For DIFC, ADGM & GCC AI teams selling into Europe

If your AI features touch EU users, you’re already liable.

The EU AI Act applies extraterritorially. A UAE-licensed company that ships AI to EU customers is a “provider” or “deployer” under Article 2(1)(c) — and on the hook for fines up to €35M or 7% of global turnover. Art 50 transparency applies from 2 August 2026; Annex III high-risk from 2 December 2027 (Omnibus agreed, approved by European Parliament on 16 June 2026; approved by Council on 29 June 2026; pending OJ publication). Regula audits your codebase locally in one command. Free, open-source, no consultants.

no account · no API key · runs on your machine · read the trust pack

Why this matters for UAE companies

Four facts about EU AI Act extraterritoriality that GCC general counsel are double-checking right now.

Extraterritorial by design

Article 2(1)(c) of Regulation (EU) 2024/1689 explicitly applies to providers and deployers established outside the EU when the output of the AI system is used in the Union. Where you incorporate is irrelevant.

Source: Regulation (EU) 2024/1689 Article 2(1)(c)

The provider carries the liability

If your DIFC or ADGM company places an AI system on the EU market — directly, through a reseller, or via an EU-based customer using your API — you are the provider. Compliance liability sits with you, not your distributor.

Source: Regulation (EU) 2024/1689 Article 3(3) and Article 16

Fines up to €35M or 7% of global turnover

Article 99 sets the maximum administrative fine at €35 million or 7% of worldwide annual turnover, whichever is higher. For a DIFC fintech with EU exposure, this is materially worse than DFSA and DIFC data-protection enforcement combined.

Source: Regulation (EU) 2024/1689 Article 99

High-risk deadline: 2 December 2027 (Omnibus)

The Digital Omnibus provisional agreement of 7 May 2026 defers Annex III high-risk obligations from 2 August 2026 to 2 December 2027. The European Parliament approved the Omnibus on 16 June 2026 (423 for, 57 against, 174 abstentions). The Council approved it on 29 June 2026; publication in the Official Journal is expected before 2 August 2026. Until OJ publication, the original August 2026 deadline remains legally binding. Article 50 transparency obligations still apply from 2 August 2026.

Source: Council press release, 7 May 2026; Regulation (EU) 2024/1689 Article 113

Sectors with the highest exposure in the UAE

Where DIFC, ADGM, Dubai Internet City, and Abu Dhabi Hub71-licensed companies most often hit EU AI Act high-risk categories.

Fintech & lendingCredit scoring, loan approval, KYC risk → Annex III Cat 5 (essential services)
InsurtechHealth/life insurance pricing, claim assessment → Annex III Cat 5
HR & recruitment SaaSCV screening, candidate ranking → Annex III Cat 4 (employment)
Health-techClinical decision support, diagnostic AI → Article 6(1) + MDR/IVDR
ProptechTenant screening, rental decisions → Annex III Cat 5
Smart city / mobilityADAS, traffic management, biometrics → Annex III Cat 1, 2, safety components

DIFC, ADGM, and the federal layer: who regulates AI in the UAE today?

The UAE does not yet have a federal AI Act. AI governance today sits across sectoral and free-zone regulators, plus the federal data institutions now being consolidated into the Federal Authority for Artificial Intelligence and Data announced in June 2026 (Morgan Lewis). Most UAE AI teams encounter the three regulators below. None of them displace the EU AI Act when your product reaches EU users.

DIFC — Dubai International Financial CentreDIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020) + Regulation 10 on processing personal data through autonomous and semi-autonomous systems. Dubai Financial Services Authority (DFSA) regulates AI deployed in regulated financial services. Personal data triggers DP law; financial use triggers DFSA rules.
ADGM — Abu Dhabi Global MarketADGM Data Protection Regulations 2021 (modelled on GDPR). Financial Services Regulatory Authority (FSRA) regulates AI in licensed financial activities. ADGM's Office of Data Protection publishes guidance on the DPR 2021, including on automated decision-making.
Federal — UAE Data Office + AI CouncilFederal Decree-Law No. 45 of 2021 (PDPL) governs personal data across the mainland. In June 2026 the UAE announced a Federal Authority for Artificial Intelligence and Data, chaired by the Minister of State for AI, consolidating the AI Office, the Emirates Data Office and part of TDRA's remit. No federal AI Act has been enacted; sectoral regulators (Central Bank, DHA, MoHAP) retain their levers.

The practical takeaway: regardless of which UAE regulator sits over your company, if your AI touches EU users, EU AI Act obligations apply on top of your local rules. Regula checks against the EU layer locally, in one command, with no data leaving your machine.

What it looks like

Real session against a one-file Python script that calls OpenAI to score a CV — the canonical Annex III Category 4 case.

$ pipx install regula-ai
Successfully installed regula-ai-1.7.5

$ cat demo.py
import openai
def classify_resume(resume_text):
    client = openai.OpenAI()
    reply = client.chat.completions.create(
        model='gpt-4',
        messages=[{'role':'user','content':f'Score this resume: {resume_text}'}])
    return reply.choices[0].message.content

$ regula quickstart

Regula Quickstart

  Created: ./regula-policy.yaml

  First scan complete (0.0s)
  Files scanned:      1
  BLOCK findings:     1

  Top findings:
    [BLOCK] [ 88] demo.py
          Annex III, Category 4
          Employment and workers management

$ regula classify --file demo.py
HIGH-RISK: Employment and workers management - Articles 9, 10, 11, 12, 13, 14, 15

$ # From pip install to a categorised, article-cited finding in under 10 seconds.
$ pipx install regula-ai && regula quickstart

How you verify Regula independently

Procurement teams in DIFC and ADGM ask the same questions. Here are the answers, all in one document.