Law firms · AI policy, UAE to Kuwait
Law firm AI policy generator
For managing partners writing the firm's rules on AI. Pick where the firm practises and the tools it uses, and get an outline to copy, each point with the text that drives it and the open questions marked.
How this generator works
- The twelve points come from a reading of the lawyer secrecy rules, court guidance, court decisions and data protection texts of nine Gulf jurisdictions, checked on 8 October 2026. Each point keeps only the texts of the places you pick, with a quote and the source.
- Where the research could not settle a point, the outline marks it "Unclear" and says why. Where your places have no text for a point, it says which places do.
- The tools you pick go into the approved-tools list, and their own pages' answers on training, retention, staff access, certifications and hosting go into the due diligence and transfer points.
- Everything runs in your browser: nothing you tick is sent, and the copy button only uses your clipboard.
Not covered here
- The text of the UAE Ministry of Justice's ten guiding principles for law firms of 29 September 2026: only the press release was found.
- Sector rules on where data must stay, such as health data rules or the Saudi National Cybersecurity Authority's controls: not read.
- Courts other than those named, and rules issued after 8 October 2026.
Sources
Laws, rules, court guidance and decisions
- UAE Federal Decree-Law No. 34 of 2022 Regulating the Legal Profession, checked 8 October 2026
- UAE Cabinet Resolution No. 8 of 2025, Executive Regulations of Decree-Law No. 34 of 2022, checked 8 October 2026
- UAE Cabinet Resolution No. 9 of 2025, Code of Ethics for the Legal Profession, checked 8 October 2026
- UAE Federal Decree-Law No. 31 of 2021, Crimes and Penalties Law, checked 8 October 2026
- UAE Minister of Justice, Guiding Principles for the Use of AI Systems by Law Firms, press release of 29 September 2026, checked 8 October 2026
- UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, checked 8 October 2026
- DIFC Courts' Order No. 2 of 2025, Mandatory Code of Conduct for Legal Practitioners, checked 8 October 2026
- DIFC Courts, Practical Guidance Note No. 2 of 2023 on large language models and generative AI, checked 8 October 2026
- DIFC Data Protection Law, DIFC Law No. 5 of 2020, checked 8 October 2026
- DIFC Data Protection Regulations, Regulation 10, checked 8 October 2026
- ADGM Courts Rules of Conduct 2016, checked 8 October 2026
- ADGM Courts Practice Direction 2, Commercial and Civil Claims, 17 October 2025, checked 8 October 2026
- Arabyads Holding Limited v Gulrez Alam Marghoob Alam [2025] ADGMCFI 0032, costs judgment of 18 December 2025, checked 8 October 2026
- ADGM Data Protection Regulations 2021, consolidated, checked 8 October 2026
- Saudi Code of Law Practice, Royal Decree No. M/38 (unofficial English translation), checked 8 October 2026
- Saudi Implementing Regulations of the Code of Law Practice, gazette notice, checked 8 October 2026
- Saudi Rules of Professional Conduct for Lawyers, gazette notice, checked 8 October 2026
- Saudi Judicial Scientific Society compilation of the Law of Legal Practice and its regulations (not an official source), checked 8 October 2026
- Saudi Personal Data Protection Law, checked 8 October 2026
- Saudi Regulation on Personal Data Transfer Outside the Kingdom, August 2024, checked 8 October 2026
- SDAIA Generative AI Guidelines For Public, checked 8 October 2026
- Qatar Law No. 23 of 2006, Law of Advocacy (Al Meezan English translation), checked 8 October 2026
- Qatar Penal Code, Law No. 11 of 2004, Article 332, checked 8 October 2026
- Qatar Law No. 13 of 2016 on Protecting Personal Data Privacy, checked 8 October 2026
- QFC Court and Regulatory Tribunal, Practice Direction on the Use of AI (No. 1 of 2026), checked 8 October 2026
- QFC Court, Practice Guidance on the Use of AI, 6 January 2026, checked 8 October 2026
- Jonathan David Sheppard v Jillion LLC [2025] QIC (E) 3, checked 8 October 2026
- QFC Data Protection Regulations 2021, in the Data Protection Office guidance, checked 8 October 2026
- Bahrain Legislative Decree No. 26 of 1980, Lawyering Law (LLOC English translation), checked 8 October 2026
- Bahrain Penal Code, Decree-Law No. 15 of 1976 (LLOC English translation), checked 8 October 2026
- Bahrain Law No. 30 of 2018, Personal Data Protection Law (LLOC English translation), checked 8 October 2026
- Bahrain Resolution No. 42 of 2022 on transfers of personal data outside the Kingdom (Arabic), checked 8 October 2026
- Oman Royal Decree 41/2024, Advocacy and Legal Consultancy Law (unofficial translation), checked 8 October 2026
- Oman Penal Law, Royal Decree 7/2018 (Supreme Judicial Council translation), checked 8 October 2026
- Oman Royal Decree 6/2022, Personal Data Protection Law (unofficial translation), checked 8 October 2026
- Oman Ministerial Decision 34/2024, Executive Regulation of the Personal Data Protection Law (Arabic), checked 8 October 2026
