THE LAW EVERYONE IS CITING DOES NOT EXIST.

WHAT HAPPENED

Since July a steady stream of material aimed at businesses in the Emirates has described a "UAE AI Act": a four-tier risk classification, a mandatory self-assessment due in September 2026, prior written approval from a UAE AI Authority before deploying higher-tier systems, continuous monitoring, audit logs, and fines reaching AED 10 million. The pieces are confident, detailed, and consistent with one another.

They are also, without exception in what we could find, compliance vendors, security products and search-optimized guides. None of the pieces we reviewed cites a decree number, a gazette entry or a government portal. Meanwhile three independent legal sources dated February to April 2026 record no such statute, and a fourth, from October 2025, lists what binds without listing it.

NO DEDICATED AI LAW IS IN FORCE

CMS's AI regulation scanner for the UAE, updated February 2026, is unambiguous: there is currently no dedicated AI law in force in the United Arab Emirates. It lists no binding risk classification and no self-assessment obligation. The Chambers 2026 data protection guide for the UAE, current to March 2026, reaches the same conclusion and adds detail — on the mainland, neither AI-specific legislation nor AI-specific governance mechanisms have been established. Latham & Watkins' survey of UAE AI regulation, published 30 October 2025, enumerates the instruments that bind businesses. A general AI statute is not among them — an omission rather than a finding of absence.

The most direct is Lamy Liaisons, a French legal publisher writing for practitioners: published 16 March 2026, updated 16 April 2026, inside the year the "Act" is dated to. It tests the claim explicitly and concludes that no federal text bearing that name exists, and that the national Charter of 2024 creates neither harmonized fines nor a binding classification.

Proving that something does not exist is harder than proving that it does, and we would rather be corrected than confident. As of publication the legal record above runs to April 2026 and carries no such statute, and no federal instrument of that name has been issued since. Four dated legal sources are a better position than a chain of posts citing each other.

PDPL, SECTOR RULES AND THE DIFC BIND INSTEAD

The absence of an AI Act is not the absence of obligations. It means they are scattered, and which ones reach you depends on what your systems do and where you are incorporated.

INSTRUMENT	WHO IT REACHES	WHAT IT REQUIRES
PDPL — Federal Decree-Law 45/2021	anyone processing personal data in the UAE	Article 18: a right to object to automated decisions carrying legal or serious effect, profiling included — subject to exceptions for contract, other legislation and prior consent
Guidelines for Financial Institutions Adopting Enabling Technologies (CBUAE, SCA, DFSA, FSRA, 2021 — supervisory guidance, not statute); DHA's AI policy in healthcare	regulated firms in finance and healthcare	governance frameworks, explainable models, regular auditing, independent validation
DIFC Data Protection Regulation 10, September 2023	DIFC entities	per Chambers, March 2026, the only UAE jurisdiction with AI-specific data protection obligations: transparency, fairness and accountability built into the design of autonomous systems
Charter for AI Development (2024), AI Ethics Guide, Dubai AI Seal	nobody, formally	principles and voluntary verification, no enforcement mechanism

Two things about the PDPL are worth knowing before anyone quotes a penalty at you. Its Executive Regulations were due within six months of the 2021 law. Chambers, with the law stated as of 10 March 2026, records them as still unissued, and no Cabinet decision setting administrative penalties had been published as of that date. Chambers records the practical consequence plainly: limited enforcement activity, a cautious regulator, and organizations driving compliance through their own risk assessments rather than in response to regulatory action.

The Federal Authority for Artificial Intelligence and Data, announced 14 June 2026, consolidates the AI Office, TDRA's digital-government functions and the Emirates Data Office into one body. Its remit covers federal compliance, national standards and policy coherence. It creates no private-sector registration or classification regime.

THE EXERCISE IS RIGHT, THE DEADLINE IS UNSOURCED

Every version of the story repeats one observation that is entirely true: most companies have more AI in the building than they think. Third-party SaaS with model features switched on. Legacy software with a model inside it. A chatbot stood up by one department and never inventoried.

You cannot answer an Article 18 question, satisfy a sector regulator, or scope Dubai's agentic mandate without that inventory. So build it, and then write down for each system what it executes on its own, what it drafts for a human, and what it refuses. That is the work a tiered self-assessment would have forced on you, and it holds its value whether or not anyone legislates it.

What is not worth doing is buying a compliance product against a deadline no instrument sets. When we run a readiness audit the regulatory section names the instrument and the article; a claim that cannot be traced to one does not go into the report. That is the whole method: name the instrument and the article, or the claim stays out of the report. Applied to the September deadline, it takes one line to fail.