UAE Creates Single AI Regulator to Unify Fragmented Oversight Powers

FEDERAL REGULATOR CONSOLIDATES UAE AI AND DATA OVERSIGHT IN MAJOR GOVERNANCE RESTRUCTURING

On 14 June 2026, His Highness Sheikh Mohammed bin Rashid Al Maktoum announced the establishment of the Federal Authority for Artificial Intelligence and Data, a unified national body that consolidates previously fragmented oversight functions under a single structure answerable directly to the Cabinet. The decision resolves a persistent governance problem: the UAE’s approach to AI and data regulation had been distributed across multiple institutions, leaving jurisdictional boundaries unclear and enforcement authority ambiguous.

The new Authority absorbs three existing bodies: the UAE’s Artificial Intelligence Office, the Information and Digital Government Sector within the Telecommunications and Digital Government Regulatory Authority (TDRA), and the Emirates Data Office, which had been formally announced but never achieved full operational capacity. Its mandate spans policy direction, legislative proposals, standards development, compliance oversight, research capacity building, and international partnership expansion, covering both federal and local digital initiatives.

The Authority will be led by the Minister of State for Artificial Intelligence, Digital Economy and Remote Work Applications, positioning it as the central coordinating body for how the UAE manages artificial intelligence and data governance at the national level.

One jurisdictional boundary remains unresolved. The Authority absorbs TDRA’s digital government functions, but TDRA continues operating as a telecom regulator. The announcement does not clarify where responsibility for Internet of Things regulation ultimately resides, or whether oversight will be divided based on whether an issue concerns connectivity or data governance. That distinction is likely to become one of the Authority’s first substantive jurisdictional questions.

For businesses operating on the UAE mainland, the most pressing practical implication concerns the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the PDPL). The law has been in force for several years, but its Implementing Regulations remain unpublished. Those regulations are essential to operationalise core concepts including legal basis for processing, data subjects’ rights, cross-border transfers, and breach notification requirements. No supervisory authority has been unambiguously designated to oversee PDPL compliance, leaving the private sector in prolonged regulatory uncertainty.

Market expectation is that the Authority will assume responsibility for finalising those regulations and bringing enforcement of the PDPL within its mandate. Whether this occurs quickly, or whether AI governance and digital government priorities crowd out data protection enforcement in the Authority’s early phase, remains to be seen. The structural conditions for progress are now in place for the first time.

Meanwhile, the UAE maintains separate data protection frameworks in its free zones. The DIFC Commissioner of Data Protection and ADGM Commissioner of Data Protection operate independently within their respective jurisdictions, enforcing their own frameworks. Both have developed active enforcement practices, issuing decisions, imposing sanctions, and providing regulatory guidance that has clarified how privacy obligations are interpreted and applied. The mainland PDPL draws on many of the same principles as these free zone frameworks.

For companies operating across multiple UAE jurisdictions, with entities or processing activities spanning both free zone and onshore locations, regulatory coherence between these frameworks substantially reduces compliance complexity. The Authority building its enforcement posture with reference to the established practice developed by DIFC and ADGM would represent a logical path forward, and one the market would welcome.

This consolidation sits within a broader pattern of intentional ecosystem development. The UAE National AI Strategy establishes an ambitious 2031 target for deploying AI across education, government services, and community well-being, with an economic growth target of AED 335 billion (approximately $91 billion) in additional value. Against that backdrop, the creation of the Authority functions as deliberate infrastructure investment rather than administrative reorganisation.

The consolidation reflects the UAE’s consistent governance philosophy: pairing ambition with pragmatism and treating regulatory design and commercial growth as compatible objectives. A regulator whose mandate explicitly spans policy, standards, compliance, and international partnership is structured to engage with the market rather than simply constrain it. Businesses operating in AI, data processing, and digital infrastructure in the UAE should monitor how the Authority establishes stakeholder engagement in its formative phase. The approach it adopts in that opening period is likely to shape the relationship between regulator and industry for years to come.