Civil Law, Artificial Intelligence and Digital Economy: Civil Liability in the UAE

1. Introduction

Civil liability in the United Arab Emirates (UAE) concerns the legal responsibility of individuals, companies, technology providers, digital platforms and other entities to compensate persons who suffer harm because of a wrongful act, breach of contract, negligence or other legally recognised ground.

The growth of artificial intelligence (AI) and the digital economy has created new types of civil disputes involving:

AI-generated financial advice, automated decisions and algorithmic errors.

Digital payment systems, electronic contracts and online marketplaces.

Data breaches, privacy violations and unauthorised use of personal information.

Defective AI software, autonomous systems and cybersecurity failures.

Smart contracts, blockchain transactions and digital assets.

Online advertising, misleading algorithmic recommendations and platform liability.

Losses suffered by consumers, businesses, investors and employees through automated systems.

The UAE's legal framework addresses these problems through general civil liability principles, contractual obligations, consumer protection, electronic transactions, data protection, cybercrime legislation and financial-sector regulation.

Central legal principle: The use of AI does not automatically eliminate the civil responsibility of the person or organisation that develops, supplies, deploys or relies on it. Liability depends on the applicable law, the parties' obligations, the nature of the wrongful conduct, causation and the damage proved.

This explanation focuses on UAE law, including the distinction between federal law, the laws of individual emirates and the separate legal frameworks applicable in financial free zones such as the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM).

Legal note: The cases discussed below are relevant judicial authorities on civil liability, electronic transactions, privacy, technology, contracts and related principles. They should not be understood as six UAE judgments specifically deciding AI-liability disputes; that would overstate the available precedent. The distinction between directly applicable UAE law and persuasive foreign authorities is important.

2. Legal framework governing AI and digital-economy civil liability in the UAE

The first step in a civil liability dispute is to identify the law governing the transaction and the court with jurisdiction.

A. Federal civil liability law

The UAE's Civil Transactions Law provides the general foundation for civil obligations, contractual liability, compensation and liability for harmful acts.

A significant legislative development is the new Civil Transactions Law promulgated in 2025 for commencement in 2026. Because the relevant date and transitional provisions matter, a claim arising before its effective date may require analysis under the earlier Civil Transactions Law, Federal Law No. 5 of 1985, as amended. The applicable text and commencement provisions should be verified for each dispute.

UAE Legislation

+1

The principal questions in an AI-related civil claim are:

Was there a legal duty or contractual obligation?

Did the defendant breach that duty or obligation?

Did the breach cause actual loss or legally recognised harm?

Is the loss sufficiently connected to the wrongful conduct?

What compensation or other remedy is available under the applicable law?

For example, if a company deploys an AI credit-scoring system that negligently processes customer information and causes a financial loss, a claimant may investigate negligence, contractual obligations, data-protection requirements and the company's control over the system.

B. Electronic transactions and digital contracts

Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services provides a framework for electronic transactions, electronic documents, signatures and trust services.

Digital contracts may be enforceable even when concluded electronically. However, the use of electronic technology does not automatically prove that a contract exists, that the correct person authorised it, or that every contractual term is enforceable.

Potential disputes include:

Whether an AI chatbot made a binding contractual offer.

Whether an automated acceptance formed a contract.

Whether a digital signature was authentic.

Whether a platform changed its terms without adequate notice.

Whether a smart contract executed the parties' actual agreement.

Whether a system error invalidated or breached a transaction.

The legal analysis should distinguish the electronic form of a transaction from the substantive rules governing consent, authority, contractual interpretation, breach and remedies.

C. Personal data and privacy

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data establishes a federal framework for personal-data processing, subject to its scope, exclusions and applicable special regimes.

AI systems may process customer profiles, biometric information, employment records, financial histories and behavioural data. Civil disputes can arise where an organisation processes data without a lawful basis, fails to meet applicable obligations, or exposes information through inadequate security.

The claimant should establish which data-protection regime applies, whether the defendant breached a relevant obligation, and whether compensation is available on the facts under the governing legal framework.

It is also important not to assume that every entity in every UAE jurisdiction is governed identically. The DIFC has its own data-protection legislation, and ADGM has a separate data-protection framework.

D. Consumer protection and digital commerce

Federal consumer-protection legislation, including Federal Law No. 15 of 2020 on Consumer Protection and its implementing rules, may be relevant to online purchases, digital services, misleading representations and defective products or services.

