Generative AI Data Privacy Compliance in UAE: Legal Risks When Employees Upload Confidential Information to ChatGPT

Generative AI Data Privacy Compliance in UAE: Legal Risks When Employees Upload Confidential Information to ChatGPT

Estimated reading time: 34 minutes

Generative AI Data Privacy Compliance in UAE Is Now a Board-Level Confidentiality Issue

Generative AI data privacy compliance in UAE is not governed by a single comprehensive “ChatGPT law”. As at 31 October 2026, the more accurate legal position is that the corporate use of ChatGPT UAE, artificial intelligence chatbots, automated drafting tools, coding assistants, document-analysis platforms and similar generative artificial intelligence systems must be assessed through several overlapping legal regimes. These include Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services, the UAE Charter for the Development and Use of Artificial Intelligence, Federal Decree-Law No. 33 of 2021 Concerning Regulating Labour Relations, Federal Decree-Law No. 32 of 2021 on Commercial Companies, sector regulations, contractual confidentiality obligations, intellectual property rights, professional secrecy duties and, for financial free zones, the applicable Dubai International Financial Centre and Abu Dhabi Global Market data-protection regimes. The UAE Legislation platform identifies itself as the official updated destination for federal legislation, and the Personal Data Protection Law came into force on 2 January 2022. ([uaelegislation.gov.ae])

The central question for UAE business owners, company directors, general counsel, compliance officers, human resources managers, information-technology teams and cybersecurity teams is no longer whether employees are experimenting with artificial intelligence tools. The more serious question is whether the company can prove that such use is controlled, authorised, secure, proportionate, recorded and consistent with the company’s duties towards clients, employees, regulators, shareholders, contracting parties and affected individuals. A prompt entered into an artificial intelligence chatbot may not be legally equivalent to an internal note. Depending on the facts, it may constitute processing, disclosure, transmission, copying, storage, cross-border transfer or communication of information to an external technology provider.

The most dangerous misconception is that entering information into ChatGPT UAE or another public generative artificial intelligence service is merely an internal drafting step. If the prompt includes personal data, employee records, client files, source code, credentials, unpublished financial information, tender strategy, board material, legal advice, patient information, banking information, insurance information or regulated data, the business may have created a legal event without opening a formal data room, executing an outsourcing agreement, performing vendor due diligence, issuing a privacy notice or obtaining client approval. For that reason, an AI chatbot policy should not be treated as a technology convenience document. It should be drafted as a legal-control instrument governing authority, data classification, permitted tools, prohibited inputs, human review, provider due diligence, audit logs, incident reporting and disciplinary consequences.

The focused issue for UAE companies is therefore this: what happens when an employee uploads confidential information into ChatGPT or another public generative artificial intelligence service without clear corporate approval? The answer depends on the nature of the information, the employee’s authority, the employer’s policy, the platform terms, the provider’s retention and training practices, the location of processing, whether personal data or regulated data was involved, whether the business is subject to sector rules, whether contractual confidentiality has been breached, and whether the conduct falls within cybercrime law UAE provisions concerning personal electronic data, confidential workplace information, privacy, electronic records or fraudulent digital activity. A defensible UAE position requires an “approved tools, approved data, approved purposes” model, supported by evidence. A general instruction saying “do not misuse ChatGPT” is not adequate for a serious UAE business handling confidential information.

1. AI Data Privacy UAE: The UAE Legal Framework Behind Generative AI Compliance UAE Obligations

Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, commonly referred to in practice as the UAE Personal Data Protection Law or UAE PDPL, is the principal federal personal-data statute for organisations within its scope. It applies to the processing of all or part of personal data by electronic systems, whether automatic or otherwise, including processing by controllers or processors in the UAE concerning data subjects inside or outside the UAE, and controllers or processors outside the UAE processing personal data of data subjects inside the UAE. The law expressly excludes certain categories, including government data, government entities, personal data held by security and judicial authorities, personal data processed by an individual for personal purposes, personal health data and personal banking and credit data where separate legislation regulates their protection and processing, and companies in free zones that have special personal-data protection legislation. ([uaelegislation.gov.ae])

