The UAE's regulatory sandbox: Temporary AI License under Law No. 25

Mainstream

The UAE’s regulatory sandbox is not a way to circumvent the law, but a legal mechanism for temporarily bringing innovation to market.

For companies developing AI-based solutions, Law No. 25 of 2018 on Future Projects provides the opportunity to test technologies for which there is no ready-made regulation or existing regulations create disproportionate barriers.

The key question is not “Can I get a temporary exemption?” but “How do I build testing so that in two years I can grow into a full-fledged business with a permanent license or form a new regulation for myself?”

Effective entry into the sandbox begins with three checks:

Which government agency or regulator is authorized to issue a temporary license.Whether there is a well-thought-out exit and commercialization strategy after the test period.

If these issues are not resolved in advance, the company risks getting stuck in a temporary license mode without a clear path to scaling or, conversely, being rejected due to unpreparedness.

When you need a regulatory sandbox of the UAE

The use of the temporary licence mechanism under Law No. 25 becomes necessary if:

• Your product is based on AI technology and does not fit within existing industry licenses
• Regulatory uncertainty blocks pilot launch
• You need to test autonomous systems, medical diagnostics, fintech solution or other AI-service with real users
• A flexible environment for iterations is needed without the risk of immediate sanctions for formal nonconformity.
• You plan to then enter the UAE and MENA market with a scalable product
• A foreign startup wants to test the technology in Dubai without a full commercial registration in the first stage

The mistake most innovative companies make

Many applicants begin with the question:

Where to get a full commercial license for AI-service?

That's the wrong first question.

The right question is:

What legal regime would allow the technology to be legally tested, proven valuable and safe, and then either create new regulations for it or enter the market through adapted licensing?

Sometimes the best result is a regulatory sandbox with an industry regulator. The Dubai Future Foundation is a temporary license. Sometimes it is a parallel track in several free zones. And sometimes, working with the regulator through official “regulatory laboratories” before filing a formal application.

Entering the sandbox requires not a standard licensing approach, but a controlled experiment strategy.

Step 1. Law No. 25 of 2018 “On Future Projects”

Law No. 25 of the Emirate of Dubai creates a legal framework for granting temporary licenses to projects that are recognized as “projects of the future”. Its goal is to allow for the testing and implementation of innovations that are either not covered by existing legislation or create unnecessary restrictions.

Key provisions of the law:

• Temporary license may be issued for up to two years with the possibility of renewal
• Partial or complete exemption from the requirements of the applicable laws and regulations of the emirate is allowed if this is necessary for testing.
• The project should demonstrate a clear innovation component and potential benefits for the economy and society.
• Special conditions for monitoring, reporting and risk management are established
• The license can be revoked if the operator violates the terms, poses a security threat or fails to achieve the stated objectives.

The document does not replace the industry sandboxes in the financial sector (CBUAE, DFSA, ADGM), but complements them, acting as a horizontal tool for any projects of the future, including AI, robotics, autonomous transport, aircraft, biotechnology.

Step 2. Evaluate whether your AI project fits the criteria of the “project of the future”

For qualification, you need to prepare evidence that the project:

• based on advanced technologies (artificial intelligence, machine learning, generative models, etc.)
• The law does not have direct and adequate regulatory coverage in Dubai’s current legislation or the existing regulations make testing impossible.
• has a high potential for influence, whether economic, social or technological
• can be tested in a controlled environment with clear success rates and risk minimization measures
• Complies with national priorities (UAE AI Strategy 2031, Dubai AI Principles, Smart City Concept, etc.)

At this stage, it is important to avoid vague wording like “innovative service”. The application should demonstrate where the technology is outside the scope of the existing regulatory model.

Step 3. Identify an authorized regulator

Law 25 does not create a single window for all projects. The application is usually initiated through the Dubai Future Foundation (DFF) or the industry regulator.

In practice, it might look like this:

• Dubai Health Authority (DHA) and DFF
• Roads and Transport Authority (RTA)
• Knowledge and Human Development Authority (KHDA)
• fintech – Dubai Financial Services Authority (DFSA) in DIFC or FSRA in ADGM, and CBUAE at the federal level
• Dubai Department of Economy and Tourism (DET) and DFF

An error in the identification of the main regulator leads to a delay in the process, so it is advisable to conduct regulatory mapping at the start.