Examples include:

An e-commerce platform displaying materially misleading AI-generated product descriptions.

A chatbot providing incorrect information about a refund or warranty.

An automated subscription system continuing to charge a customer after cancellation.

A digital service failing to provide the functionality promised in its contract.

A business concealing material limitations of an AI-enabled product.

Whether a particular consumer remedy applies depends on the relevant statute, the parties' status, the nature of the product or service, and any applicable exclusions.

E. Cybersecurity and digital wrongdoing

Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes may be relevant to unlawful digital conduct. However, criminal liability and civil liability are distinct: a criminal offence does not automatically establish every element of a civil damages claim, and a civil claim may be available even where no criminal conviction has been obtained.

F. DIFC and ADGM legal regimes

The DIFC and ADGM are financial free zones with their own legal frameworks and courts. Their judgments should not automatically be treated as binding on courts applying mainland UAE law.

The DIFC Courts operate within a common-law-oriented legal framework, while ADGM applies English common law to the extent provided by its legislation. The applicable jurisdiction may substantially affect the rules of contract, tort, evidence, procedure and precedent.

Global law firm

+2

3. How civil liability arises in AI and the digital economy

1. Liability of AI developers

Developers may face claims where negligent design, inadequate testing, misleading documentation, or a contractual defect causes foreseeable harm. The claim depends on the applicable duty, the developer's conduct and the causal link to the loss.

2. Liability of businesses deploying AI

A bank, insurer, employer or retailer may be responsible for its own decisions, supervision failures or contractual breaches even if a third-party AI supplier created the software.

3. Platform and e-commerce liability

Disputes may concern misleading listings, payment errors, defective services, unauthorised account activity, refund obligations or failures to implement promised safeguards.

4. Data and privacy liability

A company may face legal exposure for unlawful processing, disclosure or security failures, subject to the applicable data-protection regime and the legal requirements for the remedy sought.

5. Blockchain and smart-contract disputes

A dispute may concern a coding defect, unauthorised transfer, failure to execute agreed conditions, mistaken transaction or a mismatch between coded instructions and the underlying contract.

An AI system is not, merely by being autonomous, a substitute for an identifiable legal person who can be held liable. Responsibility generally must be assessed by examining the conduct and legal obligations of the relevant developer, operator, service provider, contracting party or other responsible person.

Chambers and Partners

+1

4. At least six relevant case laws

The following cases illustrate how courts approach AI-assisted work, digital assets, contractual responsibility, privacy and technology-related disputes. The most important distinction is between direct UAE-related decisions and comparative foreign authorities. The latter may provide analytical guidance but are not automatically binding in the UAE.

Case 1. Arabyads Holding Limited v Gulrez Alam Marghoob Alam — ADGM

Citation: [2025] ADGMCFI 0032

Facts and issue: The proceedings involved legal submissions containing authorities that did not exist or were incorrectly cited and that bore the hallmarks of AI-generated hallucinations.

Decision and significance: The ADGM Court imposed wasted costs of AED 282,508 on the relevant legal representatives in connection with the defective litigation work. The case illustrates the importance of professional verification and procedural responsibility when AI-generated material is used in court.

Oxford Institute of Technology and Justice

+1

Relevance to civil liability in the digital economy:

AI-assisted work must be checked before it is relied upon.

A professional cannot simply transfer responsibility to an AI provider.

Negligent verification may result in adverse costs consequences.

Businesses using AI in regulated professional services should maintain review and approval procedures.

Legal lesson: AI can be a tool, but its use does not eliminate the legal obligations of the human professional or organisation relying on its output.

Case 2. Klesta Eshja and Hair Creators Salon LLC v Salah Masri and Others — DIFC

Case number: CFI 066/2024

Facts and issue: The litigation involved amended pleadings in a commercial dispute. The DIFC Court's orders addressed amendments to defences, wasted costs and applications seeking to strike out pleadings. The proceedings have also been identified in legal commentary as involving AI-assisted pleadings and problematic legal references.

DIFC Courts

+2

Legal significance: The case illustrates that AI-generated legal documents remain subject to ordinary procedural standards. A party cannot assume that computer-generated submissions will be accepted merely because they are produced quickly or appear authoritative.