For generative AI compliance UAE, the legal analysis begins with the concept of processing. In practical terms, a company may be processing personal data when an employee copies a customer complaint into a chatbot, uploads a spreadsheet containing employee details for summarisation, asks an artificial intelligence tool to rank job applicants, sends patient notes for drafting, uses customer transaction information to generate a risk memorandum, or retains prompt logs containing identifiable individuals. The fact that the employee’s purpose is speed, convenience or internal drafting does not remove the personal-data character of the information. Under the UAE PDPL, relevant obligations include fair, transparent and lawful processing; collection for a specific and clear purpose; data minimisation; confidentiality, integrity and availability; appropriate technical and organisational measures; data-subject rights; impact assessment for high-risk modern technologies; and cross-border transfer controls. ([uaelegislation.gov.ae])

The UAE PDPL is particularly important where artificial intelligence is used for automated analysis, profiling or consequential decision support. The law defines profiling by reference to automated processing of personal data to assess personal aspects of a data subject, including financial condition, health, preferences, interests, behaviour, location, movements or reliability. It also grants data subjects rights concerning automated processing decisions, including profiling, particularly where decisions have legal impact or adversely affect the data subject, subject to statutory exceptions. The law further requires a personal-data protection impact assessment before processing where modern technologies would pose a high risk to privacy and confidentiality, and specifically identifies systematic comprehensive assessment using automated processing, including profiling with legal consequences or serious impact, and large-volume sensitive personal-data processing. ([uaelegislation.gov.ae])

Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes is equally important because it is not limited to hacking in the narrow technical sense. Article 6 addresses infringement of personal electronic data and information. It covers acquiring, possessing, modifying, destroying, revealing, leaking, cancelling, deleting, copying, disseminating or re-disseminating personal electronic data or information using information technology or an information technology means without permission. The penalty under Article 6 includes imprisonment for at least 6 months and/or a fine of not less than AED 20,000 and not more than AED 100,000. Data relating to examinations, diagnosis, medication, healthcare, medical records, bank accounts or e-payment information is treated as an aggravating circumstance. ([adgm.com])

Article 45 of Federal Decree-Law No. 34 of 2021 is particularly relevant to employee use of generative artificial intelligence tools because it addresses disclosure of secrets and confidential information obtained at work, because of work, or by virtue of a job, profession, craft or art, using information technology means. Where an employee places confidential information obtained through employment into an unauthorised public artificial intelligence tool, the risk is not merely an internal policy issue. Depending on the facts, the conduct may raise civil, employment, regulatory and criminal issues. This does not mean every mistaken prompt becomes a cybercrime. It means that the legal assessment must examine authorisation, intent, the nature of the information, the method of disclosure, the recipient, the employee’s role and the resulting exposure.

Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services adds another layer where confidential information appears in electronic records, documents or correspondence. Article 42 provides that a person who, by authority granted under that Decree-Law, has access to confidential information of a sensitive nature in electronic records, documents or correspondence and intentionally discloses such information in violation of the Decree-Law is punishable by temporary imprisonment and/or a fine of not less than AED 500,000. Article 42 also addresses non-sensitive confidential information and negligent disclosure, subject to the precise statutory wording and exceptions for disclosure for implementation of the Decree-Law or judicial procedures. ([uaelegislation.gov.ae])

The UAE Charter for the Development and Use of Artificial Intelligence is not a substitute for binding legislation, but it is an important governance benchmark. It identifies responsible and ethical artificial intelligence, privacy, data security, transparency, accountability, human oversight, safety, algorithmic-bias mitigation and compliance with applicable laws and treaties as central principles. For companies operating in the UAE, the Charter supports a practical expectation that artificial intelligence systems should not be deployed without clear responsibility, privacy protection, data-security controls, human oversight and compliance procedures. ([uaelegislation.gov.ae])

2. ChatGPT UAE and Confidential Information: Why a Prompt Can Become a Legal Disclosure

A ChatGPT UAE prompt is not legally neutral merely because it is typed into a screen and returned as draft text. From a compliance perspective, a prompt may transfer information to an external provider, create server logs, generate account metadata, allow processing by affiliates or subprocessors, involve retention under platform terms, or result in processing outside the UAE. A company should therefore treat public generative artificial intelligence services as external recipients unless it has verified, contractually and technically, that the service preserves confidentiality, restricts model-training use, controls retention, limits human access, protects data in transit and at rest, supports deletion, provides auditability and allows incident response.

