AI Use Policy Template for UAE Businesses

A two-page AI use policy you can adapt today: approved tools, data staff must never enter, human review, customer disclosure and reporting — written for UAE law.

Your staff are already using AI. Someone is pasting a client email into a chatbot to draft the reply, someone is summarising a contract with a free tool, someone is asking an assistant to tidy a spreadsheet of customer names and phone numbers. None of it is malicious, and most of it is useful. Almost none of it is covered by a written rule.

This article gives you a ready-to-adapt AI use policy template for UAE businesses: a short document that tells employees which AI tools they may use, what they must never put into them, when a person must check the output, and who to tell when something goes wrong. It is written for small and mid-sized companies that need something practical this month, not a governance programme.

The policy is one piece of a wider picture. For the laws and obligations behind it, see our guide to AI governance in the UAE.

The short answer

A useful AI policy fits on two pages and answers five questions: which tools are approved, what data must never go into them, what needs human review before it is used, what customers must be told, and who to contact. The UAE has no law requiring a company to have one, but the data protection obligations that apply to you do not pause when an employee opens a chatbot — and an unwritten rule cannot be followed, trained or enforced. Adapt the template below, name an owner, and review it every six months.

Why a UAE business needs one now

• Personal data does not stop being personal data in a prompt. Customer names, phone numbers, Emirates ID numbers and salary details pasted into an AI tool are processed under the same data protection rules as anywhere else: the federal Personal Data Protection Law for most companies, or the DIFC or ADGM regimes for firms licensed there.
• Consumer tools and business tools have different terms. Some free and personal AI products may use what you type to improve their models; business versions of the same products usually offer different commitments. Staff rarely check which one they are using.
• Client contracts often already restrict it. Confidentiality and data-location clauses written before AI tools were common can make pasting a client document into an external service a breach.
• The national direction is clear, even if it is not yet law for you. The UAE Charter for the Development and Use of Artificial Intelligence, published in 2024, sets out twelve principles including human oversight, transparency, privacy and accountability. It is not binding on private companies, but it is the standard customers, partners and government-related buyers increasingly expect.
• Health and financial data carry stricter rules. Health information in particular is restricted from leaving the UAE, which rules out many external AI tools entirely for clinics. See AI for clinics and healthcare providers.

A policy does not make any of this go away. It makes it visible, so the decisions are made once, deliberately, instead of every day by whoever happens to be at the keyboard.

How to use the template

1. Replace everything in square brackets with your own details.
2. Fill in the approved-tools list in section 3. If you have not chosen any yet, that is the first decision to make.
3. Check section 4 against what your business actually handles, and add any data your contracts or sector rules restrict.
4. Have it reviewed by whoever advises you on employment and data protection. This template is general guidance, not legal advice.
5. Walk your team through it in fifteen minutes and get a written acknowledgement.

The template

1. Purpose

[Company Name] encourages employees to use artificial intelligence tools where they make work faster or better, provided they are used safely, lawfully and with care for our customers' and colleagues' information. This policy sets out how.

2. Scope

This policy applies to all employees, contractors and interns of [Company Name], on company and personal devices, whenever AI tools are used for company work. "AI tools" means any software that generates or analyses text, images, audio, video or code, including chat assistants, writing tools, transcription and meeting tools, and AI features inside other software.

3. Approved tools

Only the tools listed below may be used for company work, and only through accounts provided or approved by the company:

• [Tool name] — [business account; approved uses, e.g. drafting, summarising internal documents]
• [Tool name] — [approved uses]

Personal or free accounts must not be used for company information. To request a new tool, contact [policy owner]. New tools are approved only once we know where data is processed and stored, whether it is used to train AI models, how long it is kept, and who can access it.

4. Information you must never enter into an AI tool

Unless a specific tool has been approved for that type of data in writing, never enter:

• Personal data about customers, employees or anyone else — including names with contact details, Emirates ID, passport or visa numbers, salary, bank or payment details.
• Health information of any kind.
• Client documents or information covered by a confidentiality agreement or contract.
• Passwords, access keys, system credentials or security details.
• Unpublished financial results, pricing, deals or plans.
• [Source code or technical designs, unless using an approved development tool.]
• [Anything else specific to your business or sector.]

If you are unsure, remove the identifying details or ask [policy owner] first.

5. Checking the output

AI tools can produce confident, plausible and wrong answers. You are responsible for anything you use, send or publish, whether or not AI helped produce it. Before it leaves your hands:

• Check every fact, figure, name, date and reference against a reliable source.
• Read anything going to a customer, partner or authority in full, as if you had written it yourself.
• Have Arabic text reviewed by a fluent speaker before it is sent externally.
• Do not present AI output as legal, financial, medical or other professional advice.

6. Decisions about people

AI tools must not be used to make or decide on hiring, promotion, discipline, pay, credit, eligibility or any similar decision about an individual. They may assist a person who makes the decision, and that person remains accountable for it.

7. Being open with customers

Where customers interact with an AI system on our behalf — for example a chat or WhatsApp assistant — they will be told it is an automated assistant and will be able to reach a person. Employees must not present AI-generated messages as personally written where that would mislead.

8. Intellectual property and publishing

Do not upload material we do not have the right to use. Check AI-generated images, text and code for resemblance to existing work before publishing. Marketing content created with AI follows the same approval process as any other content.

