Ask which UAE AI rules apply to a DIFC company and the honest first answer is that the question needs rewriting, because a company incorporated in one of the financial free zones does not inherit the federal position by default. It sits under its own data protection law, answers to its own commissioner, and if it is licensed, answers to its own financial regulator as well.
This article describes the position at a general level for orientation. It is not legal advice, and what applies to any particular entity depends on its licence, its activities and its client base. Take advice on your own facts.
Why the free zones are a separate question
The Dubai International Financial Centre and Abu Dhabi Global Market are common-law jurisdictions with their own courts, their own legislative instruments and their own regulators. For data protection purposes that separation is real rather than cosmetic: entities incorporated in them follow the zone's own law rather than the federal regime that governs a mainland company.
This trips people up in a predictable way. The staff are often the same people, working in the same building, using the same laptops and the same software, for a group that presents itself to clients as one business. The regime, however, attaches to the entity, and the question of which entity is processing a given set of personal data is a question of fact that nobody has usually written down.
The two data protection regimes
A DIFC entity operates under DIFC Data Protection Law No. 5 of 2020. An ADGM entity operates under the ADGM Data Protection Regulations 2021. Each is administered by its own commissioner, each draws heavily on European concepts, and each has been more active in publishing guidance than the number of registered entities alone would lead you to expect.
That last point is the practical one. If you are incorporated in one of these zones, the material published by your own commissioner is the most relevant guidance available to you, and it is considerably more specific than anything at federal level. It is also, in most companies, unread.
What that changes for AI use
Very little of what follows is about artificial intelligence, and that is the point. The obligations that bite on AI use in a free-zone company are the ordinary data protection obligations, engaged because a tool is doing something with personal data. At a general level, four questions do most of the work.
- Is this processing? Pasting a client list into a drafting tool, running a transcription service over a recorded call, or letting a recruitment product rank candidates are all processing, regardless of how informal the act felt at the time.
- Does data leave the jurisdiction, and on what basis? Most cloud AI products process data outside the zone. That is a transfer question with an answer, and the answer needs recording before the tool is in use rather than after.
- Have people been told? Transparency towards the individuals whose data it is does not pause because the processing is novel. Privacy notices written before a tool arrived rarely describe what it does.
- Can you show your reasoning? Accountability is the obligation that most rewards a written inventory, because it is discharged with documents rather than with intentions.
A company that can answer those four for every AI-enabled system it runs has done the substantial part of the work, whichever of the two zones it sits in.
Group structures and the higher standard
The common UAE shape is a mainland operating company with a free-zone holding or advisory entity above it, or the reverse. The employees move between them, the shared drive does not distinguish, and the AI tool was bought on one company card for everybody.
Two things resolve this without a restructuring exercise. First, record which entity each AI-enabled system sits under and which entity's personal data it touches, as a column in the inventory rather than as a separate project. Second, write one group policy to the highest standard among the regimes you sit under, rather than three documents that staff cannot tell apart. A single readable rule that is followed everywhere beats three precise ones that are followed nowhere, and it is far easier to evidence to a client.
If your entity is a licensed firm
Licensed firms in DIFC are supervised by the Dubai Financial Services Authority, and licensed firms in ADGM by the Financial Services Regulatory Authority. Both supervise conduct and prudential matters for the firms they authorise, which is a different axis from data protection and sits alongside it rather than replacing it.
The useful framing inside a licensed firm is not to ask whether either regulator has published AI-specific rules, but to ask which of the rules you already follow are engaged when a task is performed by, or with the assistance of, a machine. Existing expectations around outsourcing and third-party arrangements, technology and operational risk, governance and senior management responsibility, record-keeping and the fair treatment of customers do not stop applying because the process now involves a model. That reframing produces a short, unglamorous list of things to fix, and it produces it without waiting for anything new to be published.
If you need to know the current position on AI-specific supervisory material from either authority, check the live rulebook and the authority's own published guidance, or have your compliance adviser do it. It moves, and a summary in an article is the wrong place to rely on for that.
A practical sequence
For a free-zone entity starting from nothing, the order below front-loads the parts that make everything else cheaper.
- Confirm in writing which data protection regime governs each entity in the group, and who the accountable individual is for each.
- Build the AI inventory with an entity column, covering embedded AI features in software you already license as well as the tools people went out and bought.
- Read your own commissioner's published guidance, which is the most specific material available to you and takes an afternoon.
- Map which AI-enabled systems move personal data out of the zone, and record the basis for each.
- Put a vendor gate in front of new tools, using a standing question set rather than a fresh conversation each time.
- If the entity is licensed, walk your existing rulebook obligations across every AI-assisted process and note where evidence is currently missing.
- Take the whole picture to the board once a quarter, using the board question set as the agenda.
How this differs from a mainland company
Less than most people expect, and in ways that are easy to name.
What is genuinely different
The instrument you cite, the commissioner you deal with, and the guidance that is most relevant to you. Free-zone entities also tend to have a more formal governance structure already in place, which means the quarterly reporting habit has somewhere obvious to land rather than needing to be invented. And their client base skews towards counterparties who send questionnaires, so the commercial pressure usually arrives earlier than it does for a mainland trading company of the same size.
What is the same
The artefacts. An inventory, a readable acceptable-use policy, a gate in front of new vendors, a documented view of which decisions require a human, and a quarterly paper. Those five are the same in a DIFC asset manager, an ADGM advisory firm and a Dubai mainland clinic group. What changes between them is which regime you name in the document and which regulator you would be explaining it to, not what you have to build.
Which is the more encouraging way to read the whole regulatory landscape. The fragmentation is real, but it affects the citations far more than it affects the work, and a company that has done the work once can re-cite it for any of them.
If you are working out which regime governs which entity in your group and want that settled before it becomes a client questionnaire, message Hayat Advisory on WhatsApp with your structure and where each entity is licensed.