Application to digital-economy disputes:

Suppose a company uses an AI system to prepare a defence to a claim concerning an online marketplace. If the defence contains fabricated contractual clauses, inaccurate legal propositions or unsupported factual assertions, the company and its lawyers remain responsible for the documents they submit.

Legal lesson: AI use does not excuse compliance with procedural rules, accurate pleading and professional obligations.

Case 3. Techteryx Ltd v Aria Commodities DMCC and Others — DIFC Digital Economy Court

Citation: [2025] DIFC DEC 001

Facts and issue: The dispute concerned funds associated with reserves backing TrueUSD, a US-dollar-denominated stablecoin. Techteryx alleged that approximately USD 456 million transferred to Aria Commodities DMCC had been misappropriated or improperly dealt with. The DIFC proceedings included applications for proprietary relief and a worldwide freezing injunction in support of related Hong Kong proceedings.

DIFC Courts

+2

Decision: In its 2025 amended judgment, the court continued proprietary and freezing injunctions pending further order. The proceedings concerned preservation of assets and alleged wrongdoing; the injunctions should not be misrepresented as a final determination of every allegation.

Legal significance:

Digital-asset disputes can involve conventional principles of property, tracing, trusts and fraud.

A claimant may seek urgent court protection to prevent assets from being dissipated.

The involvement of cryptocurrency or a stablecoin does not automatically remove a dispute from ordinary civil remedies.

Banks, custodians, intermediaries and asset holders may have different legal roles, and liability must be assessed individually.

Legal lesson: Digital assets can generate substantial civil disputes, and traditional remedies may be relevant even when the underlying transaction uses blockchain-related technology.

Case 4. AC Network Holding Ltd v Polymath Ekar SPV1 — ADGM Court of Appeal

Citation: [2023] ADGMCA 0002

Facts and issue: This case concerned the operation of precedent in the ADGM legal system and the relationship between ADGM law and English common law.

Decision and significance: The ADGM Court of Appeal confirmed the importance of the doctrine of precedent as part of the English common law framework applicable in the ADGM.

Chambers and Partners

+1

Relevance to AI and the digital economy:

Parties must identify the correct jurisdiction before relying on judicial authorities.

English common-law decisions may have a different status in ADGM from their status in mainland UAE courts.

A legal argument involving AI-generated evidence, automated contracting or digital-asset ownership must be assessed under the governing legal regime.

Legal lesson: Jurisdiction is not a technical afterthought. It can determine which rules and precedents govern a digital-economy dispute.

Case 5. Lloyd v Google LLC — United Kingdom Supreme Court

Citation: [2021] UKSC 50

Facts and issue: The claimant sought to bring a representative action against Google over alleged unlawful collection and use of iPhone users' browser information.

Decision: The UK Supreme Court rejected the proposed representative claim in the form advanced because the claimant had not established the same kind of compensable damage for each member merely through the alleged loss of control over personal data. The judgment did not establish that every data-protection claim requires financial loss, nor did it eliminate other available routes to compensation.

Relevance to UAE digital-economy liability:

The case offers a useful comparative analysis of the distinction between:

An alleged breach of data-protection duties.

Proof that the claimant suffered legally compensable damage.

The suitability of representative or collective proceedings.

The evidence needed to establish the loss suffered by individual claimants.

For example, if an AI advertising platform unlawfully processes information belonging to thousands of users, the nature of the alleged violation and the remedy sought must be distinguished from the question of whether each claimant has proved an entitlement to damages.

Legal lesson: A data-processing violation and an entitlement to a particular damages award are related but distinct questions.

Status in the UAE: This is a foreign authority, not binding UAE precedent. Its relevance is comparative and depends on the governing UAE or free-zone law.

Case 6. Google Spain SL v Agencia Española de Protección de Datos — Court of Justice of the European Union

Citation: Case C-131/12, EU:C:2014:317

Facts and issue: The dispute concerned search-engine results linking an individual's name to older newspaper information about financial difficulties and property proceedings.

Decision: The Court of Justice recognised that, under the applicable EU data-protection framework, a search-engine operator could be required in certain circumstances to remove links from results displayed following a search for a person's name.

Relevance to AI and digital-economy civil claims:

Search engines and AI systems can affect reputation and privacy by collecting, ranking and presenting information.

Automated dissemination of personal information may raise questions about lawful processing and the rights of affected individuals.

The legality of retaining or displaying information depends on applicable law and the balance between competing rights and interests.

