On 26 October 2026, at the Dubai AI Festival, Dubai Crown Prince Sheikh Hamdan approved a new target for the Dubai AI Campus in DIFC. The campus is to host more than 1,000 AI companies and over 5,000 highly skilled jobs by 2030. According to the Dubai Media Office release, more than 500 AI companies have joined since the May 2024 launch. They have secured over AED 1 billion from private equity and venture capital funds, and the campus has contributed to more than 2,000 specialised tech jobs. It passed its original five-year company and investment target two years early. A new 100,000 sq ft purpose-built building is planned in the DIFC Zabeel District.
The UAE has done this without a horizontal AI statute. That is unusual in a year when much of the world is writing comprehensive AI laws, and it raises a fair question about how long the approach can last.
The case for a single federal law
The strongest argument for a federal AI law is legal certainty. A company deciding where to put a model-training team, or whether to deploy an AI system to consumers, wants to know which rules apply, who enforces them and what an appeal looks like. Fragmented regimes can leave those questions open. A statute also gives individuals a clear right to challenge automated decisions, and it gives regulators a mandate that a guidance note cannot. These are real benefits, and a pro-innovation publication should not wave them away.
What the UAE has instead
The UAE's answer is layered governance. Three layers matter here.
- Free-zone rules. DIFC added a specific AI-related regime in 2023. Regulation 10 of the DIFC Data Protection Regulations covers personal data processed by autonomous and semi-autonomous systems. As Mayer Brown's January 2026 analysis describes it, deployers are treated like controllers and operators like processors. Users must get notice, and high-risk processing needs certification, an appointed Autonomous Systems Officer, or purposes that are human-defined or human-approved. Mayer Brown notes the Commissioner anticipates a "permissive certification-based regime rather than licensing". That is a proportionate design, but the certification guidance is still expected in 2026.
- A new federal body. On 14 June 2026 the UAE announced the Federal Authority for Artificial Intelligence and Data. Morgan Lewis reports that it consolidates the AI Office, TDRA's Information and Digital Government Sector and the Emirates Data Office. Its listed functions include setting national AI and data policy, proposing legislation and setting standards. The same analysis flags open questions. These include how IoT oversight will be divided, and whether the Authority will prioritise data-protection enforcement given that the PDPL's implementing regulations are still unissued.
- Sector guidance. The Central Bank issued a guidance note on responsible AI use on 23 February 2026. It applies to licensed financial institutions and sets principles on governance and accountability, fairness, transparency and explainability, human oversight, and data management and privacy. It describes itself as a reference for institutions rather than a statute.
Why the light touch has worked so far
This structure matches the pace of AI deployment. Guidance can be revised in months, while statutes take years and tend to be written around yesterday's technology. The free zones also let a regulator compete for talent with predictable, English-language common-law rules. The campus numbers show the result. The 2024 Dubai Media Office launch release set a target of 500-plus firms and 3,000-plus jobs by 2028. The company count was passed ahead of schedule, though the roughly 2,000 jobs reported so far are still short of the earlier jobs figure.
The design also avoids the worst failure of horizontal laws, which is compliance cost paid by every start-up whether or not its system poses real risk. DIFC's certification-over-licensing approach and the Central Bank's principles-based note both put the burden where the risk sits.
Where the model is exposed
A free-zone strategy has limits, and the 1,000-company target will push on them.
- Boundary problems. A company in DIFC, a bank supervised federally and a consumer app serving all seven emirates may each answer to a different rule set for the same system. The more successful the campus becomes, the more often those lines will be crossed.
- Soft law can harden unpredictably. Guidance with no statutory ceiling can be tightened by supervisory practice without notice or consultation. A light-touch regime stays light only if its rules are published, stable and challengeable.
- Institutional overlap. The new federal authority is explicitly empowered to propose legislation. If that produces a broad statute, it should be built on the free-zone experience. It should not simply override it.
There is also a free-expression and openness dimension that investment announcements rarely mention. AI governance that depends on discretionary guidance is most attractive when firms trust that it will not be used to shape lawful speech or access to tools. That trust has to come from published standards and review mechanisms, not from the current leadership's goodwill.
What a proportionate path looks like
The UAE does not need to copy a comprehensive statute to fix these gaps. Three steps would be enough.
- Publish the DIFC high-risk certification guidance on schedule, and state clearly how it interacts with federal sector rules.
- Have the new Federal Authority issue a public map of which regulator governs which AI use case. It should consult industry and civil society before proposing any legislation.
- Commit to risk-tiering. Any federal law should regulate high-risk uses and leave general-purpose research and low-risk deployment alone.
The campus's early results are a genuine proof of concept that a predictable, investment-led approach can attract builders. They are not proof that the approach scales to 1,000 companies and a federal authority with legislative ambitions. That depends on whether the next layer of rules is as clear and proportionate as the first.