On 16 September 2026, the Dubai Electronic Security Centre (DESC) unveiled SARAAB at GISEC Global 2026, describing it as the first open-source deepfake-detection AI model built by a government entity in the Arab region. On 1 October, at the launch of Cyber Security Awareness Month, Dubai Police announced a dedicated AI crimes unit and a deepfake detection tool. The UAE still has no standalone deepfake statute. Enforcement rests on Federal Decree-Law 34 of 2021 on countering rumours and cybercrimes. The sequence is notable: tooling first, definitions later. That is a defensible order, but it leaves real gaps.
The case for what Dubai is doing
The strongest argument for state action is that deepfakes attack the evidentiary basis of everything else. A Dubai Police Future Foresight Centre study, reported by The National, warns that fakes threaten the reliability of digital evidence and that, as they improve, people may begin doubting genuine content too. Its director, Hamdan Al Ghassiya, pointed to more sophisticated identity theft, impersonation and fraud. A regulator that waited for a perfect statute while fraudsters moved at the speed of generative models would be failing its public.
Seen that way, SARAAB is a reasonable first move. According to Gulf News, DESC says the model reaches up to 91% accuracy, scored 89% on previously unseen data, and can analyse clips as short as seven seconds, where the open-source models it compared against generally needed 15 seconds or more. Those are DESC's own figures. We found no independent benchmark, so treat them as claims to be tested, not settled facts.
Open-source is the right instinct
The choice to release SARAAB openly is the most pro-innovation part of the announcement. DESC says it will be offered through developer platforms so that AI engineers, security experts and researchers can test it, build on it and contribute. Gulf News reports the platforms as Hugging Face and GitHub, but DESC's own page names no platforms, release date or licence. Until a repository exists, the openness is a promise.
If it ships, open release matters for a practical reason. Detection models decay: every improvement in generation invalidates part of a detector's training data. A closed government tool will age quietly, while an open one can be attacked, audited and retrained by outside researchers. Publishing accuracy on unseen data, as DESC has begun to do, is the right norm. The next step is publishing the test sets and methodology so the 89% can be reproduced.
Where detection stops and law begins
A detector produces a probability, not a verdict. A model that is wrong 9–11% of the time will, at scale, flag genuine footage and miss fakes. In a courtroom or a takedown process, that error rate has consequences, and Dubai Police's own study makes the point that technology alone will not solve the problem and that verification skills and institutional preparedness matter too.
That is where the absence of a deepfake-specific law bites. The 2021 decree reaches deepfake harms only by analogy. As Khaleej Times summarises it, impersonating someone through a fake account carries a fine of Dh50,000 to Dh200,000 and/or jail, rising to two years if used to defame the victim. Spreading false information carries a minimum of one year and Dh100,000. Article 54, on using or modifying electronic bots to circulate fake news, carries up to two years and Dh100,000 to Dh1 million. That summary does not mention AI or manipulated media at all, and we could not retrieve the official text to check article-level wording, so readers should consult the decree itself.
This matters for three reasons. First, a defendant's lawyer can argue that a synthetic video of a real person is neither an impersonated account nor a bot-driven rumour. Second, broad false-information provisions invite the opposite problem, over-reach, where satire, parody or ordinary error is swept in alongside malicious fakes. For a publication that favours free expression, that is the larger worry: a statute written around "rumours" is a blunt instrument for synthetic media. Third, a new police AI unit with a detection tool will be making judgement calls on which content is fake before any legal definition says what a fake is.
What proportionate regulation would look like
The UAE does not need a sweeping new regime. A narrow amendment would do more than a new law:
- Define synthetic media by its harm: realistic fabricated depictions of identifiable people used to deceive, defraud or damage reputation, with an express carve-out for labelled satire, art and research.
- Require proof of intent or foreseeable harm, so that sharing a fake in good faith is not treated like making one.
- Treat detector output as a lead for investigators, not as conclusive evidence, and require human and forensic review before prosecution or takedown.
- Attach disclosure duties to the commercial generators and distributors with real capacity to label content, rather than to individual users.
DESC's regulatory pages, which cover certifications, critical infrastructure, licensing and recommended standards, do not currently mention AI or deepfakes. That shows the institutional gap: the body building the detector is a security agency, not the author of the rules that give its output meaning.
Bottom line
Dubai deserves credit for shipping capability, and for choosing open source over a black box. But detection is a means, not a policy. Without a definition of the harm, a standard of proof and clear protection for legitimate expression, the UAE will have a faster way of identifying fakes and the same general law with which to punish them. The sensible next step is a small, precise legal fix that follows the tooling, not a larger regulatory build-out.