Retail is the sector where AI arrived first and where nobody wrote a rule about it.
There is no retail AI regulator in the UAE. There is no retail equivalent of the Central Bank guidance note or the Abu Dhabi health standard. A retailer reading the market could reasonably conclude that this is a free space.
It is not a free space. It is a space governed by two general laws that happen to land hard on exactly the systems retail uses most.
The first law is about the customer's data
Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, has applied since January 2022 to personal data of UAE residents outside the financial free zones.
Article 18 is the one that matters in retail. A person may object to a decision produced by automated processing where that decision has legal consequences or seriously affects them, subject to exceptions where the processing is contractual, legally required, or consented to in advance.
Article 21 requires a data protection impact assessment before processing that uses modern technologies and poses a high risk to privacy, or that involves large volumes of sensitive data.
A loyalty programme with two million members, a recommendation engine trained on their purchase history, and a fraud model that declines transactions is a high-volume automated processing operation with consequences for individuals. The assessment is not optional and the objection route has to exist somewhere a customer can find it.
The second law is about the transaction
Federal Law No. 15 of 2020 on Consumer Protection was given Executive Regulations by Cabinet Decision No. 66 of 2023, in force since October 2023. The Regulations extended the consumer protection regime expressly to e-commerce and adopted a broad definition of consumer transactions that captures digital and online activity.
They require prices for goods and services to be labelled and advertised legibly. They require the supplier to give the consumer an invoice evidencing the transaction, without the consumer bearing any further burden. They curb increasing the price of a good when a credit card is used. They set out a detailed mechanism for handling consumer complaints, with heavy sanctions on suppliers.
Read that list next to a modern retail stack and three systems light up.
Dynamic pricing, because a price that changes per person is harder to advertise legibly than a price that does not. Automated checkout decisions, because a declined transaction needs a complaint route that a human answers. And any surcharge logic, because the Regulations already took a view on payment-method pricing.
Where retail AI actually sits in this market
The register in a UAE retail group usually turns up the same eight systems.
Demand forecasting and replenishment. Pricing and promotion optimisation. Recommendation and search ranking on the storefront. Fraud and chargeback scoring. Customer service assistants, which in this market means Arabic and English at minimum and frequently Hindi, Urdu and Tagalog in practice. Buy-now-pay-later or instalment decisioning, which is usually a partner's model. Workforce scheduling. And CV screening inside the applicant tracking system, which nobody thinks of as retail AI until someone asks about it.
Only three of those decide anything about a named person. Those three carry the assessment burden. The other five carry commercial risk and almost no regulatory risk, which is a useful distinction to draw early, because it tells the board where the governance spend goes.
The market the systems are being built for
Mordor Intelligence puts the UAE e-commerce market at 12.30 billion US dollars in 2026, rising to 21.01 billion by 2031 at 11.29% compound annual growth. It puts mobile commerce at 78.67% of 2025 transactions and cross-border purchases at 58% of online buying.
Those are one research house's numbers, produced on its own methodology, and they are not a government statistic. They are quoted here with that label because in this category the numbers usually arrive without one.
Two of the three tell a retailer something operational. A market where most transactions are on a phone punishes a recommendation system that assumes a desktop grid. A market where most purchases cross a border makes returns, duty and delivery-time prediction the highest-value forecasting problem in the business, ahead of the one every vendor demonstrates.
The Arabic problem, stated plainly
Most retail AI vendors demonstrate in English. Most UAE retail customer bases are not English-first.
A customer service assistant that handles English well and Arabic poorly is not a partial success. It is a system that gives worse service to the customers a UAE regulator and a UAE board are most sensitive about. The Central Bank made bilingual disclosure explicit for financial institutions in February 2026, and retail should read that as the direction of travel rather than as somebody else's rule.
Test in Arabic before the contract is signed, not after the rollout.
What the seat holds in retail
One register of the eight systems, with the vendor named against each and the oversight mode recorded. Assessments on the three that decide. A complaint route that a person answers, tied into the mechanism the Consumer Protection Regulations already require. A staff policy about what goes into which tool, which in retail has to be written for store managers rather than for head office. And one production use case with a number the finance team already reports, which in retail is almost always markdown, shrinkage or delivery cost.
That is a two or three day a week job in a chain of any size, and it is not a job the e-commerce director can absorb, because the register covers the e-commerce director's own vendors.
Nothing on this page is legal advice. Confirm the consumer protection and data positions with counsel.
Where to go next
For every rule in one place, read the map of UAE AI regulation. For the order of work, read AI transformation in the UAE.
If you have run retail AI at scale in this region, claim a page. If your board has asked who owns it, read the register.