There’s been a lot of talk about the new Artificial Intelligence and Data Authority in the UAE, and honestly, most business owners still don’t realize how much this changes things. Three government departments got merged together. Now there’s one body that answers directly to the cabinet. It’s got real power to investigate companies and hand out fines.
The Personal Data Protection Law came out back in 2022. For years, it was basically toothless. Companies had it on the books, sure, but nobody was really enforcing anything. You could have a half-baked privacy policy and nobody would bother you. Your customer database could be a complete mess and that was fine. It was all very relaxed.
Not anymore. This new authority is different. They’re actually going to enforce things. They’re going to look at how you collect data. They’re going to check if your AI systems are using information properly. If you’re cutting corners, they’ll find out.
Here’s what I see when I talk to companies in Dubai and Abu Dhabi. Most of them have data scattered everywhere. Your sales team has customer records in one place. Marketing has them somewhere else. Finance has their own version. Your CRM doesn’t match any of them. Nobody actually knows which database has the correct information.
This was always messy, but it didn’t really matter much before. Now it matters a lot. If you’re using any kind of AI and let’s be honest, who isn’t these days; that AI is pulling from all this fragmented stuff. You’re feeding garbage into your systems and expecting good results. Meanwhile, you’ve got a regulator who wants to know exactly where your data comes from and how you’re keeping it safe.
The thing that gets companies in trouble isn’t usually one big mistake. It’s the complexity that builds up over years. You’ve got dozens of systems, each with slightly different customer information. Nobody’s really keeping track of what’s where. Then you deploy an AI tool and suddenly you’ve got a problem on your hands.
I know companies that spent serious money on AI platforms. They hired smart people. They built impressive systems. And then they realized their data infrastructure was held together with string and prayers. The AI couldn’t work right because the data was unreliable. Now they’re scrambling to fix it before the regulator comes knocking.
Basically, if you’re doing business in the UAE and you’re collecting any kind of customer information, this applies to you. Email addresses. Phone numbers. What they bought. Where they live. How often they visit your store. All of that counts as personal data.
It gets more serious if you’re using automation. A chatbot on your website? That’s AI. An algorithm that decides who gets approved for credit? That’s AI. Recommendations based on what someone looked at before? Also AI. All of these need to be running on data that you can prove was collected legally and stored securely.
If you’re operating in the DIFC, you’ve got your own set of rules on top of this. It’s not one or the other. You need to follow both.
What I find interesting is that a lot of companies have invested heavily in AI without really thinking about their data foundation. They get excited about the technology. They see what competitors are doing. They want to move fast. So they buy platforms and deploy tools. Then reality hits. Their data is a mess. The AI doesn’t work as well as it should. And now there’s a regulator asking questions.
You’ve got to start somewhere. First thing is to actually look at what you’re doing right now. What systems are you running? What AI tools are you using? How’s data actually moving through your company? Where’s it sitting? Who can get to it? Be honest about where you’re weak.
Most companies realize they need to spend money on getting their data organized. Not necessarily some massive enterprise software package, though that helps. You need to pull everything together. You need one source of truth for your customer data. You need to know where it came from. You need to know how you’re protecting it. You need to be able to say who can access what and why.
The companies that are doing this right aren’t treating it like a burden. They’re treating it like a chance to actually get organized. When your data is clean, everything works better. Your AI performs better. Your team moves faster. Customers get better service. And you’re not constantly stressed about getting investigated.
I’ve seen companies with AI adoption in the UAE handle this well. The ones that succeed are the ones that fix their data first, then add AI on top. It takes longer at the beginning, but it works out.
Your leadership team needs to be involved in this. It can’t just be an IT problem. You need actual policies about how people handle data. You need to train your staff. You need someone who’s responsible for this. Make it a real part of your business operations.
What is this Artificial Intelligence and Data Authority?
It’s a government body that oversees AI and data in the UAE. It enforces the Personal Data Protection Law. Unlike before, it actually has the power to investigate and fine companies.
Was there not already a data law?
There was, since 2022. But enforcement was basically nonexistent. Now there’s an actual agency that’s going to make sure companies follow it.
How does this affect our AI work?
You need to be able to show that your AI is using data that was collected legally. You need to show you’re protecting it properly. You need to know who’s accountable if something goes wrong.
What happens if we don’t comply?
They can investigate. They can take action. They can fine you. The exact amounts haven’t been published, but assume they’ll be significant.
Where do we start?
Look at what you’ve got. Your databases. Your AI tools. Your data policies. Figure out what’s broken. Then start fixing it.
Does this apply to everyone?
If you’re collecting personal data in the UAE, yes. That includes people in the DIFC. You need to follow both your zone’s rules and these federal rules.
How long do we have?
The law’s been around since 2022. The authority is already working. You should start now.
Can we use cloud storage?
You can, but you’re still responsible for the data. Make sure your provider meets UAE standards. You can’t just outsource your responsibility.
What about old data?
You still need to protect it. The authority can look back at how you collected it. You can’t just say it was before the rules.
Will this slow us down?
Maybe initially. But companies with good data practices actually move faster. Your AI works better. You deploy quicker. You get better results. It’s worth the upfront work.
What if we’re already using AI?
You need to audit it. Make sure the data feeding it is clean and legally collected. Make sure you can explain how it works. Get your house in order now rather than waiting for a problem.
Do we need to hire someone new for this?
Not necessarily. But you need someone accountable for data governance. Could be someone on your team. Could be external. But it needs to be someone’s job.
The journal of record for technology decisions in the UAE. Trusted reporting, in-depth analysis, and expert insights connecting business leaders, innovators, and technology professionals with the trends shaping digital transformation.
© 2026 Eyes On Solution. All rights reserved.
