Many technology companies in Dubai and across the UAE assume that European AI rules are a European problem. That assumption can be costly. The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) was written to reach businesses outside the EU whenever their AI systems, or the outputs of those systems, touch the European market. In this article, AI lawyer Dr. Ahmadreza Moini explains when the Act applies to UAE companies, what changed in 2026, and what you should do now.
The Short Answer
Yes, the EU AI Act can apply to a UAE company, even one with no office, staff or servers in Europe. What matters is not where your company is incorporated, but where your AI system is placed on the market, put into service, or where its output is used.
When the EU AI Act Reaches Companies Outside the EU
The Act’s territorial scope is deliberately broad. In practice, a UAE business is likely to be caught in three main situations:
- You sell or license an AI system to EU customers. A Dubai start-up offering an AI-powered SaaS product to clients in Germany or France is a “provider” placing an AI system on the EU market, regardless of where it is established.
- The output of your AI is used in the EU. Even if the system itself runs in the UAE, the Act can apply where its output, such as a recommendation, score or generated content, is used in the Union.
- You provide a general-purpose AI model. Developers of foundation or general-purpose models made available in the EU have their own set of obligations, wherever they are based.
Non-EU providers of certain systems, including high-risk AI systems and general-purpose AI models, must also appoint an authorised representative established in the EU. For many UAE companies, this is the first concrete compliance step they encounter.
The Risk-Based Approach in Brief
The Act does not regulate all AI equally. It sorts systems by risk:
- Prohibited practices, such as certain manipulative techniques and social scoring, are banned outright.
- High-risk systems, including AI used in recruitment, credit scoring, education, essential services and critical infrastructure, face the heaviest requirements: risk management, data governance, technical documentation, human oversight, and conformity assessment.
- Limited-risk systems, such as chatbots and generative AI, carry transparency duties, for example telling users they are interacting with AI and labelling synthetic content.
- Minimal-risk systems face no specific obligations under the Act.
Key Deadlines After the 2026 Digital Omnibus
In 2026 the EU adopted the “Digital Omnibus on AI”, which entered into force on 27 July 2026 and postponed several obligations. The timeline now looks like this:
- 2 February 2025: prohibited AI practices apply.
- 2 August 2025: obligations for general-purpose AI models apply.
- 2 August 2026: most transparency obligations under Article 50 apply. These were not postponed.
- 2 December 2026: end of the grace period for watermarking and marking AI-generated content for systems already on the market.
- 2 December 2027: obligations for stand-alone high-risk systems listed in Annex III apply (previously 2 August 2026).
- 2 August 2028: obligations for high-risk AI embedded in products covered by EU product-safety law apply (previously 2 August 2027).
The postponement is a reprieve, not a repeal. The technical work required for high-risk compliance, from documentation to human-oversight design, takes time, and companies that start late will struggle to meet the new dates.
What About UAE Law?
Complying with the EU AI Act does not replace local obligations. The UAE has no single AI statute comparable to the EU Act, but AI projects are shaped by the federal personal data protection law, the separate data protection regimes of free zones such as DIFC and ADGM, and sector-specific rules from financial, health and telecommunications regulators. A UAE company serving European clients will often need to satisfy both sets of rules at the same time, which makes early conflict-of-laws analysis essential.
Penalties
Fines under the Act are significant. The most serious breaches, involving prohibited practices, can lead to fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Other breaches carry lower but still substantial ceilings. Beyond fines, non-compliance can mean losing access to EU customers and partners who will increasingly demand evidence of compliance in their contracts.
Five Practical Steps for UAE Companies
- Map your AI systems. List every AI system you build, license or use, and identify which ones reach EU users or produce outputs used in the EU.
- Classify the risk. Determine whether each system is prohibited, high-risk, limited-risk or minimal-risk, and whether you act as provider, deployer, importer or distributor.
- Meet the transparency duties now. Chatbot disclosures and labelling of AI-generated content are already required, so these should be your first priority.
- Review your contracts. Update agreements with EU clients and AI suppliers to allocate compliance responsibilities, warranties and liability clearly.
- Plan for high-risk obligations. If any system may be high-risk, begin documentation, data-governance and human-oversight work well before December 2027, and consider appointing an EU authorised representative.
How an AI Lawyer Can Help
Determining whether the EU AI Act applies, and how it interacts with UAE and free-zone rules, requires both regulatory and comparative legal analysis. PAD International Group advises technology companies, start-ups and investors on AI regulatory compliance, AI contracts, data protection and AI-related disputes. Learn more about our AI lawyer services or book a consultation with Dr. Moini.
This article provides general information as of October 2026 and is not legal advice. AI regulation is changing quickly; please seek advice on your specific situation.