The UAE's new Federal Authority for AI and Data: what it means for technology teams

What was announced

In June 2026 the UAE approved the establishment of the Federal Authority for Artificial Intelligence and Data, reporting to the Cabinet, as a unified national body for data governance, artificial intelligence and digital government¹². Commentary reports that it brings together three existing functions¹³:

The mandate described in commentary covers the national AI strategy, government data governance, and standards and compliance across federal entities¹³. By October, reporting on the UAE's AI programme was already framing the authority as the body bringing national data, AI and digital government systems together⁶.

This week: Dubai's AI campus targets

On 26 October, during the Dubai AI Festival, Dubai approved new targets for its AI campus: more than 1,000 AI companies and over 5,000 specialised jobs by 2030⁴⁵. Together with federal consolidation, the direction is clear: one national voice on AI and data standards, and emirate-level competition to host the companies building on them.

What we don't know yet

• Private sector reach. The described mandate centres on federal entities. How far its standards will extend to private companies, directly or through procurement, is not yet clear.
• Interaction with free zones. DIFC and ADGM have their own data protection regimes, including DIFC Regulation 10 on AI systems. How federal AI standards will sit alongside them remains to be seen.
• Data protection supervision. The federal PDPL continues to apply. Which body leads on its AI-related aspects will become clearer through guidance.
• Health data. Sector rules, such as those in the UAE health data law, remain in place.

The regional pattern

Saudi Arabia went down this path earlier, with the Saudi Data and Artificial Intelligence Authority as a single body for data and AI⁷, alongside its own data protection law covered in Saudi PDPL and cross-border AI. A combined data and AI authority tends to treat data governance and AI governance as one discipline. Architecturally, that's right: most AI risk is data risk.

How I'd prepare

1. Map your current obligations by entity and location: federal PDPL, free zone regimes, sector rules, and where your models and data actually run, as discussed in UAE AI infrastructure.
2. Build governance on a recognised framework, such as ISO 42001 or the NIST AI RMF, so national standards become a mapping exercise.
3. If you sell to government, expect federal data and AI standards to appear in procurement first. Keep an AI system inventory and data lineage ready to evidence.
4. Unify data and AI governance internally. If the regulator treats them as one discipline, a separate AI committee disconnected from data owners will struggle.
5. Watch for guidance from the new authority and plan a quarterly review of your mapping.

How I can help

I help companies in the UAE and the US build AI platforms with governance that maps cleanly across regimes. As a fractional CTO I can own that work. Or analyse your challenge and bring the result to a call.