UAE Companies Can Be Liable for AI-Driven Losses Under Civil Transactions Law

The column answered a reader's question about who is responsible when AI-generated advice or decisions cause financial loss, legal violations or harm to an individual: the company, the employee who acted on the advice, or the developer. It said such cases may be assessed under the general principles of civil liability, contractual obligations and any sector-specific legislation that applies.

The governing text is Federal Decree-Law No. 25 of 2025 promulgating the Civil Transactions Law. Article 245(1) applies its chapter on harmful acts to liability arising from a harmful act committed by "a natural or legal person", subject to the liability provisions of special legislation. Article 246 states: "Every act causing harm to another shall obligate its perpetrator to compensate for the damage, even if the perpetrator lacks discernment."

Article 247 separates harm caused directly from harm caused by causation. Direct harm brings compensation without any condition. Harm by causation does so only if the perpetrator was a transgressor, acted intentionally, or the act led to the harm. Liability may therefore depend on each party's role in developing, deploying or using the system, the act or omission involved, and whether that conduct can be sufficiently linked to the damage. Using AI as a tool would not by itself necessarily rule out liability for the person or company responsible for using it, the column said.

For companies, it pointed to situations such as inadequate assessment of a system, insufficient safeguards or a failure to monitor its use properly. The company's contractual obligations, regulatory requirements and how involved it was in the decision may also be relevant.

The position is clearer for professional companies, which Article 645 defines as firms set up by one or more people licensed to practise a liberal profession, alone or with others, in order to practise it. Under Article 651, each partner is personally liable for professional faults towards the company and the other partners, and the company is liable to third parties for the partners' faults. The company also answers for its managers' acts in the ordinary course of management, and for employees or agents with authority to act for it where a third party relied on that authority. Any provision in the articles of association allowing a current or former manager to be exempted from personal liability is void.

Such firms therefore remain liable for their professional services whether or not the work relied on AI-generated advice, and cannot shed that liability through their constitutional documents or other agreements, the column concluded. A partner who rendered the service remains personally liable to the company for losses from a third-party claim. A company can also act against a manager who went beyond the ordinary course of business, citing Article 614 of the Civil Transactions Law, or an unauthorised employee who acted in bad faith, including by dismissal under Article 44 of Decree Law No. 33 of 2021 on the Regulation of Employment Relations.

On developers, the column cited the AI Ethics: Principles and Guidelines issued in December 2022 by the UAE Ministry of State for Artificial Intelligence, Digital Economy and Remote Work Applications. Article 3.2.1 says: "Accountability for the outcomes of an AI system lies not with the system itself but is apportioned between those who design, develop and deploy it." The guidelines say operators and developers should consider designating people to investigate and fix the causes of loss or damage, and they set out procedures for people affected by significant AI-assisted decisions to challenge them and seek human review.

The guidelines describe themselves as non-binding, and the column said they should be read as policy guidance rather than a standalone basis for legal liability.