For instance, an AI search assistant that repeatedly surfaces outdated personal information may raise privacy or reputational concerns. Whether that conduct creates liability in the UAE would require a separate assessment under UAE law, including the applicable data-protection regime.

Legal lesson: Technology companies may have legal obligations concerning personal information even when they do not create the original information themselves.

Status in the UAE: This is a comparative European authority, not binding UAE precedent.

Case 7. Donoghue v Stevenson — House of Lords

Citation: [1932] AC 562

Facts and issue: A consumer alleged illness after drinking ginger beer that contained a decomposed snail. The product had been purchased by a friend, so the consumer did not have a direct contract with the manufacturer.

Decision: The House of Lords recognised a duty of care owed by a manufacturer to the ultimate consumer in the circumstances of the case.

Relevance to AI products and digital services:

The decision provides a foundational comparative principle for examining negligence where a person suffers foreseeable harm from a product or service, even without a direct contract with the responsible party.

Consider a company that supplies an AI-powered industrial robot. A software defect causes the robot to malfunction and injure an employee of the purchasing business. Depending on the applicable UAE law and the facts, the injured person might investigate negligence, product-related liability, contractual duties and the responsibility of the operator.

However, Donoghue v Stevenson does not itself establish the UAE's rules for AI products or replace the applicable statutory requirements.

Legal lesson: The absence of a direct contract does not necessarily end a negligence inquiry. The relevant duty, breach, causation and legally recognised damage must still be established.

5. Comparison of the seven cases

The first four are UAE-related authorities, although Techteryx is principally a digital-asset case and AC Network Holding concerns precedent rather than AI liability directly. The last three are comparative authorities. They help explain legal principles but should not be presented as binding UAE judgments.

6. Hypothetical UAE civil liability disputes

Scenario A: AI credit-scoring error

A UAE bank uses an AI model to evaluate loan applications. A software defect incorrectly identifies a customer as a high-risk borrower, causing the bank to reject a loan and allegedly damaging the customer's business.

Potential issues include:

Whether the bank breached a contractual, regulatory or other applicable legal duty.

Whether the model's data were inaccurate.

Whether the bank had appropriate oversight and review procedures.

Whether the customer can prove actual compensable loss.

Whether the software provider also bears responsibility under its contract or another applicable legal rule.

Possible outcome: If the customer establishes an actionable breach, causation and recoverable loss, compensation or another appropriate remedy may be available. The incorrect decision alone does not automatically establish liability.

Scenario B: AI chatbot misrepresents an online purchase

An e-commerce platform's chatbot assures a consumer that an expensive electronic product has a particular warranty. The seller later refuses to honour the warranty.

The dispute may turn on whether the chatbot's representation can legally be attributed to the business, whether the statement formed part of the contract, what the consumer was reasonably told, and whether consumer-protection or contractual remedies apply.

Relevant evidence includes the conversation transcript, the platform's terms, product descriptions, payment records and the seller's warranty documentation.

Scenario C: Blockchain transaction and missing digital assets

A company transfers substantial funds to an intermediary under an arrangement connected with a stablecoin. The funds are subsequently transferred through multiple accounts, and the claimant alleges that the intermediary acted without authority.

The legal questions may include:

Who beneficially owned the assets?

Was the transfer authorised?

Can the assets or their proceeds be traced?

Did any party commit fraud or breach a contractual or fiduciary duty?

Are proprietary relief, freezing injunctions, restitution or damages available?

The Techteryx proceedings demonstrate the practical importance of asset-preservation remedies in disputes involving stablecoin reserves.

Scenario D: AI data breach

A technology provider uses customer information to train or operate an AI system. A configuration error exposes personal information to unauthorised parties.

The affected persons or organisations may investigate data-protection obligations, contractual security commitments, negligence and any applicable regulatory remedies.

The claimant would need to identify the relevant legal duties, establish the breach and demonstrate the basis for the particular remedy claimed. The precise requirements depend on the applicable data-protection regime.

7. Evidence required in AI and digital-economy civil litigation

AI disputes can be difficult because the relevant evidence may be held by a software developer, cloud provider, bank or platform rather than the claimant.

Important evidence may include:

Contractual evidence

Signed agreements, electronic acceptance records, service-level agreements, software licences, warranties, disclaimers and limitation-of-liability clauses.

