If you ask three organisations in the UAE which regulator oversees their use of personal data and AI, you may get three different answers. That is because the UAE has three data protection regimes, not one. The federal mainland, the DIFC and the ADGM each have their own law and their own regulator, and they have developed at very different speeds.
In June 2026, the UAE announced a new Federal Authority for Artificial Intelligence and Data. For the first time, one federal body is responsible for both data and AI. This should help the mainland get the regulator, and in time the detailed rules, that it has been missing since the PDPL came into force in 2022. But the Authority does not merge the three regimes, and it changes nothing in the DIFC or the ADGM.
This paper explains what that means in practice. We take one AI chatbot and look at how it would be treated under each regime, then set out what organisations should do now, depending on where they operate. It is written for compliance, legal and business leaders.
Download the white paper here