UAE’s New AI and Data Authority: What Private Companies Should Do Now

On 14 June 2026 the UAE Cabinet established the Federal Authority for Artificial Intelligence and Data. It reports to Cabinet and is led by Omar Sultan Al Olama, Minister of State for Artificial Intelligence, Digital Economy and Remote Work Applications. It consolidates the UAE Artificial Intelligence Office, the Information and Digital Government Sector of the TDRA, and the Emirates Data Office.

Legal commentary through September and again on 9 October 2026 treats that merger as the institutional fix the market had been missing. The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in force for years. Its executive regulations were still unissued as of September 2026 updates. No public date has been set. The working expectation is that this Authority is the body that will finish those regulations and own enforcement. That is an expectation, not a commenced rule.

What changed, and what did not

What changed is the map. AI policy, government data, and the data-protection function that never fully stood up now sit in one federal body. A vendor questionnaire that used to be three conversations can become one.

What did not change is the operating duty. Mainland private companies do not have a new fine schedule from this announcement. DIFC firms already have a separate regime: Regulation 10 has been in full enforcement since 1 January 2026 for personal data processed by autonomous systems. A Dubai mainland clinic is not a DIFC firm. It still should not paste patient messages into a public chatbot.

The inventory that will be asked for

When regulations land, the first request is rarely a model name. It is a list. Build that list now, while it is still an internal document.

• Every system that reads customer, patient, employee, or invoice data and produces a decision or a message. Include the WhatsApp bot, not only the tool labelled AI.
• The vendor, the subprocessor, and the region where the transcript is stored. A BSP dashboard in one country and a model endpoint in another are two rows.
• What the system can write. A reply is one permission. Creating a sales order or changing a price is another.
• The human owner when it is wrong. A shared inbox with no named escalation is not an owner.
• Whether customer content is used to train a provider model. If the contract is silent, treat it as unknown, not as no.

AWS and Strand Partners, with the UAE Artificial Intelligence Office, reported on 2 October 2026 that 72% of UAE businesses use AI and only 31% of adopters have custom systems or agents. The other adopters are mostly on public chatbots. That is the set most exposed if training-data questions get sharper. The Authority does not need a new prohibition for a clinic to stop putting lab questions into a consumer chat window.

How this meets the agent projects already in market

Dubai’s Create AI Agents Championship opened registration on 7 October 2026, with a prize pool above AED 2.5 million and a December close. The same month, Dubai’s agentic AI accelerator put 33 government entities on a shared pipeline with the Dubai AI Seal and DESC’s AI security policy. Private companies will be sold both stories.

Copy the governance, not the prize. DESC’s point on the government programme is that security review starts at design, not after go-live. A WhatsApp agent for a distributor should have the same shape: read the price list, refuse to invent a price, write only to a queue a person can reject.

What to do this quarter

1. Name one person who owns the agent inventory. Not a committee.
2. List WhatsApp, CRM, and ERP connections that send personal data to a model or a BSP.
3. Turn off any workflow that puts clinical, credit, or invoice data into a public chatbot.
4. Ask each vendor, in writing, where transcripts are stored and whether they train on them.
5. Keep the Authority announcement out of the sales deck until a regulation is actually issued. Customers will ask. “We have an inventory and a stop rule” is a better answer than a prediction.

If the agent is already on the number customers message, the useful next step is the permission boundary, not a new model. We scope that against the CRM or WhatsApp line you already run.

Related reading:

• Why most UAE AI adoption is still a chatbot
• What private companies should take from the Create AI Agents Championship
• WhatsApp CRM