Table of Contents
You relocated your company to Dubai because of zero corporate tax on qualifying income, since you didn’t have to deal with the Dutch bureaucracy anymore and there was a new market in which to operate. Then someone from your network asks, “Wait, doesn’t the EU AI Act still apply to you?” and at that moment you realise that you aren’t certain.
The short answer is that establishing yourself in DMCC, DIFC, or any other free zone does not immediately place you beyond the scope of EU law. Even if your AI tool reaches EU users, enters EU markets, or involves decisions based in the EU, Brussels will still be able to influence how you develop it, even when you are based in the Burj Khalifa District.
It is not a sufficient cause for panic and by any means not a reason to omit the subject on the grounds that “we’re not in Europe anymore”; it should rather serve to clarify precisely where the boundary lies, so that you can plan your compliance schedule in the same way that you plan your VAT submissions.
Key Takeaways
The EU AI Act, just as the GDPR had done earlier, was based on the concept of “market location”, not on the location of the company. Article 2 specifies who is covered, and one particular clause catches many founders by surprise in that providers and deployers who are established outside the EU are still included if the output of their AI system is used within the Union.
Consider the practical implications of this. For example, suppose your AI startup, which is based in Dubai, develops a recruitment screening tool and a company in Rotterdam uses it to produce a shortlist of candidates. Your servers could be located in Dubai South, your staff could all be based in the UAE, and your company could be a firm in the DMCC free zone with no Dutch shareholders listed on paper. Yet all of that is irrelevant if the output, such as the shortlist, the scores, or the recommendation, ends up in the EU and influences a decision taken in the EU.
There’s an extra complication in the case of a Dutch entrepreneur. Should you still have personal Dutch tax residency, be carrying out your marketing activities using a team based in the Netherlands, or if your company in the UAE is a deployer making use of AI tools that were developed elsewhere and used by staff in the EU, you may end up falling within the scope through more than one of these routes. It is therefore important to regard this as a real dual-compliance issue rather than simply assuming that setting up your company in the UAE has dealt with the problem.
The date on which most people focus is 2 August 2026, and this date is genuine, but it is no longer the full picture. As a result of the Digital Omnibus agreement achieved in May 2026, the European Parliament and the Council extended the compliance deadline for high-risk Annex III systems, such as recruitment tools, credit scoring and AI related to education, from August 2026 to December 2027; the Annex I embedded high-risk products had their deadline extended even further to August 2028.
Article 50 remains in force. The transparency requirements, these being the rules which mandate that you must disclose when someone is interacting with a chatbot, when the content in question is AI-generated, or when a deepfake is involved, will still be in effect on 2 August 2026 as had been originally intended. So long as your company in Dubai operates a customer-facing AI chatbot, produces marketing content using AI, or creates any synthetic media that EU users could come across, this deadline will not be altered.
What this means in practical terms for a Dubai-based company owned by the Dutch is that the deadline which was the most urgent (the high-risk classification) now has some leeway, while the less urgent one (the transparency disclosure) does not. The founders who had assumed that the Omnibus had given them an extra full year in all cases are the ones most at risk of being caught out.
Related Reads:
It is genuinely good news that most of the AI tools developed by early-stage Dubai startups do not come under the high-risk category. The high-risk classification listed in Annex III applies to certain fields such as recruitment and HR decisions, credit and insurance scoring, law enforcement, access to education, critical infrastructure, and a few other areas. So, if your product is a general SaaS analytics tool, a content generation platform, or an internal automation system which doesn’t involve making decisions regarding a person’s access to a job, a loan, or a service, you will probably be in the lower-risk category, which mainly imposes transparency obligations rather than requiring the full conformity assessment.
Even so, “likely” should not be regarded as a compliance strategy. The proper course of action here, and the one that distinguishes a serious operator from someone who hopes that no one notices, is to classify your system rather than to assume. A brief internal audit which answers three questions will get you most of the way there.
If all three answers are truly no, then your obligations will be limited to general ones. Still, if any of the answers are yes, you should have a real conversation with someone who knows both the structure of the UAE and that of the EU before you proceed any further.
