Where the firm is licensed decides which rules apply. Onshore, the Central Bank of the UAE supervises banks, finance companies, payment firms and insurers, and the federal Personal Data Protection Law governs personal data. In the DIFC, the DFSA regulates financial services and the DIFC Data Protection Law applies. In ADGM, the FSRA regulates, under ADGM's own data protection regime.
What do the rules require, in plain words?
Onshore: the Central Bank of the UAE. Licensed institutions must manage risk, govern outsourcing, protect consumers and maintain sound information security. Consumer protection rules require fair treatment, clear disclosure, suitable products, protection of customer data and effective complaint handling. Responsibility for outsourced services stays with the licensed institution.
Onshore: the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Personal data must be processed fairly, transparently and lawfully, for specific purposes, minimised, accurate, secured and kept no longer than needed. People have rights including access, correction, erasure, restriction and objection, including to automated processing with legal or serious effects. Controllers must notify breaches and assess high-risk processing. The law does not apply where specific legislation governs certain banking, credit or health data, or within free zones that have their own data protection law.
DIFC: the DFSA and the DIFC Data Protection Law. DFSA-regulated firms must manage operational and technology risk, outsourcing and conduct. The DIFC Data Protection Law is modelled closely on GDPR-style principles, and the DIFC has added rules for personal data processed through autonomous and semi-autonomous systems, covering notice, purpose and accountability for such systems.
ADGM: the FSRA. FSRA-authorised firms face equivalent expectations on technology risk, outsourcing and conduct, and ADGM has its own data protection regulations.
Who does it apply to?
The licence decides. An onshore bank answers to the Central Bank and the federal data law. A DIFC investment firm answers to the DFSA and the DIFC data law. A group with entities in more than one jurisdiction will have agents subject to different rule sets, sometimes on the same platform.
What does this mean when the system is an agent that acts?
One platform, three regimes. A group running the same agent for its onshore bank and its DIFC wealth arm must apply the stricter combination, or configure the agent per entity. Data flowing between the two jurisdictions is a transfer that needs a basis under each law.
Autonomous systems have specific rules in the DIFC. An agent that processes personal data and acts with little human direction falls squarely within the DIFC's rules for autonomous and semi-autonomous systems. Firms need to give clear notice that such a system is used, describe its purpose and keep accountability with a named party.
Arabic and English both matter. Customer-facing agents commonly work in both languages. Disclosures, product information and complaint routes must be equally accurate in each, because conduct rules apply to what the customer reads.
Health data is often governed separately. Healthcare agents face emirate-level health data rules in addition to, or instead of, the federal law. See AI agents for compliance teams in healthcare in the United Arab Emirates.
The payments perspective is in AI agents for compliance teams in payments in the United Arab Emirates, and the design question of running one platform across regimes is covered in how to design an AI agent architecture for a regulated business.
How do you meet the rules?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Licence-based scoping | Each agent tagged to the entity and jurisdiction it serves | Agent register by entity |
| Outsourcing | Platform assessed and contracted per regulator's expectations | Due diligence; contract; notifications where required |
| Information and technology risk | Agent identity, scoped access, logging and testing | Access maps; logs; test reports |
| Consumer protection and conduct | Agent content approved in each language; complaints routed | Approved content; complaint logs |
| Federal PDPL: lawful processing and rights | Agent purposes recorded; rights requests reach agent stores | Processing records; request files |
| Automated processing with serious effects | Significant decisions held for a person, or safeguards documented | Hold records |
| DIFC autonomous systems rules | Notice and accountable party for agents processing personal data | Notices; accountability records |
| Cross-jurisdiction transfers | Basis recorded for data moving between onshore, free zones and abroad | Transfer assessments |
| Breach handling | Incidents assessed under each applicable law | Incident records |
What will the Central Bank, the DFSA, the FSRA or a data regulator ask?
- Which entity does each agent serve, and which regulator supervises it?
- Where is agent data processed, and how does it move between jurisdictions?
- Who is accountable for each agent?
- How do you ensure Arabic and English answers say the same thing?
- What can the agent decide or execute without a person?
- How have you met the DIFC's rules for autonomous systems?
What do these rules not cover?
There is no federal AI statute that licenses or bans agents. The UAE has published national AI strategy and ethics material, which is guidance rather than binding law for private firms. Firms serving the EU must also meet EU rules; see how AI agents are regulated in the European Union, and for another market with layered regulators, how AI agents are regulated in South Africa. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, authority is granted per capability, per customer, and the minimum chain applies the customer's own limits at the moment of action. A group can set different limits for its onshore and DIFC entities on the same agent, and each verdict, naming the bound that decided, is filed in an append-only record that shows which entity's rules applied.
Questions people ask
Does the federal PDPL apply to a DIFC firm?
Generally no. Free zones with their own data protection law, such as the DIFC, are outside the federal law's scope for processing within the zone. A DIFC firm processing data onshore or transferring it there must consider both.
Is consent required for an agent to process customer data onshore?
Consent is the main basis under the federal law, with exceptions such as performance of a contract and legal obligations. Most customer service uses can rest on contract, but the purpose must be clear and the processing kept to it.
Do UAE regulators require AI agents to be approved before use?
There is no general approval requirement for agents. Outsourcing rules may require notification or approval for material outsourcing, which can include an agent platform supporting key functions.