Artificial Intelligence In UAE Business Contracts: Who Bears The Legal Risk When Automated Decisions Go Wrong?-

Artificial intelligence (AI) tools are increasingly being used by businesses in the UAE to prepare and review contracts, assess commercial terms, generate quotations, evaluate risks and communicate with customers and counterparties. Tasks once performed by employees or external consultants are now, at least in part, handled by automated systems. Although these tools promise greater speed, consistency and cost efficiency, their use does not alter the basic legal principles governing contractual obligations.

 

An AI system is not itself a party to a contract, has no independent legal personality under UAE law and cannot assume responsibility in its own name for a clause, recommendation or decision it generates. The legal consequences of its use must instead be assessed by reference to the conduct and obligations of the individuals and entities involved. This article examines the legal position of AI-assisted contracting in the UAE, the applicable legal and regulatory framework, and the risks businesses should address before relying on automated systems in commercial transactions.

 

What Is AI-Assisted Contracting?

 

AI-assisted contracting covers the use of artificial intelligence at any stage of a commercial transaction. A system may draft contractual provisions, cross-check clauses, summarise commercial terms, generate prices, communicate with a counterparty or respond to customer enquiries. It may be used directly during negotiations or simply to prepare a document that is subsequently reviewed and sent to another party. The technology may be developed in-house, purchased under licence or incorporated into a general business application.

 

UAE law does not establish a comprehensive, standalone category of AI-related contractual liability or confer general legal personality on AI systems. Nor is there a separate contractual liability regime that automatically determines responsibility whenever an AI-generated output causes a loss. Instead, the legal consequences are assessed under the existing rules governing contractual obligations and civil liability. Responsibility may fall on the natural or legal persons who select, deploy, configure, supervise or rely on the system, depending on their respective roles, obligations and conduct. The central issue is therefore not whether a machine produced the output, but which party is legally responsible for the decision or commitment made through its use.

 

Legal Framework Governing AI In UAE Business Contracts

 

The UAE does not have a single statute governing AI-assisted commercial contracting as a distinct legal category. Its use is assessed under the general principles of contract law and civil liability, alongside the legislation governing electronic transactions, personal data, consumer protection and other relevant activities. AI-assisted contracting is not prohibited merely because automation is involved, but its use must remain within the applicable legal framework.

 

Under the UAE Civil Transactions Law, contractual obligations are generally assessed by reference to the parties' agreement and the applicable requirements concerning the subject matter, cause and validity of the transaction. Electronic communications and automated processes may also have legal consequences. Where a business makes an offer, accepts terms or communicates a binding commitment through an automated system, it cannot ordinarily avoid the resulting obligations simply because the communication was generated by technology rather than an employee acting manually.

 

This position is reinforced by Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services, which recognises electronic transactions and addresses contracts formed through automated electronic systems. The legal effect of an automated communication must be assessed in the context of the applicable provisions and the circumstances of the transaction. A technical error or an unexpected AI-generated response does not, by itself, establish that a contract is invalid or relieve a business of its obligations. The parties' authority, the circumstances in which the communication was made and the applicable rules on contractual and civil liability remain relevant.

 

Data protection obligations must also be considered. Onshore businesses within the scope of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data must comply with the applicable requirements when processing personal information through AI systems. Businesses operating in the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM) must assess the separate data-protection regimes applicable in those jurisdictions. Where AI tools are used to communicate with consumers or influence consumer transactions, the Consumer Protection Law, Federal Law No. 15 of 2020, and its applicable implementing requirements may also be relevant. The precise obligations will depend on the nature of the business, the data involved and the jurisdiction in which the activity takes place.

 

Liability And Counterparty Risks In AI-Assisted Contracting

 

The principal legal risks arise not from the mere use of AI, but from determining who bears responsibility when an output is inaccurate, incomplete or misleading. A business cannot ordinarily escape liability for its own contractual obligations by arguing that a machine generated the relevant wording or recommendation. Where a technology provider, consultant and developer have all contributed to a system's deployment, each party's exposure must be assessed against its contractual commitments, conduct and contribution to the loss. Relevant factors include the purpose for which the technology was acquired, the provider's representations, the system's configuration, the extent of human supervision and whether the tool was used beyond its intended scope. If the parties have not clearly allocated these risks, the business using the system may face the immediate commercial and legal consequences of an error.

 

The agreement with the technology provider is therefore a critical part of risk management and should not be treated as routine procurement paperwork. Providers may seek broad exclusions for inaccurate outputs, data loss and consequential losses while limiting their financial exposure to a relatively low amount. Businesses should examine these provisions against the potential scale of the harm and negotiate appropriate warranties, indemnities and liability caps. Particular attention should be paid to confidentiality breaches, data-security incidents, intellectual-property claims and material system failures. The agreement should also address material changes to the model, notification of incidents, continuity of service and the return or deletion of business information when the relationship ends. If the provider is based outside the UAE, the parties should additionally consider governing law, dispute resolution, jurisdiction and cross-border data transfers before signing.

 

Data Protection, Confidentiality And Oversight: Practical Realities

 

AI systems may process information entered through prompts, uploaded documents or connected business applications. This can create legal exposure when the information includes personal data, commercially sensitive material or documents protected by contractual confidentiality obligations. Businesses should establish what information the system collects, where it is stored, who can access it and whether it is transferred across borders. Confidentiality must be considered separately from data protection because commercial information may be contractually protected even when it does not constitute personal data. Employees should not upload client files, legal advice, pricing details or transaction documents to external AI platforms without appropriate authorisation. The provider's terms should also be checked to establish whether inputs and outputs may be retained, accessed by others or used to train its systems.

 

When an AI-generated output contributes to a contractual mistake, the legal assessment will generally focus on the actions of the parties and the safeguards that could reasonably have been expected in the circumstances. Businesses should adopt internal policies identifying approved tools, permitted uses, restricted information and the people authorised to make final decisions. Oversight should be proportionate to the consequences of the task. Summarising a routine internal document carries a different level of risk from recommending termination of a contract or determining a customer's contractual entitlement. Significant decisions should not be left to automated systems without clearly defined authority, appropriate checks and independent human review.

 

Customer-facing applications require particular care. Businesses remain responsible for ensuring that chatbots and automated sales tools provide accurate information about prices, services and contractual terms, in accordance with applicable consumer-protection requirements. Complaints involving substantial sums, refund disputes and significant financial commitments should be referred to an authorised employee where appropriate. For material AI-assisted decisions, businesses should maintain records of the system used, relevant inputs, human checks and approvals. Such documentation can help identify the source of an error, establish how a decision was reached and support the business's response to a contractual dispute or regulatory enquiry.

 

Conclusion

 

The use of AI in UAE business contracts is permissible in principle, but it brings commercial and legal risks that businesses should not underestimate. AI systems do not have independent legal personality or assume contractual responsibility in their own name, and businesses cannot rely on the technology itself as a general defence against liability. Accountability must be assessed by reference to the parties who select, configure, supervise and use the system, together with their respective legal duties and the circumstances in which a loss occurs.

 

The practical value of AI-assisted contracting depends not only on the technology's capabilities, but also on the contractual protections, data controls and human review surrounding its use. Businesses should establish clear rules for automated communications, negotiate meaningful safeguards with technology providers and ensure that consequential decisions remain subject to appropriate oversight. AI may change how commercial decisions are prepared and executed, but it does not remove responsibility for them. Without effective safeguards, the efficiency gained through automation may be outweighed by disputes, financial losses and legal exposure that the business could have reduced through proper planning.