On 21 April 2026, Abu Dhabi Global Market (ADGM) hosted the release of the World Alliance of International Financial Centers' first report on artificial intelligence in financial services. Its headline finding was unsurprising but consequential: AI is now "firmly embedded" across the world's financial hubs, yet most jurisdictions still lack any AI-specific regulation, governing the technology instead through existing data-protection law. (ADGM) Two days later, the UAE Cabinet announced that half of all federal government services would be delivered by AI agents within two years. (The National)
The gap between those two facts — aggressive deployment, deliberately thin statute — is not an oversight. It is the UAE's regulatory strategy, and ADGM is its clearest expression.
A regulator that ships code, not just rules
Where Brussels wrote a 113-article AI Act sorting systems into risk tiers, ADGM's Financial Services Regulatory Authority took a different route with its Open Regulation (OpenReg) initiative. Rather than publishing prose for firms to interpret, the FSRA put machine-readable regulations and its own AI models on a public GitHub repository, letting RegTech firms and data scientists build compliance tools directly against the regulator's logic. "This is the first time a regulator has tried to provide regulatory context in the form of machine-readable regulations and AI models," said FSRA chief Emmanuel Givanakis, describing a programme developed with the Mohamed bin Zayed University of Artificial Intelligence. (ADGM)
This is regulation as infrastructure rather than prohibition. ADGM has not enacted a dedicated AI law; nor has its sister free zone, the DIFC. Both apply principles-based regimes — accountability, governance, robust data protection — layered on GDPR-aligned data rules, with sector guidance like the FSRA's "Guidelines for Financial Institutions Adopting Enabling Technologies" filling the detail. (Latham & Watkins) At the emirate level, Abu Dhabi created the Artificial Intelligence and Advanced Technology Council under Law No. 3 of 2024 to coordinate AI projects and investment, but the council steers strategy and capital, not granular compliance.
The case the regulators get right
First, the steelman for going slower. The Atlantic Council notes the UAE's ethical guidelines are "nonbinding," and the Center for AI and Digital Policy ranks the country "Tier 4," citing a "lack of algorithmic transparency laws and weak independent oversight." (Atlantic Council) Those are not pedantic complaints. When half a government's services run on autonomous agents that "analyse, decide, execute and improve," a citizen denied a benefit or flagged by a model deserves an explanation and an appeal — and the documented willingness of platforms to geo-block human-rights accounts in the UAE shows the stakes of opaque, unaccountable decision-making in the region. A binding right to algorithmic explanation, enforced by an independent body, would close a genuine accountability gap.
That critique should be answered, not dismissed. But it argues for targeted obligations — transparency, contestability, independent audit — not for importing a horizontal risk-tier statute that freezes a fast-moving field.
Why proportionate beats prescriptive
The EU AI Act's core weakness is that it classifies systems by category before anyone knows how they will behave, then bolts on compliance costs that fall hardest on the smaller entrants a competitive market needs. ADGM's model inverts this: regulate outcomes and obligations, and make compliance computable so that meeting the rule is cheap and verifiable rather than a legal guessing game. A startup that can run its model against the regulator's published logic spends its capital on the product, not on outside counsel parsing recitals.
The scale the UAE is chasing makes the efficiency argument concrete. AI is projected to add roughly $91 billion to the economy and to double its share of GDP from about 10 percent in 2022 toward 20 percent by 2032, on the back of compute build-outs — from 414 MW of data-centre capacity today toward a planned multi-gigawatt cluster — and more than 5,600 active startups. (Atlantic Council) A regime that priced out new entrants would forfeit exactly the dynamism those numbers assume.
The free-zone structure also functions as a real-world sandbox. ADGM and DIFC can pilot AI licensing and supervisory tooling on sophisticated, well-capitalised firms, observe failures in a contained perimeter, and harden rules before any federal codification. That iterative path — test, measure, then legislate the parts that proved necessary — is more likely to produce durable rules than a single grand statute drafted before the evidence exists.
The one fix worth legislating
None of this excuses the transparency gap. The proportionate move is narrow: make algorithmic explainability and contestability enforceable for AI systems that make consequential decisions about individuals, and give an independent body — not the deploying authority — the power to audit them. Crucially, ADGM has already built the mechanism. OpenReg's machine-readable approach could publish not just compliance models but the audit and disclosure standards themselves as testable code.
The UAE has bet that you regulate AI best by building the tooling to govern it, not by drafting a statute and hoping the technology stands still. On the evidence so far, that bet is sound — provided Abu Dhabi treats enforceable transparency as the next feature to ship, not an optional one.