Artificial intelligence (AI) is currently transforming the activities of both the public and private sectors, and the Middle East is no exception. The region is increasingly asserting itself as a centre of innovation in this field, thanks to the United Arab Emirates (UAE).
The UAE’s stated aim is to move away from an economy heavily reliant on oil to a more diversified economy, much of which will be based on new technologies. In this respect, the Emirates has set a clear objective: to shift 20% of its economy to technological activities by 2031. This digital transition will only be achieved with major resources.
To match its ambitions, the Emirates has its approach, which we will attempt to decipher.
The national AI ecosystem is booming
The booming national AI ecosystem in the UAE is the result of remarkable strategic planning and execution. As early as 2017, the UAE took the lead by becoming the first state in the world to create a ministry specifically dedicated to AI. This pioneering initiative was followed by the launch of the national AI strategy by the federal Emirati government, with a horizon set for 2031.
This strategy is broken down into an interesting triptych, as follows:
• building a solid ecosystem with human and material resources;
• developing AI activities, particularly in the public sector;
• promote strong leadership through a reputation as a destination for IA.
Through this strategy, the Emirates paints an honest picture of the situation, listing its strengths and improvement areas. While the Emirates are keen to dynamically develop research and development (R&D), they are quite honest in stating that they are “a young country that has not yet established a strong academic tradition” to provide a pipeline of world-class researchers. The Emirates will therefore have to resort to other means of accessing AI research and development talent. And to do this, it has deployed a genuine strategy of welcoming and retaining talent. For example, in March 2022, the government introduced a specific license allowing companies in the field to work within the Dubai International Financial Centre (DIFC) Innovation Hub, which is the largest cluster of fintech in the region. This license offers certain benefits to their employees, including long-term residence visas (golden visas).
In parallel, the Emirates has started developing its own AI systems, as the world discovered a few months ago. Indeed, the federation has developed a model that has created surprise and unanimity on an international scale – Falcon LLM – which is an open source generative AI model. This model quickly gained recognition and prestige, topping the rankings on the Hugging Face platform. Philipp Schmid, an AI researcher at the machine-learning platform Hugging Face, points out that “The UAE was not well known, before, for training models. But then, by more or less the next day, we knew that they can train models, they open-source their models, they publish research around it, which benefits all”.
A few months ago, the Advanced Technology Research Council (ATRC) announced the creation of MGX, a new technology investment company with Mubadala and G42 as founding partners. The company will invest in leading partnerships in the UAE and globally, with the potential to reach $100 billion in assets under management. MGX’s investment strategy will focus on three main areas: AI infrastructure (data centers and connectivity), semiconductors (graphics card unit (GPU) design and manufacturing), and core AI technologies and applications (AI models, software, data, life sciences, and robotics). A few weeks apart, Microsoft invested $1.5 billion in the capital of G42. This is a strategic investment that “will strengthen the UAE’s position as a global centre for AI”, according to Microsoft.
A federation involved in international institutional initiatives
While the UAE government regularly invites the CEOs of the biggest companies in the sector to talk about AI – Satya Nadella from Microsoft, Jensen Huang from Nvidia, Sam Altman from OpenAI, etc. – it also regularly discusses the subject with the various institutional players at international level.
Indeed, the UAE has taken concrete steps to become part of the global landscape of AI governance and regulation by adhering to international standards and participating in meetings and discussions on the subject for several years now.
In March 2018, President Macron, at the launch of France’s AI Strategy, announced that he wanted to create an “IPCC of artificial intelligence” – the Intergovernmental Panel on Climate Change. The Emirates has expressed a desire to work with France and other governments to create the foundations for such a body. On the 22nd of May, the Abu Dhabi AI and Advanced Technology Council (AIATC) and the French Ministry of Economy, Finance and Industrial and Digital Sovereignty jointly signed a Memorandum of Understanding on AI. This agreement aims to develop the AI ecosystems of both countries through a combination of investment programs and collaborations that foster the responsible development and deployment of AI.
In November 2021, the UAE joined the United Nations Educational, Scientific and Cultural Organization’s (UNESCO) Member States in adopting the first-ever global ethical framework for the use of AI. A year later, in 2022, the Emirates played an active part in drawing up the Organization for Economic Cooperation and Development (OECD) Framework for Classifying AI Systems, which is now a reference document in the field and has greatly inspired the European Commission’s work on the AI Act.
In November 2023, the Emirates attended the AI Summit organized by the UK, where they signed the Bletchley Declaration alongside 27 other countries. This declaration which establishes international cooperation in the field of AI, promotes the development of transparent AI systems that respect human rights, diversity, and the protection of privacy. It prohibits the development of AI systems for surveillance, discrimination, or manipulation of any kind.
Finally, in February 2024, the government went a step further by signing an agreement with the United Nations Development Program (UNDP) to strengthen AI research and development in the Arab region.
Participating in these types of meetings and taking part in these types of engagements allows the UAE to forge strategic partnerships, discuss challenges and opportunities, share best practices, and be part of a movement to harmonize AI governance and regulation.
The pedagogical approach of the UAE Federal Government
A society is only as good as its approach to the major challenges it faces. One of its most significant responses is the way it decides to regulate. In many of our Western societies, “regulate” is often a synonym for “legislate”, to provide a framework in law, a text with probative and coercive force. But “to regulate” means above all “to ensure the correct functioning, the regular rhythm of a mechanism, the development of a process”. It is possible to regulate via the firm tool of the law, the text, just as it is possible to regulate via more flexible tools such as recommendations aimed at modifying or guiding the behaviour of their recipients by eliciting their support, for example.