9. Reporting problems

If you entered information that this policy prohibits, received output that looks harmful or seriously wrong, or suspect an AI tool has been misused, tell [policy owner] at [contact] the same day. Reporting quickly matters more than blame; we would rather know.

10. Ownership and review

This policy is owned by [name and role]. It will be reviewed every six months, and whenever we adopt a significant new AI tool or the law changes. Breaches are handled under our normal disciplinary procedures.

11. Acknowledgement

I have read and understood the [Company Name] AI Use Policy and agree to follow it.
Name: ____________ Signature: ____________ Date: ____________

What the template deliberately leaves out

It does not try to be your AI governance framework. A company that builds AI into its own products or processes — an AI agent answering customers, a system processing documents, automated reporting — also needs a record of what each system does, a risk assessment, data protection assessments where personal data is involved, vendor terms, and monitoring. Those are covered in AI governance in the UAE, with the platform side in securing enterprise AI on AWS Bedrock. The staff policy sits alongside that framework, not instead of it.

Adapting it for your situation

• DIFC or ADGM firms: reference your free zone's data protection regulations instead of, or as well as, the federal law, and check transfer rules before approving any tool hosted abroad. See AI automation in Abu Dhabi for the ADGM position.
• Clinics and healthcare: add an explicit ban on entering any patient information into tools not approved for health data, and confirm where approved tools store data.
• Financial services: add your regulator's requirements on outsourcing, records and client communications.
• Operating in Saudi Arabia too: the Kingdom's own data protection law applies to Saudi customers' data. See AI automation in Saudi Arabia.
• Customer-facing AI on WhatsApp: Meta's own terms add conditions on how WhatsApp data may be used with AI. See the 2026 WhatsApp rules.

Making it stick

• Give people an approved option. A policy that only says "no" pushes AI use onto personal phones. Approving one good business tool removes most of the reason to break the rules.
• Fifteen minutes, with examples. Show three real prompts: one fine, one that needs the names removed, one that must never happen.
• One named owner. Someone people can ask without feeling they are confessing.
• Review twice a year. The tools change faster than most policies, and an out-of-date approved list is quietly ignored.

Common mistakes

• Banning AI outright. It moves the use out of sight, which is worse than the use.
• Copying a long policy from abroad. A forty-page document written for another legal system will not be read, and may not fit UAE law.
• No approved-tools list. "Use AI responsibly" gives an employee nothing to act on.
• Forgetting AI features inside existing software — meeting transcription, email assistants and CRM features process the same data.
• Never reviewing it.

How Nexus Labs AI can help

Nexus Labs AI, also known as Nexus Labs UAE, is an AI company in Dubai. When we build AI employees and workflows for clients, the data rules in this policy are designed into the system — where it runs, what it stores, what it may decide and when it hands over to a person — so the company's policy and its AI systems say the same thing. If you are deciding where AI fits before you build anything, our AI consulting in the UAE page explains how we scope a first workflow, and you can talk to us.

Where to Go Next

For the legal framework behind the policy, read AI governance and data privacy in the UAE. For the platform controls, securing enterprise AI on AWS Bedrock. For handling documents that contain personal data, AI document processing in the UAE. For the cost side of moving from personal tools to business ones, what an AI agent costs.

Frequently Asked Questions

Is an AI policy legally required in the UAE?

There is no general UAE law requiring private companies to have an AI use policy. But the data protection obligations that apply to your business still apply when employees use AI tools, and client contracts may restrict where information can go. A written policy is the simplest way to show you take those obligations seriously and to make sure staff know them.

What should an AI use policy include?

At minimum: which AI tools are approved, what information must never be entered into them, when output must be checked by a person, a ban on using AI to decide matters about individuals, how customers are told when they deal with AI, who owns the policy, and how to report problems. Two pages is usually enough.

Can employees use ChatGPT or other public AI tools for work?

That is the company's decision, and the policy should state it. Many businesses approve a business-tier account of one or two tools, with terms they have checked, and prohibit personal or free accounts for company information. Whatever the tool, personal data, client confidential information and credentials should not be entered unless the tool has been approved for that data.

Can we put customer data into AI tools?

Only into a tool that has been approved for that type of data, after checking where it is processed and stored, whether it is used for training, how long it is kept and who can access it. Customer names with contact details, ID numbers and payment information are personal data under UAE law, and health data has additional restrictions.

What is the UAE AI Charter?

The UAE Charter for the Development and Use of Artificial Intelligence, published in 2024, sets out twelve principles for AI in the UAE, including human oversight, safety, avoiding algorithmic bias, data privacy, transparency, and governance and accountability. It is a non-binding policy framework rather than a law, but it reflects what customers and government-related partners increasingly expect.

Does the policy apply to AI features inside software we already use?

It should. Meeting transcription, email writing assistants, CRM features and document tools increasingly include AI that processes the same information as a standalone chatbot. The policy's scope should cover any AI feature used for company work, and the approved list should name them.

How often should an AI policy be reviewed?

Every six months, and whenever the company adopts a significant new AI tool or the law changes. AI products and their terms change quickly, and an approved-tools list that is out of date is quietly ignored.

Is a staff AI policy the same as AI governance?

No. The staff policy governs how employees use AI tools. AI governance is the wider framework for AI systems the company builds or deploys — records, risk and data protection assessments, vendor terms and monitoring. A business using AI in its own operations needs both.