The highest-risk prompts are often ordinary business requests. Instructions such as “summarise this customer complaint”, “rewrite this termination letter”, “analyse these employee performance notes”, “check this acquisition term sheet”, “draft a response to this regulator”, “review this source code”, “prepare a defence strategy from this litigation file” or “extract payment-risk indicators from these bank statements” may each involve confidential information, personal data, trade secrets, privileged legal material, regulated data or commercially sensitive information. The risk is not only that information may be published publicly. The more immediate legal risk is loss of control over who processes the information, where it is stored, whether it is retained, whether it is used to improve a model, whether it is accessible by human reviewers, whether it can be deleted, and whether the company can prove compliance afterwards.

Under the UAE PDPL, where personal data is included in a prompt, a company must consider the purpose of processing, lawful basis, transparency, data minimisation, security, confidentiality, retention, data-subject rights, processor arrangements and cross-border transfer controls. Under cybercrime law UAE, the issue may become more serious if personal electronic data or confidential workplace information is revealed, leaked, copied or disseminated without permission through information technology means. Under contract law and commercial practice, the same act may breach a non-disclosure agreement, client engagement letter, outsourcing agreement, shareholder arrangement, joint venture agreement, banking confidentiality clause, tender undertaking, procurement condition or settlement agreement.

This is why an AI chatbot policy must use the language of authority rather than convenience. The question should not be limited to whether the tool is useful. The legal questions are: who approved the tool; what data may be entered; what data is prohibited; what legal basis applies to personal-data processing; whether transfer safeguards exist; what vendor terms bind the provider; whether prompts or uploaded files are used for training; how long prompts and outputs are retained; whether audit logs can be retrieved; whether the tool is approved for regulated activity; whether the provider’s subcontractors are known; and who remains accountable for the final work product.

A sound artificial intelligence governance model should classify data before tool selection. Public information may be suitable for low-risk drafting or brainstorming. Internal non-confidential information may be suitable only through approved corporate accounts. Confidential information, personal data, legal advice, regulated information, employee records, health information, financial information, source code and credentials should not be entered into unapproved tools. Where high-risk information must be processed through artificial intelligence, the tool should be an approved enterprise or private environment supported by contract, security assessment, access controls, logging, retention controls, deletion rights and human review.

3. Corporate Liability UAE: Confidential Information, Trade Secrets and UAE Commercial Companies Law

Confidential information in the artificial intelligence context includes far more than documents marked “confidential”. It includes information that is not publicly available and that derives commercial, strategic, legal or professional value from restricted access. In UAE commercial practice, this may include customer lists, price books, margins, contract negotiations, product roadmaps, source code, access credentials, vulnerability reports, supplier terms, litigation strategy, legal advice, board papers, shareholder disputes, unpublished financial statements, employment investigations, medical information, anti-money-laundering alerts, suspicious activity material, insurance claims files, tender submissions and merger discussions.

A company that allows unrestricted employee use of public artificial intelligence tools may weaken its legal position when later alleging that information remained confidential. Confidentiality is not assessed only by the nature of the information. It is also affected by the steps taken to preserve secrecy. If directors, managers and employees routinely upload sensitive documents into uncontrolled external artificial intelligence systems, a counterparty may argue that the company failed to maintain reasonable confidentiality measures. That argument may become relevant in civil claims, injunctive applications, trade-secret disputes, evidence preservation, contractual enforcement and regulatory investigations.

Corporate liability UAE exposure may arise in several ways. First, the company may face contractual claims from clients, customers, suppliers, lenders, shareholders or transaction counterparties. Second, it may face civil claims for breach of confidence, negligence, breach of statutory duty or misuse of personal data. Third, it may face regulatory scrutiny if the information relates to financial services, banking, insurance, healthcare, telecommunications, government projects, professional services, free-zone entities or regulated decision-making. Fourth, the company may face employment disputes if disciplinary action is imposed without a clear policy, proper evidence, proportionality and compliance with labour procedures.