When it comes to AI, the UAE government has not yet enacted any regulations. It has, however, published a great deal of documentation on the subject: Guidelines for the adoption of AI within government departments, a General-purpose AI guide, a List of 100 general-purpose AI use cases in the media, an AI maturity an AI ethics guide, and so on. In addition, the Emirate of Dubai has published an open-access self-analysis tool on AI ethics, which appears to be easy to use and effective in providing companies or public bodies with an initial analysis of the risks and impacts that the development and deployment of their systems may entail.
Through these publications, the UAE government is reiterating its desire for “appropriate” regulation. Is the government going to regulate via binding texts, or does it consider these resources to be sufficient soft law? While the publications are certainly not legally binding, they are valuable reference documents to support companies in the development and deployment of their AI systems. Soft law, which is more flexible, can initially anticipate the development of hard and coercive legal rules. The future will tell whether the government intends to legislate on this subject. For the time being, it is quite clear that when it comes to regulating AI, the UAE government is adopting an approach that is intended to be more educational.
Institutions producing voluntary standards
The UAE has a unique legal system, in which Muslim canon law, French law, and Anglo-Saxon common law blend and prevail depending on the matters dealt with at the federal and state level. At this crossroads of worlds, it is not easy to navigate the legal landscape, as the sources are so numerous and heterogeneous. There is a mixture of different laws, and coercive power is distributed in a way that is different from that in Europe. This singular context has given rise to certain specificities in terms of regulation.
In the United Arab Emirates, for example, there are international and autonomous jurisdictions that operate with their own regulations, laws, and courts that are distinct from the country. While the UAE government has not yet enacted any legislation to regulate AI, some of these autonomous bodies have taken up the subject, and standards have emerged for companies and public bodies developing, deploying, and using AI, which are ultimately quite similar in spirit to what our Western societies wish to adopt.
For our study, let’s take the example of the Dubai International Financial Centre (DIFC). This financial centre has several powers, particularly within the banking and financial sectors, which it administers. Since its creation in 2004, + 4300 members entities are registered and the institutions has drafted 30 laws covering various aspects ranging from intellectual property to labour rights. A Personal Data Protection Act was also enacted in 2020 . Interestingly, this law provides a framework for the processing of personal data operated via autonomous and semi-autonomous technological systems.
It should be noted that this text has been put out to public consultation so that industry experts, researchers, civil society organizations, and other stakeholders can comment on it and so that it can be adapted accordingly. This approach ensures that the text is balanced and adapted to the challenges faced by those working directly on the ground.
Finally, although this is a voluntary standard to which players choose whether to adhere, this law has a wider scope than it appears. The Data Protection Act, which recently included provisions on AI systems, applies to entities that are members of the DIFC, as well as to those that process personal data in this area as part of stable contractual relationships, even if they are not members of the DIFC themselves. In other words, this means that the law covers both entities inside and outside the DIFC that are involved, directly or indirectly, in the processing of personal data within this jurisdiction.
The example of DIFC and its regulatory framework consistent with international standards
On reading the text, the effort made to harmonize with international standards is striking. For example, the definitions of autonomous and semi-autonomous systems have been adapted in line with the work of the OECD and the European Commission, and the definitions of system operators and deployers have been adapted in line with the AI Act and China’s Management Measures for Generative AI Services.
In addition, the text requires the operators and deployers of such systems to notify the persons concerned of several items of information, including certification of conformity. Among the certifications recognized by DIFC are those of the OECD, UNESCO, and the National Institute of Standards and Technology (NIST). Note that the Ministry of AI is developing a certification under the name “UAE AI Seal”. This certification aims to verify that AI systems developed and deployed are safe and effective, as reported by the Ministry. This certification will comprise 4 levels of approval: public sector, private sector, institutional, and product. Based on this classification, we can deduce that not only a product but also an organization can receive this certification. There is little information about the certification methodology that will be used, but the government indicates that it will be based on world standards in terms of ethics and robustness. This certification project will certainly be added to this list, which will be amended over time by the Commissioner in charge of applying the law.
The text also stresses the importance of respecting ethical considerations in this area, stipulating that such systems processing personal data must be designed in such a way as to comply with standards of fairness, transparency, security, and responsibility.
It also sets out specific requirements for systems involved in “high-risk processing activities”. It states that these systems will have to comply with additional audit and certification requirements set by the relevant Commissioner. As far as AI regulation is concerned, we can see that the risk-based approach is therefore common to several regions of the world, although it remains to be seen what the Commissioner will put behind the term “high-risk processing activities”.
Interestingly, the text stipulates that deployers or operators of such systems must appoint an Autonomous Systems Officer (ASO) with responsibilities like those of a Data Protection Officer (DPO) under the regulations. It should be noted that this function does not currently exist in European regulations, but it seems entirely appropriate given the subject matter and the need to appoint a person at least responsible for ensuring the compliance of such systems within an entity.
Finally, DIFC will retain the right to monitor the processing carried out. The text obliges the deployers and operators of such systems to make available to the Commissioner responsible for regulation any information demonstrating that the systems comply with the regulations.
Conclusion
The Emirates offers valuable lessons in economic, technological, and institutional commitment that could inspire other nations. While the subject still raises many questions due to its constant evolution, the technical nature it imposes, and the social and legal concepts it disrupts, the Emirates has, for the time being, opted for an approach that makes the federation a key location for the development and deployment of AI systems. Last February, Sam Altman went so far as to say that the UAE could serve as a global “regulatory sandbox” for testing AI technologies. As we know, technological time is precious in this field, and it will certainly not be slowed down by the time it takes to comply with regulations. In particular, the interoperability mechanisms foreseen for the recognition of foreign compliance certifications will enable UAE institutions and companies to make their compliance process much smoother. This is a pragmatic approach to the ambitious goals the UAE has set itself for 2031. Combined with its ability to mobilize significant resources quickly, the UAE is now undeniably a frontrunner in the AI race.