- Kuwait Law No. 42 of 1964 on the legal profession (a lawyer's compilation, not the Official Gazette), checked 8 October 2026
- Kuwait Law No. 20 of 2014 on Electronic Transactions (KDIPA English translation), checked 8 October 2026
arelion.dev guides
- arelion.dev guide: UAE PDPL and AI, guide of 6 October 2026
- arelion.dev guide: DIFC Data Protection Law and AI, guide of 6 October 2026
- arelion.dev guide: ADGM Data Protection Regulations 2021 and AI, guide of 7 October 2026
Vendor pages
- Harvey: www.harvey.ai/security, checked 8 October 2026
- Harvey: trust.harvey.ai/, checked 8 October 2026
- Harvey: www.harvey.ai/legal/subprocessors, checked 8 October 2026
- Legora: legora.com/security, checked 8 October 2026
- Legora: security.legora.com/faq, checked 8 October 2026
- Legora: security.legora.com/, checked 8 October 2026
- Legora: legora.com/legal/eu-pre-approved-sub-processors, checked 8 October 2026
- Legora: jobs.ashbyhq.com/legora/85f05d60-c3a0-4a14-b344-150856d88cd2, checked 8 October 2026
- Lexis+ with Protégé: www.lexis.ae/protege/, checked 8 October 2026
- Lexis+ with Protégé: www.lexisnexis.com/community/pressroom/b/news/posts/lexisnexis-marks-16-years-in-mena-with-launch-of-lexis-with-protege, checked 8 October 2026
- Lexis+ with Protégé: www.lexisnexis.com/assets/en-au/pdf/Lexis_Plus_AI_Security-Information_Nov-24.pdf, checked 8 October 2026
- Lexis+ with Protégé: www.lexisnexis.com/en-int/products/lexis-plus-protege, checked 8 October 2026
- Lexis+ with Protégé: www.lexisnexis.com/global/privacy/en/subprocessor.page, checked 8 October 2026
- CoCounsel: www.thomsonreuters.com/en/cocounsel, checked 8 October 2026
- CoCounsel: www.thomsonreuters.com/en-us/posts/innovation/cocounsel-achieves-iso-iec-420012023-certification-another-milestone-in-trusted-ai/, checked 8 October 2026
- CoCounsel: www.thomsonreuters.com/en/trust-center, checked 8 October 2026
- CoCounsel: mena.thomsonreuters.com/en/products-services/legal/cocounsel.html, checked 8 October 2026
- CoCounsel: mena.thomsonreuters.com/en/press-releases/2025/may/thomson-reuters-sets-future-agenda-at-synergy-dubai-pioneering-transformation-in-legal-tax-compliance-and-finance-sectors.html, checked 8 October 2026
- Microsoft 365 Copilot: learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy, checked 8 October 2026
- Microsoft 365 Copilot: learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor, checked 8 October 2026
- Microsoft 365 Copilot: learn.microsoft.com/en-us/purview/customer-lockbox-requests, checked 8 October 2026
- Microsoft 365 Copilot: learn.microsoft.com/en-us/compliance/regulatory/offering-iso-42001, checked 8 October 2026
- Microsoft 365 Copilot: learn.microsoft.com/en-us/microsoft-365/enterprise/o365-data-locations, checked 8 October 2026
- Microsoft 365 Copilot: news.microsoft.com/source/emea/2025/10/microsoft-announces-in-country-data-processing-for-microsoft-365-copilot-in-the-uae-to-accelerate-ai-adoption/, checked 8 October 2026
- Microsoft 365 Copilot: www.microsoft.com/en-us/microsoft-365/blog/2025/11/04/microsoft-offers-in-country-data-processing-to-15-countries-to-strengthen-sovereign-controls-for-microsoft-365-copilot/, checked 8 October 2026
- ChatGPT Enterprise: openai.com/enterprise-privacy/, checked 8 October 2026
- ChatGPT Enterprise: developers.openai.com/api/docs/guides/your-data, checked 8 October 2026
- ChatGPT Enterprise: openai.com/security-and-privacy/, checked 8 October 2026
- ChatGPT Enterprise: help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt, checked 8 October 2026
- OpenAI: openai.com/index/response-to-nyt-data-demands/, checked 8 October 2026
Questions
What should a law firm AI policy cover in the Gulf?
Twelve points come out of the texts: an approved-tools list with no client material in personal chatbot accounts, a data classification, consent in writing from the client and from any other owner of the information or person the personal data is about, vendor due diligence, a transfer map, a gate for sensitive data, verification of every citation, disclosure of AI use by court, no AI-generated evidence, named responsibility with training, the DIFC and ADGM duties on personal data, and an incident procedure.
Do Gulf courts require lawyers to disclose AI use?
It depends on the court. The DIFC Courts' guidance asks parties to declare AI use at the earliest opportunity. The QFC Court does not require a declaration unless it asks, but lawyers must be ready to show which parts used AI and how they were checked. The ADGM Courts require notice before AI is used to search for documents in disclosure. No rule was found for the onshore courts.
What happens when a lawyer cites a case invented by AI?
In the ADGM, a law firm was ordered to pay costs of AED 282,508 on the indemnity basis in Arabyads v Alam (December 2025). In the QFC, contempt of court was proved in Sheppard v Jillion (November 2025) on a finding that the lawyer's conduct was intentional, without a penal sanction, and the court warned that later breaches would name the lawyer or law firm.