The UAE created a federal AI authority reporting to Cabinet

The United Arab Emirates approved the creation of an Artificial Intelligence and Data Authority on 14 June 2026, chaired by Omar Sultan Al Olama. The body absorbed the AI Office, the digital government sector of the telecommunications regulator and the UAE Data Office, reports directly to the Cabinet, and has the power to propose AI and data legislation. The consolidation is the substantive part. AI policy, data policy and digital government policy had been sitting in three places with adjacent remits — a common arrangement internationally, and one that makes it harder to say which body owns a given answer. Merging them puts all three under one accountable structure. The Authority reports to Cabinet rather than to a ministry, which places it above the departments it coordinates rather than beside them. It can propose legislation, which makes it a source of rules rather than only an implementer of them. What it does not have is a dedicated AI statute to enforce. The UAE has deliberately not passed one. AI systems must instead comply with existing law — the Personal Data Protection Law, the Child Digital Safety Law, sectoral regulation and the separate rule books of the financial free zones. That is a considered choice rather than an omission, and it mirrors the approach several jurisdictions have taken after watching the EU AI Act's drafting. Regulating AI as a distinct category requires defining it, and every definition either captures too much or dates quickly. Regulating outcomes under existing law does not have that problem. The most enforced AI rule in the region is not federal. DIFC Regulation 10 has been the leading AI-specific regulation across the Middle East, Africa and South Asia since 2023, and reached full enforcement in January 2026. That is characteristic of how UAE regulation develops. DIFC and ADGM have their own legislatures and their own courts, and they move faster than a federal process by design. A rule proves itself in a free zone with a few thousand licensed entities before anything comparable is attempted nationally. For a company operating in the UAE it means the relevant question is not what UAE law says but which UAE it is in — and the answer changes the compliance obligation materially. The date with the clearest operational consequence is 1 January 2027, when full UAE Personal Data Protection Law compliance is required. That is now inside sixteen months. Companies training or deploying models on UAE personal data should be reading the PDPL rather than waiting for AI-specific rules, because on the current design the PDPL is the AI rule.