UAE Establishes Federal Authority for Artificial Intelligence and Data

The United Arab Emirates has just made one of its most consequential regulatory moves in the technology space. On 14 June 2026, His Highness Sheikh Mohammed bin Rashid Al Maktoum announced the creation of the Federal Authority for Artificial Intelligence and Data (the Authority), a unified national body consolidating AI oversight, digital government, and data regulation under a single structure reporting directly to the Cabinet of the UAE.

WHAT WAS ANNOUNCED

The Authority will be led by the Minister of State for Artificial Intelligence, Digital Economy and Remote Work Applications and will function as the UAE’s centralised umbrella institution for managing data, artificial intelligence, and digital government across the federation.

WHAT IT ABSORBS

The Authority consolidates three existing bodies: the UAE’s Artificial Intelligence Office, the Information and Digital Government Sector within the Telecommunications and Digital Government Regulatory Authority (TDRA), and the previously announced Emirates Data Office (the latter, though formally announced, has never became fully operational in practice).

This is not a cosmetic restructuring or a simple merger of functioning institutions. It represents a deliberate and thoughtful effort of the UAE to resolve the fragmentation that had, in practice, left meaningful questions about regulatory jurisdiction and enforcement unresolved.

RESPONSIBILITIES AND FUNCTIONS

The mandate is broad: setting unified national AI and data policy direction, proposing legislation and strategies, ensuring coherence between federal and local digital initiatives, establishing standards and guidelines for data and AI management, driving compliance across federal entities, building national R&D capacity, and expanding international AI partnerships.

Interestingly, it is not clear to what extent the Authority will be responsible for development and enforcement of Internet of Things (IoT) regulation. TDRA has to date been the primary federal body overseeing IoT deployment and data governance in connected device environments. The Authority absorbs TDRA’s digital government functions, but TDRA itself continues to exist as a telecom regulator.

Where IoT oversight ultimately sits, and whether it will be split between the two bodies depending on whether the issue is connectivity or data, is not yet clear from the announcement and is likely to be one of the first jurisdictional questions the Authority will need to address.

WHY THIS MATTERS

PDPL Enforcement: The Question the Market Has Been Waiting to Answer

For businesses operating on the UAE mainland, the most immediate practical question is what this consolidation means for the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the PDPL).

While the PDPL has been in force for several years, its Implementing Regulations—which are necessary to operationalise key concepts around legal basis for processing, data subjects’ rights, cross-border transfers, and breach notifications—have still not been issued. Enforcement has remained elusive: no supervisory authority has been unambiguously designated for private sector oversight, and businesses have been operating in a state of prolonged regulatory uncertainty that has far outstayed its welcome.

The expectation across the market is that the Authority will take ownership of finalising those regulations and bring meaningful enforcement of the PDPL within its mandate. Whether that happens quickly or whether AI governance and digital government crowd out data protection enforcement in the Authority’s early phase is not yet clear. But the structural conditions for progress are, for the first time, genuinely in place. How the Authority moves on this in its first year will be closely watched.

In any case, in developing its enforcement approach the Authority might look closely at what has been built within the UAE’s own free zones. Both the DIFC Commissioner of Data Protection and ADGM Commissioner of Data Protection (operating independently within their respective jurisdictions and without any reference to the PDPL) have developed active and increasingly sophisticated enforcement practices under their respective data protection frameworks, issuing decisions, imposing sanctions, and providing substantive regulatory guidance that has given the market a clearer picture of how privacy obligations are interpreted and applied in practice.

The mainland PDPL draws on many of the same principles. For companies operating across the UAE, with entities or processing activities spanning both free zone and onshore jurisdictions, regulatory coherence between these frameworks is not just convenient—it substantially reduces compliance complexity.

The Authority building its enforcement posture with reference to the body of practice that DIFC and ADGM have already developed would be the most logical and constructive path forward, and one the market would welcome.

The AI Context: A Deliberate Ecosystem

This development sits within a much broader pattern. The UAE has been building one of the most active AI ecosystems in the world with intent and consistency. The UAE National AI Strategy sets an ambitious horizon of 2031 for developing an integrated system employing AI in vital areas including education, government services, and community well-being, with the economic target of AED 335 billion (around $91 billion) in additional growth.

Against this backdrop, the creation of the Authority reads less like administrative housekeeping and more like deliberate infrastructure investment for building the institutional architecture that a serious AI economy needs to function properly.

What This Signals for the Market

The consolidation reflects the UAE’s consistent approach to technology governance: pairing ambition with pragmatism, and recognising that regulatory design and commercial growth are not competing objectives. A regulator whose mandate explicitly spans policy, standards, compliance, and international partnership is one that is structured to engage with the market and not simply control it.

Businesses operating in AI, data processing, and digital infrastructure in the UAE should monitor how the Authority sets up its stakeholder engagement early as the approach it takes in its formative phase is likely to shape the tone of the relationship with industry for years ahead.