AI security and governance for UAE enterprises
The UAE governs AI through its data protection laws, its free-zone regulators and sector rules rather than one AI act. Kapālins maps those obligations to controls proved continuously, for banks, government entities and the groups headquartered in Dubai and Abu Dhabi.
What changes for the UAE enterprises, and when.
DIFC Regulation 10's AI-specific requirements have applied since January 2026, and the federal PDPL is moving toward full compliance expectations in 2027. Across the Gulf, Saudi Arabia's regulator has already issued dozens of enforcement decisions under its PDPL, and UAE boards read those as a preview. The UAE's national AI strategy means AI adoption is a mandate; proving it is governed is the next board question.
- In force
DIFC Regulation 10 AI-specific requirements in force. Data controllers and processors using autonomous or semi-autonomous systems in the DIFC must meet specific duties. Source (secondary)
- In force · upcoming
UAE PDPL full-compliance expectation. Reported by secondary sources; the PDPL's fines still await a Cabinet decision. Verify against the UAE Data Office before quoting. Source (secondary)
Dates: each entry links to its source. A source marked secondary is a law firm, analyst or vendor summary; check the primary text before relying on the date. The full calendar is on the AI regulation tracker.
Mapped on the platform for the UAE.
Also mapped at onboarding: UAE PDPL and DIFC rules are mapped to your controls at onboarding; they are not yet published as framework pages.
Every framework page says which controls are proved by a live signal from the gateway, probes or device sensor, and which by assessment evidence. Both are exported in the regulator evidence pack.
Hosting and residency.
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon.
Industries and cities.
Questions buyers in the UAE ask.
Is Kapālins available in the UAE?
Yes. Kapālins is delivered remotely from Melbourne, Australia, and through partners in the Authorised, Premier and Elite tiers. Organisations in Dubai, Abu Dhabi are served in the same way: a briefing on your own estate, then onboarding.
Which the UAE frameworks does the platform map?
ISO/IEC 42001, ISO/IEC 27001, SOC 2, OWASP LLM Top 10, NIST AI RMF. Each framework page lists the controls mapped and whether a control is proved by a live platform signal or by assessment evidence. UAE PDPL and DIFC rules are mapped to your controls at onboarding; they are not yet published as framework pages.
Where is our data hosted?
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon.
Are UAE frameworks on the platform?
UAE PDPL and the DIFC rules are among the Middle East frameworks mapped to your controls at onboarding. They are not yet published as public framework pages; the published library covers ISO/IEC 42001, ISO/IEC 27001 and the global standards.