The programme itself is voluntary. The regulatory environment around AI in the UAE is not. Four frameworks intersect with any agentic AI deployment:
UAE AI Act 2026
Effective from March 2026. Provides the federal regulatory backbone for AI systems in the UAE. Specific agentic-AI compliance rules are still being clarified by the UAE AI Office; expect sector regulators to publish overlays through 2026–2027.
UAE Personal Data Protection Law (PDPL)
Federal Decree-Law on personal data protection. Applies to any agent that handles UAE residents’ personal data — which is almost all customer-facing implementations. Key obligations: lawful basis, data minimisation, retention limits, individual rights (access, rectification, erasure).
DIFC Data Protection Regulation 10
Applicable to financial-services AI within the Dubai International Financial Centre. Effective from September 2025. Requires that AI systems be designed with ethics, fairness, transparency, security, and accountability — and demonstrably so during regulatory examinations.
DHA AI Guidance
Dubai Health Authority circular establishing the regulatory framework for AI in healthcare facilities, diagnostic systems, and patient-data handling. Agentic systems for clinical decisions face higher bar than operational systems (scheduling, documentation).
The practical implication: any agent that touches regulated data must ship with audit logs, defined escalation paths, documented model behaviour, and demonstrated human-in-the-loop oversight for consequential decisions. This is not a checkbox — examiners increasingly ask for evidence.