Start by checking which law, supervisory expectation, proposal, or guidance applies to your organization. The table identifies each instrument, its status, and who it addresses. The contribution section then explains what AAES Govern records can help a reviewer examine.
These pages describe the product and cite public instruments. They are not legal advice, not a certification, and not a statement that any instrument applies to your organization. The official source is authoritative; applicability questions belong to your advisers.
Instruments, by status
| Instrument | Status | What it addresses |
|---|---|---|
| Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 | Binding law, in force 2 January 2022. The law contemplates executive regulations; this note has not established their current publication status, so implementation deadlines dependent on them need separate confirmation. Establishment of the federal Artificial Intelligence and Data Authority was approved on 14 June 2026. | Federal personal-data processing, including automated processing, subject to statutory exclusions: certain government, health and banking data are carved out, and the financial free zones have their own regimes. Using AAES does not discharge the controller's duties; other parties' obligations depend on their roles. |
| Data Protection Law No. 5 of 2020 and Regulation 10 · DIFC | Binding in the DIFC. Regulation 10 on autonomous and semi-autonomous systems was introduced in September 2023. Its requirements and any applicable audit or certification conditions must be checked against the current DIFC legal database. Consultation Paper No. 3 of 2026 (closed 18 July 2026) proposes amendments, including a Regulation 11 on certification schemes (a proposal, not final). | AI-specific binding rules for autonomous and semi-autonomous systems processing personal data: impact and risk assessment, transparency notices, human-intervention design. For commercial systems undertaking the high-risk processing defined in Schedule 1, Article 3(a), Regulation 10.3.3 requires all of the following (cumulative conditions, not alternatives):
|
| Data Protection Regulations 2021 and FSRA cyber-risk requirements · ADGM | Binding in the ADGM. The FSRA's Cyber Risk Management framework (GEN 3.5, announced 29 July 2025) became mandatory for Authorized Persons and Recognized Bodies on 31 January 2026, including 24-hour material-incident notification to the FSRA. | Data protection and cyber resilience inside Abu Dhabi's financial free zone; AI systems sit inside both frameworks rather than a dedicated AI rule. |
| Guidance Note on Consumer Protection and Responsible Adoption and Use of AI and ML · Central Bank of the UAE (11 February 2026) | Supervisory guidance for licensed financial institutions: formally guidance, treated as an expectation in supervision. | Board accountability, model inventories with risk ratings, annual bias testing, consumer opt-out for high-impact decisions, and the expectation that human-out-of-the-loop operation is reserved for low-risk processes. The institution remains accountable for third-party AI. |
| UAE AI Charter (2024) | Policy instrument, non-binding. | Principles that shape procurement and vendor diligence rather than enforceable duties. |
What AAES Govern records may contribute
| Expectation | AAES contribution | Capability status |
|---|---|---|
| Named accountability (CBUAE board accountability; DIFC deployer duties) | Each registered agent has an accountable manager whose chain of managers ends at a person. AAES Govern records the approver for human approval decisions; those assignments do not establish statutory appointments. | Implemented. |
| Human intervention in high-impact processing (DIFC Regulation 10; CBUAE human-in-the-loop expectation) | Capabilities registered as irreversible require human approval bound to the exact request, with expiry. The operator classifies the action and must ensure reviewers have the information and authority to decide. | Implemented. |
| Records that may assist a regulator's review (DIFC audit expectations; CBUAE inventory and testing) | Decision records are linked by cryptographic fingerprints to help detect changes. The client's own reviewer can check an export offline. | Implemented. An independently controlled witness can be configured separately; that is not an external assessment, and the default deployment has none. |
AAES Govern decision records may support review of access and approval controls. They do not establish lawful processing, model fairness, suitability, or compliance with any instrument as a whole.
Export checks do not establish complete capture, downstream success, or meaningful human oversight. Enforcement requires a credential path the agent cannot bypass. See the verification checks and their limits.
Your responsibilities
- The client remains the regulated entity. Ask your advisers which of the three regimes (federal, DIFC, or ADGM) applies to you.
- Activity outside AAES Govern is visible only where telemetry is supplied. Decision records cover routed requests; reported telemetry may describe other activity without establishing complete coverage.
- AAES has no independent certification or assessment. No SOC 2 report exists, and no penetration test has been performed yet; an independent test is planned for Q4 2026. AAES's records do not establish satisfaction of any applicable DIFC certification requirement.
- Status changes. The DIFC amendments proposed in 2026 may be finalized, and the federal authority may begin operating, after this note's review date. Re-check the primary source before relying on the status shown here.
Bring the instruments your risk team cites to a scoped evaluation.