Step 4. Prepare an application

The strong application includes the following components:

• Technical description of the solution and the architecture of AI
• Testing objectives and key performance indicators (KPI)
• parameters of the test environment: Geographic perimeter, number of users, data volumes
• Risk management plan and consumer safety
• measures to protect personal data in accordance with the UAE Federal Data Protection Act (PDPL) and industry requirements
• mechanism for obtaining informed consent of test participants
• Cybersecurity, including Model and Data Protection
• Preliminary plan for exit and commercialization

A well-prepared application not only speeds up the license, but also reduces the likelihood of unfavorable conditions being imposed by the regulator.

Step 5. Agree on the scope of the temporary license

The scope of the license is a key negotiating block. It defines:

• specific laws and regulations from which the operator is exempted
• Extreme testing limits (e.g. maximum 500 users, limited area in Dubai)
• Permissible types of transactions and interaction with consumers
• Financial Limits and Liability Insurance Requirements
• Obligations for monitoring and regular reporting
• pretermination

Trading is appropriate here, but it should be based on objective data on the minimum amount of deregulation necessary to validate hypotheses.

Step 6. Go through the review process

After the application is submitted, the interaction with the regulator begins, which may include:

• clarifying
• presentation and demonstration of the prototype
• Refining the Testing Plan on Demand
• Agreement of conditions with several departments in a cross-sectoral project
• Signing of the Interim License Agreement (Term License Agreement)

The timeframe for consideration varies greatly, but usually takes two to six months. High-quality legal training at the start significantly reduces the number of iterations.

Step 7. Testing of AI solutions within the sandbox

From the moment of the license, the company is obliged to work in accordance with the agreed plan. Key responsibilities at this stage:

• Compliance with the testing perimeter and immediate notification of any incidents to the regulator
• Regular reporting (monthly or quarterly)
• Managing User Complaints
• Maintaining cybersecurity and data protection measures up to date
• storage of logs and evidence base for subsequent analysis

Ignorance of monitoring obligations is one of the main reasons for early withdrawal of temporary licenses.

Step 8. Develop an exit strategy (Exit Strategy)

The sandbox is a temporary tool. Therefore, the exit strategy should be ready before the application is submitted. Possible scenarios:

• transition to a permanent commercial license if the regulator has adapted the rules or adopted a new regulation
• obtaining a standard industry license in the same or related jurisdiction
• Using Results to Launch in Another Country
• winding down the project with the preservation of accumulated data and intellectual property

Having a clear exit plan significantly increases the regulator’s confidence and facilitates negotiations on commercialization.

Step 9. Consider legal liability and limitations

The temporary license does not exempt from liability for real damage, criminal offenses, violation of fundamental principles of law and order and public policy. The operator shall:

• have adequate insurance coverage
• comply with the terms of the license
• immediately respond to regulator’s instructions
• understand that in case of serious infringements, the license may be revoked immediately;

Risks need to be hedged in advance, not learned from them in the process.

Step 10. Use successful testing for commercialization

A successful regulatory sandbox is a powerful signal for investors, partners and customers. It confirms that the technology:

• checked under state supervision
• Safe and consistent with best practices
• It has the potential to scale.

Once the test is completed, the company can negotiate a permanent license from a much stronger position, with data on the actual operation of the solution.

Temporary License or Full Commercial License: pick

The choice does not depend on general preferences, but on the maturity stage of the technology, the readiness of the regulator and the strategic goals of the company in the UAE region.

How to strengthen your position before submitting an application

The best temporary license is laid down at the design stage.

Before contacting the regulator, it is desirable to have:

• working prototype or MVP
• Legal Memo (Legal Memo) on Regulatory Gap
• Testing plan approved by technical experts
• Data Protection Impact Assessment (Algorithmic Impact Assessment)
• Privacy Policy and Terms of Use for Beta Testers
• A clear description of what rules you ask not to apply and why
• rationale

The regulator is more willing to meet those who demonstrate not only technological, but also legal maturity.

Common mistakes when using a regulatory sandbox

1. Perception of sandbox as a permanent license. The sandbox is temporary, and without an exit strategy, the company will be at a dead end.
2. Ignoring data protection requirements. Even in test mode, PDPL and industry privacy regulations apply. Collecting real data without consent is a way to revoke a license.
3. Blurred criteria for success. An application without measurable KPIs does not give the regulator grounds for further legalization of the technology.
4. Wrong choice of regulator. Attempting to obtain a temporary license from a body not responsible for the sector results in the loss of months.
5. Lack of incident management plan. In the realm of AI, incidents are not bugs, but a matter of security and reputation. If the regulator doesn’t learn about the problem from you, trust will be undermined.
6. Launch without liability insurance. The damage from an AI solution failure can be significant.
7. Focus only on technology without legal design. Without understanding what regulations are blocking the launch, negotiations with the regulator are weak.

