Seven Rounds, Two Chapters Closed
A September 3, 2026 status report on the EU-UAE free trade agreement talks confirms what negotiators have been signaling since the summer: seven rounds since talks launched in June 2025 have produced agreement on just two chapters — small and medium-sized enterprises, and an anti-fraud clause. Digital trade remains an open gap, grouped with energy pricing and public procurement as the toughest unresolved areas heading into an eighth round scheduled for the week of October 5, 2026. Energy pricing is stuck because the UAE will not concede on dual pricing for energy-intensive industries, citing sovereignty; procurement is stuck because most UAE public contracts are awarded at the emirate level, not federally, a structural mismatch with the EU's template. Digital trade's holdup looks different on inspection, and it deserves more scrutiny than it has gotten.
The EU's Ask Is Reasonable
Start with the strongest case for what Brussels wants. The EU's digital trade chapters — closed with Japan, the UK, Singapore, New Zealand, and others — typically prohibit forced data localization, ban demands to hand over proprietary source code, and lock in a right to move data across borders subject to privacy carve-outs. The EU tabled its own textual proposal on digital trade for the UAE talks on July 11, 2025, according to the European Commission's own negotiating-documents page. That's not an aggressive ask by EU standards; it's the same template Brussels uses everywhere. And the underlying interest is real: European banks, logistics firms, and cloud providers operating in the UAE need predictable rules for moving customer and operational data home, rather than negotiating bespoke contractual safeguards deal by deal. A trade chapter that fixes those terms once removes friction that currently gets re-litigated by every company independently.
But the UAE Genuinely Can't Promise It Yet
The UAE's resistance here isn't the same sovereignty reflex driving the energy fight. It's closer to a sequencing problem. The UAE's Federal Decree-Law No. 45 of 2021 on Personal Data Protection came into force on January 2, 2022, and created the UAE Data Office as the federal regulator, per the government's own u.ae portal. The law's Article 22 lets personal data leave the country when the destination is deemed to offer "adequate" protection — the same architecture the EU itself uses under GDPR. Article 23 provides fallback routes (contracts, consent, judicial cooperation) when no adequacy finding exists.
Nearly five years after the law passed, the UAE Data Office still has not published an adequacy list identifying which countries qualify, according to legal-compliance trackers following the file into 2026. Businesses transferring data out of the UAE today are doing so almost entirely through Article 23's case-by-case fallback — contracts, impact assessments, and documented justifications — not through the adequacy pathway the statute was actually designed around. Layered on top, mainland UAE, the Dubai International Financial Centre, and Abu Dhabi Global Market each run separate data protection regimes, so even transfers between a company's own UAE entities can technically count as cross-border movements requiring paperwork.
Don't Confuse Unfinished Architecture With Bad Faith
This matters for how the digital trade chapter should be read. A government cannot credibly bind itself in a treaty to EU-equivalent data-flow guarantees when its own regulator hasn't yet decided, domestically, which countries clear that bar. That's not obstruction in the way the energy dispute is — it's an admission that the UAE's federal privacy architecture is still mid-construction. Pushing Abu Dhabi to sign a data-flow commitment ahead of finishing that architecture risks the UAE overpromising Brussels something its own Data Office cannot yet operationalize at home, which would be worse for everyone than a clean delay.
The fix isn't for the EU to drop the ask, and it isn't for the UAE to rush out an adequacy list to hit an October deadline. It's to decouple the treaty text from the finish line — a standstill-plus-review clause that locks in today's de facto openness (the Article 23 fallback regime already lets EU-UAE data move) and commits both sides to revisit once the UAE Data Office's implementing rules and adequacy list actually exist. The EU has used exactly this kind of phased approach in other digital trade chapters rather than demanding day-one full parity with its own GDPR Chapter V regime.
What to Watch in October
The practical stakes of getting the sequencing right are moderate, not existential: EU companies in the UAE have already been navigating Article 23's contract-by-contract regime for years, so a finished chapter would mostly formalize existing practice and cut transaction costs, not open a genuinely new channel. The real signal to watch on October 5 is whether negotiators close digital trade on a review-clause basis alongside the customs and sanitary-measures progress already logged, or let it slide into 2027 bundled with the harder, more ideological energy and procurement fights. Treating a sequencing problem like a political one would be the costlier mistake for both sides.