Technical evidence

System logs, model versions, input and output records, audit trails, transaction identifiers, security reports and records of human intervention.

Compliance evidence

Data-processing records, security policies, risk assessments, incident reports, internal approvals and records of compliance with applicable legal requirements.

Loss and causation evidence

Financial statements, invoices, expert reports, evidence of lost business, remediation expenses and analysis connecting the alleged breach to the claimed loss.

Federal Decree-Law No. 35 of 2022 on Evidence in Civil and Commercial Transactions is relevant to evidentiary questions in the federal civil and commercial court system. Electronic evidence must be assessed under the applicable evidentiary rules, including authenticity, integrity, attribution and the circumstances in which it was generated or stored.

Ministry of Justice, UAE

+1

A party should preserve relevant records lawfully and promptly. The absence of a complete technical explanation does not automatically establish liability, but a well-documented audit trail can be important in determining what happened and who was responsible.

8. Remedies for civil liability in the UAE

Depending on the applicable law and the facts, a claimant may seek one or more of the following:

Compensation: For proven, legally recoverable damage caused by the defendant's actionable conduct.

Contractual remedies: Such as performance, termination, repayment or damages where the governing contract and law permit them.

Restitution or recovery of assets: Where the legal requirements for repayment, recovery or tracing are met.

Injunctions: To prevent threatened harm, restrain dealings with assets or preserve the subject matter of proceedings where the relevant legal test is satisfied.

Data-protection remedies: Through the procedures and remedies available under the applicable data-protection framework.

Procedural costs: Where the court makes an appropriate costs order.

The remedies are not interchangeable. For example, an injunction preserving assets is not necessarily a final judgment that the defendant owes the claimant the entire amount claimed.

9. Defences and limitations

A defendant may argue that:

No relevant duty or contractual obligation was breached.

The alleged loss was caused by an independent event or the claimant's own conduct.

The claimant cannot prove the existence or amount of recoverable damage.

The claimant accepted relevant contractual terms, subject to their validity and enforceability.

The developer supplied the system in accordance with its contractual obligations, while the deployer used it outside its intended conditions.

The claimant has proceeded in the wrong forum or under the wrong legal regime.

A limitation period or other procedural requirement prevents or restricts the claim.

These arguments must be assessed individually. Contractual disclaimers and limitations of liability are not automatically enforceable in every situation, particularly where mandatory statutory rules apply.

10. Practical compliance measures for UAE businesses

Businesses operating AI-driven services can reduce legal exposure by implementing the following safeguards:

Contract management: Specify the roles of the developer, supplier, operator and customer, together with warranties, security obligations, incident reporting and liability allocation.

Human oversight: Require appropriate review of consequential automated decisions, particularly in financial, employment and other sensitive settings.

Data governance: Identify the applicable data-protection regime, lawful processing grounds, retention requirements and security controls.

Auditability: Preserve reliable records of important automated decisions and digital transactions.

Testing and monitoring: Assess system accuracy, cybersecurity, foreseeable failure modes and material changes after deployment.

Incident response: Establish procedures for notifying affected parties and relevant authorities when required by law.

Dispute readiness: Maintain records that can establish the contractual position, the sequence of events and the actual financial impact of an incident.

These measures do not guarantee immunity from litigation. They can, however, help demonstrate responsible governance and assist in determining the cause of a dispute.

Conclusion

Civil liability in the UAE's AI-driven digital economy rests on the interaction of ordinary civil obligations, contractual law, electronic transactions, data protection, consumer protection and jurisdiction-specific rules.

The seven cases discussed above illustrate different aspects of that framework. Arabyads Holding and Klesta Eshja demonstrate the importance of human verification of AI-assisted legal work. Techteryx illustrates the use of conventional civil remedies in a substantial digital-asset dispute. AC Network Holding highlights the significance of identifying the governing legal system. The comparative decisions in Lloyd v Google, Google Spain and Donoghue v Stevenson offer additional analytical perspectives on data protection and negligence.

The key principle is accountability: AI may perform tasks autonomously, but civil liability must still be assessed by identifying the relevant legal person, duty, breach, causation and legally recoverable harm.

For an actual dispute, the most important preliminary questions are which emirate or free-zone court has jurisdiction, which version of the law applies, what contractual and statutory duties govern the parties, and what evidence establishes the alleged loss. This is a general educational explanation, not a substitute for advice on a specific UAE claim.