Checklist for obtaining a temporary license for an AI project

Before starting the process, 14 questions must be answered:

1. What exactly is the innovation and “futurism” of the project?
2. What specific provisions of the current laws make testing impossible?
3. Which government is the main regulator for this area?
4. Is there a working prototype and minimum technical documentation?
5. Is the test perimeter defined (geography, number of users, data types)?
6. Is there a plan to reduce the risk to consumers?
7. Does the data architecture comply with the PDPL?
8. Which KPIs will demonstrate the success or failure of the test?
9. What exit strategy is planned for the day of the license completion?
10. Is there adequate insurance coverage for the pilot?
11. Is the informed consent mechanism ready?
12. Is there a plan to monitor incidents and alert the regulator?
13. Are intellectual property rights and data collected during the testing recorded?
14. How will the pilot’s results be converted into a permanent license application or the formation of a new regulation?

What a strong sandbox strategy looks like

A strong strategy usually consists of five levels:

1. Regulatory Mapping: Identification of applicable rules, gaps and authority authorized to grant a temporary license.

2. Sandbox Application Design Preparation of documents, test plan, risk appetite and negotiating position.

3. Governance & Compliance: Implement internal policies, reporting, data and incident management for the pilot period.

4. Collection and recording of evidence of safety, efficacy and compliance during testing is the basis for a permanent license.

5. Exit & Scale Legal support for transition to commercial license or participation in formation of new regulation.

Without a fifth level, the first four often fail to produce business results.

FAQ

Any legal entity or startup, including foreign companies, is available to whom the project meets the criteria for a “project of the future”. Local partnership or branch registration may be required.

Usually from 2 to 6 months, depending on the complexity, the chosen regulator and the quality of the application.

Yes, but in a strictly controlled environment with informed consent, security measures and limits agreed with the regulator.

Official fees are minimal, but the main costs are the preparation of legal and technical documentation, as well as compliance support during the testing period.

Yes, the law provides for the possibility of renewal if the necessity and a good history of compliance with the conditions are justified.

Does being in the sandbox affect investment? The presence of a regulated pilot in the UAE signals the seriousness of the project and opens the door to state and venture funds in the region.

What happens to the data after the testing is completed?They remain with the company in compliance with the requirements of data protection legislation. Intellectual property rights should be clearly regulated in an agreement with the regulator.

Can I get out of the sandbox early? Yes, according to the terms of the license agreement. However, early exit without a report could complicate future interactions with the regulator.

Related services

• Technology Law and AI Regulation in the UAE
• Regulatory sandboxes and temporary licensing
• Fintech, Digital Assets and Crypto Regulation
• Business registration and commercial licensing in the UAE (mainland, free zones, DIFC, ADGM)
• Data Protection and Cybersecurity Compliance (PDPL, GDPR alignment)
• Venture Capital and support of startups
• Intellectual Property Strategy for AI and DeepTech
• Corporate structuring of innovative companies

Related material

• The regulation of artificial intelligence in the UAE: National strategy and ethical principles
• How to choose between Mainland, DIFC and
• ADGM for tech startup Financial regulatory sandboxes CBUAE, DFSA and FSRA: Differences and Choices Protection of Intellectual Property on AI Algorithms and Datasets in the UAE
• The UAE Federal Data Protection Act: What a developer needs to know: Legal aspects of autonomous transport and robotics in Dubai
• Due diligence of the technology project before applying for a license

Conclusion

Law No. 25 of 2018 “On Future Projects” is not a universal license, but a strategic tool for the targeted removal of regulatory barriers to AI solutions.

Success in the sandbox is not built by someone who just asks for exceptions. Success is achieved by those who understand in advance what norms hinder development, how to prove the safety and value of the technology and how to turn a two-year pilot into a full-fledged business with a permanent license.

A strong position is based on five elements: regulatory mapping, strong application, managed compliance in the pilot, evidence gathering and clear exit strategy. Without them, even the most innovative AI project risks being a beautiful experiment with no commercial future.