not cover AI work.

DIFC and mainland follow different data laws.

Everything you receive.

Your rules and licence, read first

Where your time and money go

A ranked, costed roadmap

Choosing the model and hosting

A pilot on your own data

Training so your team can run it

Chosen on where your data goes.

How the roadmap gets built.

Settle what you may build

Measure, then rank

Pilot the top one

Four things we commit to.

AI consulting questions, answered.

Explore AI and Automation Services

Custom AI Development

AI Chatbot Development

AI Voice Agents

AI Dialers

WhatsApp Automation

Business Process Automation

Workflow Automation

CRM Development

Zoho Implementation

See what has to be settled first.