On 14 October 2026, UAE Minister of State for Artificial Intelligence Omar Sultan Al Olama told a World Economic Forum panel in Dubai that no AI agent will make decisions affecting a person's livelihood in federal services. Gulf News quotes him: "If human livelihood is going to be affected by the agent, then it's a red line." It also reports that about 70 per cent of services have some tolerance for AI deployment, while the remaining 30 per cent carry risk above the government's tolerance. Every federal agent must connect to a central "control tower" that logs its actions and decision process.
The design is better than most. The weak point is where it sits: the reporting names no law, decree or regulator behind it.
The strongest case for the UAE's approach
The case for a government-run model is real. The UAE is moving fast. In April 2026, Sheikh Mohammed bin Rashid announced that 50 per cent of UAE government sectors, services and operations will run on agentic AI within two years. The official u.ae guide, updated 30 September 2026, describes a framework that mandates agentic AI in 50 per cent of government sectors, services and operations by 2028.
At that speed, a single authority can move faster than a multi-agency statute. It can also build safeguards into the platform itself rather than bolt them on afterwards. A rule that every agent must register with one logging layer is easier to enforce than a requirement that each ministry audit its own vendors. A central register of agent actions gives auditors something concrete. Most jurisdictions regulating automated decisions have no equivalent.
What the design gets right
Three features deserve credit from anyone who favours innovation with proportionate rules.
- Risk-tiering by service, not by technology. Mapping every federal service and excluding the riskiest 30 per cent is the proportionate approach. It avoids a blanket ban on agents and a blanket licence for them.
- A bright line where harm is hardest to reverse. A wrongly denied benefit, licence or permit can destroy a livelihood before an appeal is heard. Gulf News reports that Al Olama placed accountability on the deploying institution, not the agent. That is the right place to put it.
- Logging at the action level. Gulf News reports that the control tower records, in Al Olama's words, "every action and every specific thought that the agent thinks of or action that it takes." It also says the system will face continuous auditing by both AI systems and humans.
The approach also leaves the private sector alone. Nothing reported extends the red line to businesses, which keeps the UAE's pitch to AI developers intact.
Where the gap lies
A policy position is not an enforceable right. Gulf News's account of the briefing names no law, decree or regulation. The u.ae guide refers to a framework and a unified guide, not a statute. It promises governance frameworks for responsible use and says the assistant can "ask for your approval when needed".
Three practical questions follow.
- Who defines "livelihood"? A fee assessment, a visa renewal and a permit suspension all touch income. If the boundary is drawn inside the same ministry that deploys the agent, the exclusion can shrink quietly as pressure to hit the 50 per cent target grows. The 30 per cent figure is also a snapshot. Gulf News says those services "currently" exceed the government's tolerance, which implies the list can change.
- Who can see the logs? A control tower logging every action is a strong audit tool only if someone outside the deploying body can read it. The reporting does not say whether citizens, courts or an independent body can access it.
- What can a person do when an agent errs? The red line covers the highest-stakes decisions. Many mid-stakes decisions stay in the 70 per cent where agents may act. Those people need a clear route to human review and a remedy.
The UAE already has a data protection statute. The u.ae portal identifies it as Federal Decree Law No. 45 of 2021, in force since 2 January 2022. The portal's summary covers consent, correction, restriction and cross-border transfers. It does not mention automated decision-making or human review. I could not retrieve the statute's full text from the official portals, so I cannot say how it applies to federal agencies' agent deployments. That is the question a regulator or the government itself should answer in public.
What would make the red line credible
The fix is modest and does not slow deployment. First, publish the service map, or at least the criteria that sort a service into the excluded 30 per cent. Second, put the red line in a binding instrument, so a future minister cannot move it by memo. Third, give an independent body read access to the control tower's logs and a duty to report on them. Fourth, give affected people a plain right to ask a human to review any agent-assisted decision.
These steps cost little. They also make the UAE's promise something investors and residents can rely on. Light-touch regulation works when rules are predictable. A rule that exists only as a conference statement is predictable only until the next conference.
The UAE has chosen a sensible shape: tier by risk, log everything, hold institutions accountable. The next step is to write it down where a court or regulator can enforce it.