The UAE commercial companies law dimension must be handled with precision. Federal Decree-Law No. 32 of 2021 on Commercial Companies is not an artificial intelligence statute and should not be presented as creating a universal artificial-intelligence duty. However, for companies governed by that law, directors and managers are expected to administer the company’s affairs in accordance with applicable law, constitutional documents, shareholder decisions, duties of care and loyalty, and governance obligations relevant to the legal form of the company. Where a company handles sensitive information, the board’s failure to adopt any artificial-intelligence data controls may become relevant in assessing internal controls, management conduct and governance after a breach or dispute.

Corporate governance should therefore treat generative AI compliance UAE as part of information governance, not merely technology adoption. Boards and senior management should ensure that artificial intelligence use is covered by data-classification rules, acceptable-use policies, procurement controls, cybersecurity controls, employment policies, confidentiality undertakings and incident-response plans. They should also ensure that sensitive functions, including legal, finance, human resources, procurement, information technology, compliance and regulated operations, are not using public tools without legal and security approval.

A further point is that confidential information disclosure through artificial intelligence platforms may be difficult to reverse. Once data has been submitted to an external provider, the company may not know whether the information has been logged, replicated, cached, reviewed, retained, backed up or used to improve services. Even if the provider later deletes data, the company may still need to assess whether a contractual breach, personal-data incident, regulatory issue or client-notification duty has already arisen. This is why prevention, not only incident response, is the core legal control.

4. Employee Use of Generative AI Tools and the Internal Investigation Problem

Employee use of generative AI tools creates a difficult evidential problem. A company may suspect that an employee uploaded confidential information, but the evidence may be dispersed across browser history, endpoint logs, clipboard activity, document-access logs, upload records, artificial intelligence platform records, corporate email, personal devices, messaging applications and cloud-storage systems. If the business has no approved-tool register, no AI chatbot policy, no data-loss-prevention tools, no monitoring notice, no device controls and no data-classification scheme, it may be difficult to establish what was uploaded, when, by whom, to which service, under which account and with what resulting exposure.

A serious investigation should begin by preserving evidence. The company should avoid deleting browser histories, wiping laptops, terminating access without preserving relevant logs where necessary, or making formal accusations before the essential facts are established. Information-technology teams should preserve access logs, upload records, data-loss-prevention alerts, endpoint telemetry, downloads, screenshots, account records and email trails. Human resources should ensure that interviews and disciplinary steps comply with the employment contract, internal policy, due process and the applicable UAE labour framework, including Federal Decree-Law No. 33 of 2021 Concerning Regulating Labour Relations and Cabinet Resolution No. 1 of 2022 Concerning the Executive Regulations of Federal Decree-Law No. 33 of 2021. ([uaelegislation.gov.ae])

The legal character of the employee’s conduct depends heavily on authority. If the employee used an approved enterprise artificial intelligence environment in accordance with policy, the incident may be a vendor, configuration, training or governance issue. If the employee used a personal account after clear written prohibition, the conduct may be a disciplinary matter and, depending on the information and intent, may also raise civil, contractual, regulatory or criminal issues. If managers encouraged the practice, the company’s exposure may be more serious because the conduct may be characterised as operational practice rather than an isolated rogue act. If no policy existed, the employer may struggle to prove that the employee clearly understood that prompt submission was an unauthorised disclosure.

The disciplinary response must be proportionate and evidence-based. Not every accidental upload is misconduct warranting the same sanction. A junior employee who pastes a non-sensitive paragraph into a tool after unclear training is different from a senior manager who uploads customer bank data, litigation files, payroll records, acquisition documents or source code through a personal account after written prohibition. The company should classify the incident, identify affected data, determine whether retrieval or deletion is possible, assess notification obligations, consider whether criminal exposure exists, preserve privilege where legal advice is involved, and document remedial action.

The investigation should also distinguish between input risk and output risk. If an employee uploaded confidential information but no output was circulated, the risk may still be serious because of external processing and loss of control. If the output was circulated internally or externally, the company must also assess whether inaccurate, defamatory, discriminatory, misleading or confidential information was created or distributed. Where personal data is involved, the UAE PDPL requires attention to privacy, confidentiality and security, and to breach notification where the statutory threshold and applicable executive requirements are met.

