Cybersecurity regulation in UAE (2026)

The UAE Cybersecurity Council announced it had thwarted a series of AI-augmented cyberattacks targeting the country's digital infrastructure and vital sectors, warning of a 'qualitative shift' in threat methodology by hostile actors. The incident accelerated inter-agency coordination and reinforced the AI-specific defensive mandates embedded in the 2025–2031 national strategy.

The UAE Cabinet approved the National Cybersecurity Strategy 2025–2031, structured around five pillars (governance, protection, innovation, capacity-building, and partnership) and backed by a $2 billion investment mandate; it shifts posture from capacity-building to active defence, expands compliance obligations to supply-chain participants, and integrates AI/ML security as a first-class requirement across all regulated sectors.

The UAE Cybersecurity Council published a comprehensively revised Information Assurance Standard (v2, later v2.1) replacing the decade-old NESA IAS; it introduces 15 security-control families spanning management (M1–M6) and technical (T1–T9) domains, adds post-quantum cryptography, threat intelligence, and secure software engineering requirements, and integrates directly with seven National Cybersecurity Policies including Cloud, IoT, and AI/ML security. Compliance is mandatory for all government bodies and critical-infrastructure operators.

The UAE Cybersecurity Council issued the National Cloud Security Policy, setting mandatory security requirements — covering data residency, access controls, encryption, and third-party vendor assessments — for government entities and critical-sector operators adopting cloud services; the policy forms part of a suite of seven thematic national cybersecurity policies underpinning the Information Assurance Standard framework.

The Cabinet issued Executive Regulations under the 2021 Personal Data Protection Law, mandating concrete technical controls for any organisation processing personal data: AES-256 encryption at rest, TLS 1.2+ in transit, multi-factor authentication, Data Protection Impact Assessments for high-risk processing, and a 72-hour breach notification duty to the UAE Data Office; a six-month grace period applied, with full enforcement expected by January 2027.

On the same date, the UAE enacted two landmark instruments: Decree-Law No. 34 of 2021 overhauled the cybercrime regime (replacing the 2012 law) criminalising hacking, phishing, ransomware, identity theft, and spread of false information, with extra-territorial reach covering crimes planned or directed from the UAE; simultaneously Decree-Law No. 45 of 2021 established the UAE's first federal personal data protection law, requiring security-by-design and incident response obligations; both laws took effect 2 January 2022.

The UAE Cabinet created the UAE Cybersecurity Council as the central national cybersecurity authority, absorbing the functions of NESA; the Council is chaired by the UAE Government's Head of Cyber Security and is mandated to develop national strategy, build a comprehensive legal and regulatory framework, and operate a National Cyber Incident Response Plan — consolidating previously fragmented oversight under a single body.

The UAE launched its first comprehensive National Cybersecurity Strategy, establishing a risk-based framework to protect government systems, critical national infrastructure, and the digital economy across six strategic pillars; it laid the governance and policy foundations that were subsequently operationalised through the creation of the UAE Cybersecurity Council in 2020.

The UAE enacted Federal Decree-Law No. 5 of 2012, replacing the 2006 law with significantly expanded coverage: it removed intent as a prerequisite for many offences, increased criminal penalties, added new categories of cybercrime (including attacks on critical infrastructure and electronic systems), and was published in full by TDRA as the operative cybercrime statute until superseded in 2022.

The UAE enacted Federal Law No. 2 of 2006 on the Prevention of Information Technology Crimes, making the UAE the first Arab country to pass a standalone cybercrime statute; the 27-article law criminalised unauthorised system access, data interception, electronic fraud, and misuse of information technology, establishing the foundational legal framework for prosecuting digital offences that all subsequent legislation has built upon.