UAE: technology regulation at a glance

Framework: Multi-regulator framework: Federal Cabinet Decision No. 111/2022 (SCA federal VASP regime); Central Bank of the UAE Payment Token Services Regulation (PTSR, 2024, fully effective June 2025); Dubai Law No. 4 of 2022 establishing the Virtual Assets Regulatory Authority (VARA) with a full rulebook suite; ADGM/FSRA Virtual Asset framework; DIFC/DFSA Investment Token & Crypto Token regime.

Crypto is fully legal in the UAE and operates under one of the world's most developed regulatory regimes, structured as a multi-layer system in which federal authorities (Securities & Commodities Authority and the Central Bank) set baseline rules while Dubai (VARA), ADGM (FSRA) and DIFC (DFSA) run dedicated licensing regimes. Any entity providing virtual asset services in or from the UAE must be licensed; comprehensive rules cover exchanges, custody, token issuance and stablecoins. The regime continues to evolve, with the Cabinet Decision 100/2024 VAT exemption for virtual asset transfers and the CBUAE Payment Token Services Regulation's transition period ending in June 2025 marking a maturing framework.

Framework: UAE National AI Strategy 2031; DIFC Data Protection Law Regulation 10 (Sept 2023); Federal Decree-Law No. 44 of 2021 (PDPL); UAE Charter for the Development and Use of AI (June 2024); Ministry of AI and UAE Council for AI

The UAE has no single comprehensive federal AI law but governs AI through a layered framework: the National AI Strategy 2031 sets strategic direction, a non-binding 2024 AI Charter articulates 12 ethical principles, and binding sector-specific rules exist in the Dubai International Financial Centre under DIFC Data Protection Regulation 10, which mandates impact assessments and transparency for AI systems. The federal Personal Data Protection Law (2021) also imposes obligations on AI-driven data processing across the mainland, while in April 2025 the Cabinet approved a world-first AI-powered legislative intelligence ecosystem to accelerate regulatory drafting, though this deploys AI in governance rather than constituting an AI Act.

Framework: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), administered by the Emirates Data Office (established under Federal Decree-Law No. 44 of 2021); DIFC and ADGM financial free zones maintain parallel, independent GDPR-aligned regimes

The UAE enacted its first omnibus data protection law, Federal Decree-Law No. 45 of 2021 (PDPL), which came into force on 2 January 2022 and applies to mainland processing of personal data by domestic and foreign entities alike. Executive Regulations issued in 2024 activated detailed compliance obligations, with the Emirates Data Office as the mainland supervisory authority. DIFC and ADGM each operate separate data protection regimes with independent enforcement offices.

Framework: Federal Decree-Law No. 6 of 2025 on the Central Bank (effective 16 September 2025), consolidated with the Retail Payment Services and Card Schemes Regulation (RPSCS, 2021); regulated by the Central Bank of the UAE (CBUAE) on mainland, with the DFSA (DIFC) and FSRA (ADGM) governing free-zone fintech.

The UAE operates one of the most comprehensive digital payments and fintech licensing regimes in the Middle East, anchored by the RPSCS Regulation (2021) which requires CBUAE licensing for all retail payment service providers across nine service categories. Federal Decree-Law No. 6 of 2025 consolidated and expanded the regulatory perimeter to capture technology providers facilitating licensed financial activities, including DeFi platforms and virtual-asset payment services. The CBUAE's Financial Infrastructure Transformation (FIT) programme underpins a live national instant-payment rail (Aani), a forthcoming open finance framework, and a planned central bank digital currency.

Framework: UAE Virtual Working Programme (Remote Work Visa), administered federally by the Federal Authority for Identity, Citizenship, Customs & Port Security (ICP) and by Dubai's General Directorate of Residency and Foreigners Affairs (GDRFA); supplemented by the 10-year Golden Visa and 5-year Green Visa regimes under Cabinet Resolution No. 65 of 2020 and subsequent ministerial decisions

The UAE operates a dedicated one-year renewable Remote Work Visa (Virtual Working Programme), launched in October 2020, allowing foreign nationals employed by or owning businesses registered outside the UAE to reside under self-sponsorship with full Emirates ID. Requirements were materially tightened in 2026: the monthly income floor rose to USD 5,000 (from USD 3,500), mandatory health-insurance coverage increased to AED 500,000, bank-statement proof doubled to six consecutive months, and employment documents must now be apostilled and UAE-mission attested. Separately, a 10-year Golden Visa and 5-year Green Visa offer longer-term residency for investors, high-earning professionals, and freelancers.

Framework: Multiple federal instruments: Federal Decree-Law No. 34/2021 (Combating Rumours and Cybercrimes), Federal Decree-Law No. 26/2025 (Child Digital Safety, in force January 2026), Federal Decree-Law No. 55/2023 (Media Regulation); TDRA mandatory ISP content filtering; UAE Media Council advertiser-permit regime

The UAE regulates online content and safety through a layered but fragmented set of federal laws and administrative regimes rather than a single comprehensive online-safety act. The Telecommunications and Digital Government Regulatory Authority (TDRA) mandates ISP-level filtering of broadly defined prohibited content, including unlicensed VoIP, gambling, pornography, LGBTQ+ material, and content deemed contrary to public morality or national security, with criminal liability for circumvention via VPNs. A landmark Child Digital Safety Law (Federal Decree-Law No. 26 of 2025), effective 1 January 2026, introduces DSA-adjacent obligations on platforms and ISPs including risk-proportionate age verification, default privacy for children, and parental-consent requirements for under-13 data processing, with a one-year compliance window.

Framework: UAE Cybersecurity Council + Federal Decree-Law No. 34/2021 (Cybercrime Law) + Federal Decree-Law No. 45/2021 (PDPL) + Signals Intelligence Agency (formerly NESA) Information Assurance Standards + National Cybersecurity Strategy 2025-2031

The UAE operates a multi-layered cybersecurity regime anchored by Federal Decree-Law No. 34/2021 (in force January 2022), which criminalises unauthorised access, hacking, and infrastructure attacks, complemented by a mandatory 72-hour breach-notification duty under the Personal Data Protection Law (Federal Decree-Law No. 45/2021). A dedicated UAE Cybersecurity Council (established by Cabinet in 2020) oversees national coordination, and the Cabinet-approved National Cybersecurity Strategy 2025-2031 (February 2025) sets a whole-of-government active-defence agenda backed by over $2 billion in investment.

Framework: Federal Decree-Law No. 32 of 2021 (Commercial Companies Law), amended by Federal Decree-Law No. 26 of 2020 (100% foreign ownership) and Federal Decree-Law No. 20 of 2025; administered by emirate-level Departments of Economic Development (DED) and individual Free Zone Authorities

The UAE is one of the world's most accessible jurisdictions for foreign business formation. Since March 2021, foreign nationals may own 100% of a mainland LLC across most commercial, professional, and industrial activities, with free zones always having permitted full foreign ownership. Company registration can be completed digitally in as few as 5-14 business days, and the government's Bashr platform targets a 15-minute online incorporation pathway.