5. UAE PDPL and Personal Data Protection Risks of AI-Generated Content

AI data privacy UAE compliance is not limited to what employees input into artificial intelligence tools. Output can also create legal risk. A generative artificial intelligence tool may hallucinate allegations about an identifiable person, infer sensitive characteristics, combine fragments into a re-identifiable profile, produce discriminatory recruitment scoring, generate inaccurate employment allegations, misstate medical facts, fabricate financial-risk conclusions, or reproduce personal data that should not appear in the final document. A company cannot defend an unlawful output merely by saying that the artificial intelligence tool produced it. Once an employee adopts, circulates or relies upon the output, the company may become responsible for its use.

Under the UAE PDPL, personal-data processing must be fair, transparent and lawful, connected to a specific and clear purpose, limited to what is necessary, and protected through appropriate technical and organisational measures. The law also requires controllers and processors to adopt measures appropriate to the risk and requires personal-data security measures suitable for the risks related to processing. For high-risk artificial intelligence use, particularly automated profiling, employment evaluation, customer-risk scoring or other consequential decision support, the company should consider whether a personal-data protection impact assessment is required. ([uaelegislation.gov.ae])

High-risk artificial intelligence outputs include recruitment shortlists, employee performance assessments, misconduct summaries, credit recommendations, customer-risk profiles, insurance underwriting notes, healthcare summaries, anti-money-laundering escalation memoranda, disciplinary letters, termination justifications, compliance reports, immigration narratives and litigation chronology documents. Such outputs should not be treated as facts. They require human review by a competent person, source verification, accuracy checking, confidentiality screening and legal approval where the consequence is material.

The company should distinguish between 3 categories of AI-generated content. First, low-risk drafting assistance, such as grammar improvement or rephrasing non-confidential marketing copy, may be permitted through approved tools subject to human review. Second, moderate-risk use, such as summarising genuinely anonymised internal text, may be permitted only where anonymisation is effective and irreversible in the intended context. Third, high-risk use, such as processing employee records, customer files, legal advice, health data, financial data or regulated information, should be prohibited unless a controlled tool, legal assessment, vendor contract and documented approval are in place.

Anonymisation requires special caution. Replacing a name with initials or deleting a heading does not necessarily make information anonymous. If the remaining facts identify the person, or if the data can be linked with other information reasonably available to the company or recipient, the data may remain personal data. The UAE PDPL recognises anonymisation and pseudonymisation as distinct concepts, and companies should not rely on superficial redaction when using artificial intelligence tools. ([uaelegislation.gov.ae])

6. AI Tool Use in Law, Finance, Banking, Insurance, Healthcare, DIFC and ADGM Regulated Businesses

Regulated businesses must not assume that a general corporate AI chatbot policy is sufficient. Banks, insurers, payment businesses, exchange houses, finance companies and other Central Bank of the United Arab Emirates regulated entities may have additional obligations concerning outsourcing, customer confidentiality, operational resilience, consumer protection, regulatory access, governance and information security. Federal Decree-Law No. 6 of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business repealed Federal Decree-Law No. 14 of 2018 and Federal Decree-Law No. 48 of 2023, while preserving current regulations, decisions, standards, guidelines and circulars until replacement instruments are issued. ([uaelegislation.gov.ae])

For banks, the Central Bank Outsourcing Regulation for Banks, Circular No. 14/2021, and its related standards are highly relevant where an artificial intelligence provider processes bank data or confidential data as an outsourced service. The regulation requires banks to maintain an outsourcing register, manage data protection, preserve bank and customer data ownership, secure data against unauthorised access, regulate subcontracting and ensure Central Bank access rights. The Central Bank rulebook also states that outsourcing agreements must protect a bank’s data, include non-disclosure and destruction provisions, restrict third-party access to confidential data, regulate subcontracting, and require breach notification without undue delay. ([rulebook.centralbank.ae])

The Central Bank Outsourcing Standards for Banks also require outsourcing agreements to provide at least the same degree of data protection that would apply if the bank performed the outsourced activity itself, including access-rights management, protection against physical and digital attacks, data integrity, audit trails and measures to detect, react to and recover from data-security incidents. This is directly relevant to artificial intelligence tools used for customer support, complaints handling, fraud monitoring, transaction analysis, credit narratives, compliance drafting, audit summaries or internal investigations. ([rulebook.centralbank.ae])

