UAE regulatory calendar
What is in force, what is coming, and what we are watching. Every entry carries its source and verification. Items without a verified date are not listed.
Five pillars: governance, protection, innovation, capacity building and partnership. The national direction every sector regulator now builds on.
Source: UAE Cabinet; World Governments Summit 2025 · Regulator page
DIFC Amendment Law No. 1 of 2025, enacted 8 July 2025, amended Data Protection Law No. 5 of 2020. Two changes reach every controller and processor: the law now covers processing within the DIFC whether or not the entity is incorporated there, and a documented adequacy assessment is required before personal data leaves the DIFC. Review transfer arrangements and the DIFC Commissioner notifications you hold.
Source: DIFC Amendment Law No. 1 of 2025 (difc.com, Annex A); Bird & Bird summary, July 2025; verified 10 September 2026
Consolidated the Central Bank’s financial-sector legislation; licensees should confirm their obligations map to the consolidated text.
Source: Central Bank of the UAE · Regulator page
Certificates on the 2013 edition are no longer valid; surveillance audits now run against the 2022 controls.
Source: ISO / IAF · Regulator page
Board-approved program reviewed annually and 24-hour incident notification for every FSRA-authorised firm in ADGM.
Source: ADGM FSRA · Regulator page
Licensed financial institutions are expected to govern consumer-facing AI and ML under five principles: governance and accountability, fairness, transparency and explainability, human oversight, and data management and privacy. Security by design and privacy by design are named in the text. Our AI governance page maps the expectations to controls.
Source: CBUAE Rulebook, guidance note issued 23 February 2026; verified 3 September 2026 · Regulator page
Every DIFC and ADGM establishment processing personal data renews its registration each year; the date follows your original registration.
Source: DIFC Commissioner of Data Protection; ADGM Office of Data Protection
Not yet issued as of October 2026, with the Data Office not yet fully operational. The law applies now; the detailed procedures follow. This entry updates the month they are published.
Source: Chambers Data Protection 2026 (March 2026); DLA Piper · Regulator page
Article 184 gave every institution and profession under Central Bank supervision one year from entry into force to align licensing, governance and consumer protection arrangements with the consolidated law. Regulations and standards issued under the repealed laws stay in force until replaced (Article 183).
Source: Federal Decree-Law 6 of 2025, Articles 183 and 184; Chambers and Partners article of 19 January 2026; verified 1 October 2026 · Regulator page
Summary for orientation, with attribution to each regulator. The regulators' own publications govern; consult them and your advisers for decisions. Reviewed monthly.
Book a demo
Tell us your sector and we will show you which UAE regulations apply to you, where the gaps are, and how one control set covers them all.
Prefer we come to you? Leave your details below and an engineer replies within one business day.