Artificial intelligence is changing how contracts are created, reviewed and managed in the UAE. Businesses now use AI tools to draft agreements, analyse risks, suggest clauses and even handle routine negotiations. These tools save time and reduce costs. But they also create a practical legal question: when the machine produces a wrong clause, misunderstands the parties’ intention or generates an inaccurate output that causes loss, who is responsible?
UAE law does not yet have a dedicated statute that fully answers this question. Instead, liability is determined through existing rules of contract, tort, electronic transactions and data protection. The consistent principle is straightforward i.e. AI has no legal personality. The machine itself cannot be sued. Responsibility falls on the people and companies that design, deploy, supervise or benefit from the system.
The New Civil Transactions Law Changes the Landscape
Federal Decree-Law No. 25 of 2025 (the new Civil Transactions Law), which came into force on 1 June 2026, is now the central civil-law framework. It modernises rules on contractual interpretation, good faith, pre-contractual negotiations and disclosure.
When a contract is unclear, courts can look beyond the written words. They may examine the parties’ true intention, commercial custom, the circumstances at the time the contract was made and the requirement of good faith. This matters greatly for AI-generated contracts. An AI tool may insert an exclusion of liability, an indemnity or a performance standard that does not accurately reflect what the human parties actually agreed. Courts are unlikely to treat the machine’s output as conclusive. They will assess the real commercial deal and the surrounding facts.
Contractual Risk Allocation Remains the First Line of Defence
Because AI-specific legislation is still developing, well-drafted commercial contracts are the most effective way to manage risk. Parties who buy or deploy AI systems should pay close attention to the following points:
- Clear accuracy and performance standards for the AI outputs
- Warranties about the quality of training data and the testing of the model
- Explicit requirements for human oversight and final decision-making
- Audit rights, explainability obligations and notice of material model changes
- Carefully worded indemnities for third-party claims arising from AI errors
- Balanced limitation-of-liability clauses (UAE courts can adjust unfair limitations)
- Allocation of responsibility for hallucinations, bias or cybersecurity failures
- Insurance and incident-reporting requirements
Simply copying standard exclusion or indemnity language is rarely enough. The clauses must fit the commercial value of the contract, the nature of possible losses and each party’s ability to control the risk. An overly broad indemnity or an unqualified exclusion can shift risk in ways the parties never intended.
Tort Liability: Who Answers When Harm Occurs?
Where loss affects third parties or where contractual protection is incomplete, UAE tort principles apply. Liability requires a harmful act, damage and a causal link. Because AI cannot itself be the perpetrator, courts look to the natural or legal persons behind the system the developer, the deployer, the supervisor or the beneficiary.
Article 253 of the new Civil Transactions Law is particularly useful in multi-party AI situations. When several parties share responsibility for the same harm, the court may allocate liability proportionally, equally or jointly and severally. It may also reduce compensation if the injured party contributed to the damage. This provision fits the reality of modern AI supply chains that involve developers, data providers, platform operators and end-users.
Early case law is beginning to appear. In Abu Dhabi Commercial Court Case No. 762 of 2026, a bank was held liable after its automated fraud-detection system failed to identify clear warning signs. The court treated the structural flaw in the risk model as a fundamental error for which the institution remained responsible. The decision confirms that reliance on automation does not remove the duty of care.
Automated Contracts Are Valid – But Responsibility Still Attaches
Federal Decree-Law No. 46 of 2021 on Electronic Transactions already confirms that contracts formed between automated systems are valid and enforceable even without direct human involvement at the moment of formation. This validates machine-to-machine contracting. It does not, however, transfer legal responsibility to the machine. Any error in an automated offer, acceptance or performance still attaches to the human or corporate principal behind the system.
Free-Zone Considerations
Entities operating in the DIFC or ADGM face additional rules. DIFC Regulation 10 specifically addresses personal data processed through autonomous and semi-autonomous systems and places primary accountability on the Deployer. ADGM applies its own data-protection framework, including rights relating to solely automated decisions. Onshore entities remain subject to the federal Personal Data Protection Law and the Civil Transactions Law. Multi-jurisdictional operations therefore require careful mapping of which rules apply to each system and data flow.
Practical Steps Businesses Should Take
Organisations that use AI in contracting or decision-making can reduce exposure by adopting clear internal practices:
- Require meaningful human review for high-stakes contractual decisions
- Keep records of prompts, model versions and the review process applied to AI outputs
- Conduct due diligence on AI vendors regarding testing, bias controls and security
- Align internal AI policies with the good-faith and disclosure expectations of the new Civil Transactions Law
- Consider insurance for AI-related risks, especially in regulated or high-impact sectors
- Ensure that any AI-generated legal content is reviewed by appropriately licensed professionals
Conclusion
Under current UAE law the machine does not take the risk. When an AI system generates an incorrect clause, produces a hallucinated analysis, or causes loss through automated action, responsibility rests with the people and organisations that put the system into operation and failed to exercise adequate control.
The new Civil Transactions Law gives courts stronger tools to interpret intention, allocate multi-party responsibility and enforce good faith. At the same time, carefully drafted commercial contracts remain the most practical instrument for allocating risk in advance.
Businesses that treat AI as a black box or that rely on generic liability wording without specialist review, expose themselves to unnecessary disputes. Those that combine clear contractual architecture, documented human oversight and awareness of the evolving civil-law framework will be better placed to capture the benefits of the technology while containing its risks. As the UAE continues to develop its AI governance framework, further regulatory clarity can be expected. Until then, the foundational principle remains unchanged i.e. the persons and entities that deploy the machine continue to answer for its mistakes.
Contact Details
Email: admin@bankslegal.com
WhatsApp: +971 55 655 2447