Healthcare providers face a separate and highly sensitive risk. Federal Law No. 2 of 2019 Concerning the Use of Information and Communication Technology in Health Fields regulates the use of information and communication technology in the healthcare sector in the UAE, including free zones, and aims to ensure the safety and security of health data and information. Cabinet Resolution No. 32 of 2020 Concerning the Executive Regulation of Federal Law No. 2 of 2019 is listed as active on the UAE Legislation platform. The UAE Government portal states that health providers must keep health data and information confidential, refrain from sharing it without due authorisation, ensure validity and credibility, protect it from destruction or unauthorised amendment, alteration, deletion or addition, and ensure availability to authorised parties. ([uaelegislation.gov.ae])

DIFC and ADGM entities must separately assess their own financial-free-zone data-protection regimes. The Dubai International Financial Centre Commissioner of Data Protection supervises and enforces Data Protection Law, DIFC Law No. 5 of 2020, which governs the collection, handling and use of personal data and provides rights and remedies for individuals. The DIFC Data Protection Regulations were amended with Regulation 10, addressing processing of personal data through autonomous and semi-autonomous systems, including artificial intelligence and generative machine-learning technology. ([difc.com])

ADGM entities are subject to the ADGM Data Protection Regulations 2021. ADGM has published guidance on the regulations, including concepts, scope, lawful bases, data-subject rights, controller obligations, data protection by design and default, records of processing, data-protection officers, processor obligations, data-protection impact assessments, breach management and standard contractual clauses for transfers to jurisdictions without adequate protection. ADGM has also published a 2025 update concerning substantial public interest conditions under the Data Protection Regulations 2021, which is relevant to certain special-category data uses. ([adgm.com])

The practical conclusion is clear. A regulated business should not permit employees to use public artificial intelligence tools for customer files, legal files, health data, bank data, insurance data, anti-money-laundering information, supervisory correspondence, suspicious transaction material, prudential information or regulated decision-making unless the tool has passed legal, regulatory, privacy, cybersecurity, outsourcing and procurement review. AI tool use in law, finance and regulated businesses in UAE requires sector-specific controls, not a generic technology policy.

7. Cybercrime Law UAE and AI-Generated Business Documents Legal Liability

AI-generated business documents can create liability even where no confidential information was uploaded. The output may contain false statements, invented citations, incorrect calculations, unsupported legal propositions, misleading consumer claims, defamatory allegations, inaccurate technical instructions, infringing content, fabricated authorities, defective contractual clauses or regulatory misstatements. Human review is therefore not cosmetic. It is the legal control that converts machine-generated draft material into a document for which a person and a company accept responsibility.

For legal documents, every proposition should be verified against current UAE legislation, regulator rules, contractual documents, court procedures and arbitral requirements. For financial documents, calculations, assumptions, disclosures and risk statements should be checked by qualified personnel. For employment documents, the factual basis, fairness, evidence and internal approvals should be reviewed. For marketing documents, consumer-protection, intellectual-property, defamation and advertising risks should be assessed. For technical documents, safety, cybersecurity and accuracy checks are essential.

Companies should retain an audit trail for consequential AI-assisted documents. The record should identify the approved tool used, the general purpose of artificial intelligence assistance, the source material relied upon, the reviewer, the verification steps, the approvals obtained, the final version and the recipient. This is especially important for board papers, regulatory submissions, legal pleadings, tender responses, termination letters, financial statements, customer communications, healthcare documents, insurance decisions and safety materials.

A company should also decide when disclosure of artificial intelligence assistance is necessary. UAE law does not impose a universal obligation to label every AI-assisted document in every business context. However, disclosure may be required by contract, client instruction, professional duties, court rules, regulator expectations, procurement documents, internal policy or the need to avoid misleading the recipient. The appropriate approach is to assess the recipient’s reliance, the purpose of the document, the sensitivity of the subject matter, and whether failure to disclose artificial intelligence assistance would create a misleading impression.

