THE LAW EVERYONE IS CITING IS NOT ON THE BOOKS.

WHAT HAPPENED

Since July a steady stream of material aimed at businesses in the Emirates has described a "UAE AI Act": a four-tier risk classification, a mandatory self-assessment due in September 2026, prior written approval from a UAE AI Authority before deploying higher-tier systems, continuous monitoring, audit logs, and fines reaching AED 10 million. The pieces are detailed and agree with one another.

Every one we could find came from a compliance vendor, a security product or a search-optimized guide. None cites a decree number, a gazette entry or a government portal. Three independent legal sources dated February to April 2026 record no such statute, and a fourth, from October 2025, lists the instruments that bind businesses and does not include it.

NO DEDICATED AI LAW IS IN FORCE

CMS's AI regulation scanner for the UAE, updated February 2026, is unambiguous: there is currently no dedicated AI law in force in the United Arab Emirates. It lists no binding risk classification and no self-assessment obligation. The Chambers 2026 data protection guide for the UAE, current to March 2026, reaches the same conclusion and adds detail: on the mainland, neither AI-specific legislation nor AI-specific governance mechanisms have been established. Latham & Watkins' survey of UAE AI regulation, published 30 October 2025, lists the instruments that bind businesses, and a general AI statute is not among them. That is an omission, which is weaker evidence than a finding of absence.

The most direct is Lamy Liaisons, a French legal publisher writing for practitioners: published 16 March 2026, updated 16 April 2026, inside the year the "Act" is dated to. It tests the claim explicitly and concludes that no federal text bearing that name exists, and that the national Charter of 2024 creates neither harmonized fines nor a binding classification.

Proving that something does not exist is harder than proving that it does, and we would rather be corrected than confident. As of publication the legal record above runs to April 2026 and carries no such statute, and no federal instrument of that name has been issued since. Four dated legal sources are a better position than a chain of posts citing each other. Update, 21 Oct 2026: the September date has passed. We have found no decree, gazette entry or regulator notice that set it, and no enforcement tied to it. Federal AI work since August has dealt with the government's own use of AI. The National Committee for the Agentic AI Project published a design guide for agentic government services in August, and on 11 October WAM reported that the committee had approved the project's operating framework. Neither is addressed to private companies.

PDPL, SECTOR RULES AND THE DIFC BIND INSTEAD

Obligations do exist. They are scattered across several instruments, and which ones reach you depends on what your systems do and where you are incorporated.

INSTRUMENT	WHO IT REACHES	WHAT IT REQUIRES
PDPL — Federal Decree-Law 45/2021	anyone processing personal data in the UAE	Article 18: a right to object to automated decisions carrying legal or serious effect, profiling included — subject to exceptions for contract, other legislation and prior consent
Guidelines for Financial Institutions Adopting Enabling Technologies (CBUAE, SCA, DFSA, FSRA, 2021 — supervisory guidance, not statute); DHA's AI policy in healthcare	regulated firms in finance and healthcare	governance frameworks, explainable models, regular auditing, independent validation
DIFC Data Protection Regulation 10, September 2023	DIFC entities	per Chambers, March 2026, the only UAE jurisdiction with AI-specific data protection obligations: transparency, fairness and accountability built into the design of autonomous systems
Charter for AI Development (2024), AI Ethics Guide, Dubai AI Seal	nobody, formally	principles and voluntary verification, no enforcement mechanism

Two things about the PDPL are worth knowing before anyone quotes a penalty at you. Its Executive Regulations were due within six months of the 2021 law. Chambers, with the law stated as of 10 March 2026, records them as still unissued, and no Cabinet decision setting administrative penalties had been published as of that date. Chambers records the practical consequence plainly: limited enforcement activity, a cautious regulator, and organizations driving compliance through their own risk assessments rather than in response to regulatory action.

The Federal Authority for Artificial Intelligence and Data, announced 14 June 2026, consolidates the AI Office, TDRA's digital-government functions and the Emirates Data Office into one body. Its remit covers federal compliance, national standards and policy coherence. It creates no private-sector registration or classification regime.

THE EXERCISE IS RIGHT, THE DEADLINE IS UNSOURCED

Every version of the story repeats one observation that is true: most companies have more AI in the building than they think. Some of it arrives as model features switched on inside third-party SaaS, some as legacy software with a model inside, and some as a chatbot one department set up and nobody inventoried.

Without that inventory you cannot answer an Article 18 objection or a sector regulator, and you cannot scope what Dubai's agentic mandate means for you. Build it, then record for each system what it does on its own, what it drafts for a person to approve, and what it refuses. A tiered self-assessment would have forced the same work on you, and the inventory stays useful whether or not anyone legislates it.

What is not worth doing is buying a compliance product against a deadline no instrument set. When we run a readiness audit the regulatory section names the instrument and the article; a claim that cannot be traced to one does not go into the report. Applied to the September deadline, that rule takes one line to fail.