I’m Registered in Dubai. Does the EU AI Act Apply to My Company?

Enforcement is handled by national market surveillance authorities in each EU member state (e.g., the BNetzA in Germany, the CNIL or a dedicated AI authority in France). For non-EU companies, enforcement typically proceeds through the EU-authorised representative you are required to designate under Article 22. If you have no representative, EU authorities can take action against any EU-established importer or distributor of your system, and may bar your product from the EU market. The EU AI Act also allows for fines against non-EU providers — up to €30M or 6% of global annual turnover for high-risk violations. Enforcement against purely non-EU entities is a developing area, but the representative designation requirement makes it practically enforceable.

Partially. The UAE PDPL and the EU AI Act both require data governance policies, but they address different things. The PDPL governs personal data processing and transfers — it is a data protection law. The EU AI Act’s data governance requirements (Article 10) specifically cover training, validation, and testing datasets used in high-risk AI systems: data quality, relevance, bias detection, and governance processes. These are AI-specific obligations that go beyond standard data protection compliance. Your PDPL-compliant data policies are a useful starting point, but they will not on their own satisfy Article 10 requirements. DIFC and ADGM companies with GDPR-aligned frameworks are closer to EU AI Act readiness, but still need AI-specific additions.

It changes your exposure profile but not your scope position. The EU AI Act applies to providers placing AI systems on the EU market — which includes B2B sales to EU enterprises. If your B2B client then deploys your AI system to their employees or customers who are EU residents, and your system falls into a high-risk category (e.g., HR screening, credit, healthcare), the full provider obligations still apply to you. What the B2B structure does change is your contractual risk: your enterprise clients will include EU AI Act compliance warranties in their procurement contracts, and failure to comply gives them contractual remedies against you. The AI MSA clause framework addresses how to allocate these obligations correctly between provider and deployer.

For many UAE-registered AI companies with substantial EU revenue, establishing an EU entity (typically in Ireland, the Netherlands, or Germany) is worth considering for three reasons: (1) it removes the need for a separate EU-authorised representative, (2) it simplifies contracting with EU enterprise clients who prefer EU-domiciled counterparties, and (3) it provides a more natural home for EU AI Act compliance obligations. The trade-off is the cost and complexity of maintaining a second legal entity and the tax structuring implications. An EU subsidiary holding the EU-facing AI provider role, with the Dubai entity retaining R&D and UAE operations, is a structure we analyse for clients under our AI jurisdiction structuring service. For smaller companies or those early in EU expansion, an authorised representative is typically the right first step.

The timeline applies to UAE providers exactly as it does to EU providers — there is no grace period for non-EU companies. Prohibited AI practices (e.g., social scoring, real-time biometric surveillance in public spaces) have been unlawful since February 2025. GPAI model obligations applied from August 2025. High-risk AI system obligations under Annex III — the most significant set for enterprise SaaS — apply from August 2026. Transparency obligations (Article 50: disclosing AI interaction to users) apply from August 2026 as well. If you are placing a high-risk AI system on the EU market and have not started your compliance programme, August 2026 is approaching fast. A scoped legal opinion now will identify your exact obligations and timeline.