Cybercrime risks from misuse of generative AI in UAE also require express controls. Generative artificial intelligence can increase the scale and credibility of business-email compromise, executive impersonation, phishing messages in Arabic and English, credential-harvesting campaigns, fake invoices, payment diversion, deepfake voice or video, social-engineering attacks, malware development, data-exfiltration schemes and fabricated electronic records. A corporate AI chatbot policy should prohibit the use of artificial intelligence tools to generate phishing, impersonation, malware, unlawful surveillance, fabricated evidence, unauthorised access instructions or any content that facilitates cybercrime or fraud.

8. Company Policies for Using ChatGPT and AI Tools in UAE: The Controls That Actually Matter

A UAE AI chatbot policy should be short enough to be followed and precise enough to be enforced. It should define approved tools, prohibited tools, permitted purposes, prohibited inputs, approval procedures, human review duties, incident reporting, monitoring, sanctions and exceptions. It must be supported by training, technical controls, procurement rules and senior management endorsement. Otherwise, it becomes a document kept in a folder while employees continue to use personal accounts for business work.

The prohibited-input rule should be explicit. Employees must not enter personal data, customer records, employee records, health data, bank data, insurance data, source code, credentials, cybersecurity information, trade secrets, confidential business information, privileged legal advice, litigation strategy, unpublished financial information, tender documents, information received under non-disclosure agreements, regulated information or information subject to localisation or sector restrictions into an unapproved artificial intelligence tool.

The permitted-use rule should be equally precise. Approved artificial intelligence tools may be used for brainstorming, translation, grammar improvement, generic drafting, formatting and summarising non-confidential content, provided that no personal data or confidential information is entered and the final output is reviewed by a responsible employee. Regulated, legal, financial, medical, employment, safety, cybersecurity and customer-impacting outputs should require qualified review and documented approval before use.

Vendor due diligence should be mandatory before any artificial intelligence tool is approved. The legal and information-security review should examine whether the provider uses customer inputs for model training, where data is processed, who the subprocessors are, whether data is encrypted, whether prompts are retained, whether tenant isolation exists, whether logs are available, whether access is restricted, whether deletion is possible, whether breach notification is contractually required, whether audit or assurance reports are available, whether cross-border transfer safeguards are sufficient, and whether the provider accepts enforceable confidentiality obligations.

Incident response should be drafted for the realistic scenario of accidental prompt disclosure. The employee must report the incident immediately, must not attempt to delete evidence silently, and must stop using the tool until instructed. The company should preserve logs, identify the data disclosed, assess whether personal data or regulated information was involved, contact the provider where appropriate, consider deletion or containment, evaluate notification obligations, notify clients or regulators where legally or contractually required, consider employment action, and document remedial controls.

A mature policy should also address monitoring. If the employer intends to monitor corporate devices, network traffic, uploads, browser extensions or artificial intelligence tool access, the monitoring should be consistent with employment documents, privacy notices, internal policies and applicable law. Employees should know that company systems are for authorised business use, that confidential information must not be placed into unapproved tools, and that violations may be investigated.

Practical Risk Matrix for UAE Companies Using ChatGPT and Generative AI

Use Case	UAE Legal Risk	Recommended Position
Brainstorming with public, non-confidential facts	Low	Permit only through approved tools
Rewriting generic internal text	Low to moderate	Permit if no personal data or confidential information is included
Summarising genuinely anonymised contract clauses	Moderate	Permit only after effective anonymisation and human review
Uploading customer contracts	High	Use only a controlled approved environment with contractual safeguards
Uploading employee records	Very high	Prohibit unless legally assessed and specifically approved
Uploading litigation files or legal advice	Very high	Prohibit in public tools; require controlled professional workflow
Uploading bank, insurance or payment data	Very high	Prohibit unless a regulatorily compliant environment is approved
Uploading health data	Very high	Prohibit unless health-sector legal controls are satisfied
Using artificial intelligence for recruitment screening	High	Require impact assessment, transparency, human oversight and bias controls
Using artificial intelligence for credit, insurance or customer-risk decisions	Very high	Require regulated model governance and human accountability
Uploading source code or credentials	High to very high	Use approved enterprise environment only, with cybersecurity review
Generating phishing, impersonation, malware or deepfake content	Prohibited	Treat as a cybersecurity and potential criminal incident

Immediate Implementation Checklist for UAE Directors, General Counsel, Human Resources and Cybersecurity Teams