As the EU AI Act proceeds with its timeline, the UAE has been establishing its own system of governance at the same time. In January 2026, AI was given an advisory function at the level of the federal Cabinet, marking the first time in the world, and regulatory bodies such as the TRA and the DIFC’s Data Protection Law are now dealing with AI systems that are involved in data-intensive or financial applications. The Dubai South Business Hub has introduced an activity code specifically for Innovation and Artificial Intelligence Research and Consultancies (7020.99), thus providing entrepreneurs with a specific license category rather than the general and vague option of ‘technology consultancy’.
It doesn’t follow that the EU obligations are being replaced. On the other hand, a Dutch founder who is setting up an AI company in Dubai is actually operating under two live and evolving frameworks, rather than one final, fixed framework together with a blank sheet. This point should be taken into account when structuring the company from the very first day, not something that should be addressed only after the client has requested an AI Act compliance statement.
There is no need for a 40-page legal memo before you write a single line of code; all you need is to be clear about three points, that is, whether you are a provider or a deployer under the Act, which of your products (if any) are covered by the Annex III list, and whether your free zone structure and your UAE licence actually correspond to the activities you are carrying out on a day-to-day basis. If your DMCC or DIFC setup is properly arranged, it will allow you to incorporate these considerations cleanly. Still, a general trading licence combined with an AI product is the type of mismatch that causes difficulties later on, both with the UAE authorities and when EU customers request compliance evidence in their contracts.
When you come to the point where you have to decide between different free zones for your AI company, it’s advisable to go through the offerings of both DMCC and DIFC before settling on a structure that will be difficult to change later.
Will the EU AI Act apply in the case where my company in Dubai has no office in the EU at all?
Yes, it might. The Act’s application is determined by the location where the output of your AI system is used, not by the physical location of your company or your team (Modulos, 2026). So long as EU users or decisions based in the EU are affected, the complete absence of an EU presence does not exclude you from the scope of the Act.
What actual deadline should I be keeping an eye on in 2026?
The transparency obligations under Article 50 become enforceable on 2 August 2026, and these cover chatbots, content generated by artificial intelligence, and deepfakes. The high-risk Annex III obligations have been postponed to December 2027 as a result of the Digital Omnibus, so do not confuse the two dates.
Is the amount of the fine actually greater than that under the GDPR?
Yes, it is. For the most serious breaches, those involving prohibited practices, the fine can amount to up to €35 million or 7% of global annual turnover, whereas the GDPR limit is 4%. For other breaches,s the amount is up to €15 million or 3% of turnover.
Will my AI licence for Dubai South (number 7020.99) assist with complying with EU rules?
Not really. Although it properly categorises your business activity for the purpose of obtaining a licence in the UAE, which is important for your local requirements and audits, it has no impact on your status under the EU AI Act. The two regulatory frameworks operate independently.
Should a company go ahead and exclude EU customers in order to avoid the Act completely?
That does represent a real possibility for certain founders. Still, it is a major strategic sacrifice rather than a means of achieving compliance, since it also means cutting off a large potential market. Generally speaking, most Dutch founders prefer to build in compliance from the beginning rather than permanently exclude their home region’s customer base
Where This Fits Into Your Bigger Setup
The way you structure your AI company in Dubai involves more than just obtaining the necessary licensing. It also has an impact on how you deal with the changes to UAE corporate tax, on which free zone you choose to register, and on whether you need dedicated PRO support to ensure that your documentation remains up to date as UAE AI regulations catch up with those of the EU. If you’re still working out the details of setting up your AI company, our comprehensive guide on starting an AI startup in Dubai gives an in-depth look at the formation process, and our PRO services team can assist with keeping the administrative side on track while you concentrate on your product.
None of this needs to be a solo research project. If you want a second opinion on whether your specific AI product and customer base put you inside EU AI Act scope, book a free consultation, and we’ll discuss it together.
Boulevard Plaza, Tower 2 – Office No. 1301, Burj Khalifa – Downtown Dubai, Dubai
Dubai Consultant © All Rights Reserved | Privacy Policy | Powered by InvesQ