What the UAE AI Act introduces
The UAE AI Act establishes a four-tier, risk-based classification framework for all AI systems deployed in the UAE. It is the first national AI legislation in the country and sits alongside — not in place of — existing sector-specific frameworks including DIFC Regulation 10 and the CBUAE Guidance Note.
The four risk tiers
Tier 1 — Minimal risk: AI systems with negligible impact on individuals or society. Basic automation, content recommendation, internal productivity tools.
Tier 2 — Limited risk: Systems with some interaction with individuals but limited consequences. Customer service chatbots with human escalation, document classification tools.
Tier 3 — High risk: Systems that make or significantly influence decisions with material consequences for individuals. Credit scoring, fraud detection, KYC classification, and compliance monitoring all sit here for financial institutions. This is where most DIFC fintechs will find their production models.
Tier 4 — Critical risk: Systems whose failure could cause significant harm to individuals or national infrastructure. Requires UAE AI Authority approval before deployment.
The September 2026 self-assessment deadline
All businesses deploying AI must self-assess their systems against the risk tier framework within six months of the Act's effective date. For most institutions, this creates a September 2026 deadline.
The self-assessment covers: identifying every AI system in scope, classifying each against the four-tier framework, documenting the basis for each classification, and submitting the assessment to the UAE AI Authority.
Penalties for non-compliance reach up to AED 10 million. The penalties are scaled to breach severity, with the highest reserved for Tier 4 systems deployed without approval or repeated Tier 3 failures.
How it interacts with DIFC Regulation 10 and CBUAE guidance
The UAE AI Act does not replace existing sector-specific frameworks. A DIFC-licensed fintech must satisfy the UAE AI Act's self-assessment obligation and DIFC Regulation 10 and the CBUAE Guidance Note. The frameworks are additive.
The practical implication: the model inventory required for DIFC Regulation 10 and the CBUAE Guidance Note is also the foundation for the UAE AI Act self-assessment. Institutions that have built a comprehensive inventory of their AI systems with risk tier classifications will find the self-assessment largely derivable from that work.