1. Appoint a responsible artificial intelligence governance owner with legal, privacy, cybersecurity, procurement and business authority.
2. Create an inventory of all artificial intelligence tools, browser extensions, plug-ins, application programming interfaces and personal accounts used for company work.
3. Classify company data into public, internal, confidential, restricted and highly restricted categories.
4. Prohibit the use of public artificial intelligence tools for personal data, confidential information, regulated information, source code, credentials, legal advice and client files.
5. Approve specific artificial intelligence tools only after reviewing provider terms, model-training use, retention, deletion, data location, subprocessors, confidentiality and security.
6. Update employment contracts, confidentiality undertakings, acceptable-use policies, information-security policies and disciplinary procedures.
7. Provide training using UAE-specific examples involving cybercrime law UAE, UAE PDPL, customer data, employee data, health data, banking data and legal privilege.
8. Require human review for all external, regulated, legal, financial, medical, employment or safety-related artificial intelligence output.
9. Implement technical controls, including blocking unapproved tools for restricted data, monitoring uploads, data-loss prevention and access logging.
10. Maintain an artificial intelligence use register for material or regulated applications.
11. Test an incident-response workflow for accidental prompt disclosure.
12. Review the AI chatbot policy at least annually and whenever the tool, provider terms, model configuration, law, regulator position or business use changes.

Official Sources Relied Upon

• Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data.
• Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes.
• Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services.
• Federal Decree-Law No. 33 of 2021 Concerning Regulating Labour Relations.
• Cabinet Resolution No. 1 of 2022 Concerning the Executive Regulations of Federal Decree-Law No. 33 of 2021.
• Federal Decree-Law No. 6 of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business.
• Cabinet Resolution No. 32 of 2020 Concerning the Executive Regulation of Federal Law No. 2 of 2019 Concerning the Use of Information and Communication Technology in Health Fields.
• Central Bank Outsourcing Regulation for Banks, Circular No. 14/2021.
• Central Bank Rulebook, Article 5: Outsourcing Agreements.

Final Legal Position

The safest UAE position is not to ban useful technology blindly, but to govern it with legal precision. Public generative artificial intelligence services should be treated as external recipients unless the company has confirmed, in writing and through technology, that confidentiality, personal-data protection, retention, deletion, security, cross-border transfer, auditability and sector obligations are satisfied. Employees should not place confidential information, personal data, client files, legal advice, financial records, health information, source code, credentials or regulated information into ChatGPT UAE or any generative artificial intelligence service unless the company has approved the exact tool, account, configuration, data category and purpose.

For UAE business owners, directors, general counsel, compliance officers, human resources managers and cybersecurity teams, the defensible model is clear: approved tools, approved data, approved purposes, human accountability and documented evidence. Anything less may convert an ordinary prompt into a breach of confidentiality, a personal-data incident, a contractual default, a regulatory problem or, in serious cases, a cybercrime investigation.

Frequently Asked Questions

Is there a specific ChatGPT law in the UAE?

No. The article explains that generative AI data privacy compliance in UAE is not governed by a single comprehensive “ChatGPT law”. Corporate use must instead be assessed through overlapping regimes including the UAE PDPL, cybercrime law, electronic transactions law, labour law, sector regulations, contractual confidentiality duties and free-zone data-protection rules where applicable.

Can an employee prompt be a legal disclosure?

Yes. A prompt may constitute processing, disclosure, transmission, copying, storage, cross-border transfer or communication of information to an external technology provider, depending on the facts and the platform terms.

What information should not be uploaded to public AI tools?

Employees should not place confidential information, personal data, client files, legal advice, financial records, health information, source code, credentials or regulated information into ChatGPT UAE or any generative artificial intelligence service unless the company has approved the exact tool, account, configuration, data category and purpose.

What is the defensible governance model for UAE companies?

The defensible model is approved tools, approved data, approved purposes, human accountability and documented evidence. This should be supported by policies, vendor due diligence, technical controls, audit logs, training and incident-response procedures.

Should AI-generated business documents be human reviewed?

Yes. Human review is the legal control that converts machine-generated draft material into a document for which a person and a company accept responsibility. Consequential legal, financial, employment, medical, regulatory, safety and customer-impacting outputs require qualified review and documented approval before use.