You’re shipping an AI product in the United Arab Emirates. Data provenance, the claims you make and the contracts you sign this quarter set your exposure.
Information, not advice
This page is information, not legal advice about your matter. A retainer begins only when a lawyer confirms it.
Start here
Write down what your model is trained on, and what you say it can do
Those two facts sit behind every contract you sign and every question a data protection or sector regulator might ask. They are cheap to pin down now and expensive to reconstruct later.
What to work through, in order
Data provenance
DIFC and ADGM data protection laws follow a GDPR-style model, while the federal PDPL applies onshore. Cross-border transfer conditions differ across the three regimes.
Claims about the system
Consumer protection law and sector regulators both address misleading claims, and national AI strategy work is producing sector guidance. Financial services claims additionally engage the relevant regulator’s conduct rules.
Contracts and liability
Contractual freedom is broad onshore but subject to Civil Code provisions on good faith. DIFC and ADGM apply common-law principles instead, which changes how exclusions are read.
Next steps
What happens if you go ahead
Scoping call
Written scope and fixed-fee quote
Engagement, once a lawyer confirms
Who would handle it
Offices
Dubai
DMCC Crypto Centre, 12th Floor, Uptown Tower, Dubai