ISO 42001 certification in the UAE and GCC: AIMS accreditation, Dubai registration and the PDPL impact assessment

Why organisations in the UAE and GCC pursue ISO/IEC 42001

The UAE Ministry of Finance's Federal Supplier Register asks mainland, free-zone and foreign suppliers for a trade licence, a VAT or tax registration certificate and a copy of the owner's passport. No management system certificate is on the list.

The pressure comes from buyers. A software house selling an AI feature to a Gulf bank and a Dubai group whose European parent wants evidence of AI governance face the same vendor-assessment questions: which AI systems do you run, who owns them, how were their impacts assessed, and can an independent body confirm it? The decision guide for AI providers and users tests whether that demand justifies certifying now.

Accreditation for ISO/IEC 42001 in the UAE and GCC

EIAC, the Emirates International Accreditation Centre, is a government entity working under the Executive Council of the Government of Dubai; Dubai Law No. 27 of 2015 created it. It accredits certification bodies to ISO/IEC 17021-1 and publishes a Conformity Assessment Bodies Directory showing each body's accredited schemes. EIAC also states that registration is mandatory for certification bodies based in Dubai and voluntary for accreditation elsewhere.

For AI management systems, a certification body also has to meet ISO/IEC 42006:2025, published in July 2025, which adds AIMS requirements to ISO/IEC 17021-1. Accreditation programmes for it are recent: UKAS in the United Kingdom, for example, has opened an AIMS programme against those two documents. A UAE organisation's certificate may therefore carry EIAC accreditation or a foreign one; either way, AI management systems must appear in the accredited scope.

For sites elsewhere in the Gulf, GAC, the Gulf Cooperation Council's accreditation body with a branch in Oman, accredits management system certification bodies to ISO/IEC 17021-1, and its directory can be filtered by country. SAAC, Saudi Arabia's national accreditation body, keeps a directory that includes certification bodies. International recognition passed to Global ACI on 1 January 2026, replacing the IAF MLA and the ILAC MRA. EIAC describes itself as an IAF MLA and ILAC MRA signatory and SAAC lists Global ACI among its affiliations, but Global ACI had published no list of recognised bodies when we last checked. The guide to choosing an ISO/IEC 42001 certification body covers the rest of the comparison.

Local practice that changes an ISO/IEC 42001 project

The PDPL impact assessment beside the AI impact assessment

Federal Decree-Law No. 45 of 2021, the UAE Personal Data Protection Law, requires an impact assessment before high-risk processing with new technologies, including systematic assessment of people by automated processing and profiling with legal consequences. People may also object to automated decisions and ask for human review. ISO/IEC 42001 requires an AI system impact assessment of consequences for individuals and societies. They are different documents drawn from the same facts: the data, the decision, the people affected and the safeguards. Plan them together with your data protection officer.

Free-zone, mainland and sector carve-outs

The PDPL does not apply to companies in free zones with their own data protection legislation, such as the DIFC under DIFC Law No. 5 of 2020, and it excludes health and banking data governed by their own laws. A group with a DIFC entity, a mainland entity and a healthcare or banking client may face three privacy regimes inside one AIMS scope. Record each as an applicable requirement and agree early which entities the certificate names.

Models and data that cross borders

Many Gulf AI systems call a model hosted abroad or use data held outside the UAE. The PDPL restricts cross-border transfers, and ISO/IEC 42001 expects data provenance and supplier responsibilities to be controlled. One map of where data and models sit answers both.

How Sterling works in the UAE and GCC

Sterling's Dubai office, our regional headquarters, runs AI governance engagements across the Gulf, with expert and experienced consultants working alongside your system owners and data protection officer, backed by 8,100+ client engagements in 60+ countries since 2003. Organisations already certified to ISO/IEC 27001 usually extend their ISMS into an AIMS rather than build a second system. Sterling does not certify; an independent, accredited certification body audits your AIMS and decides.

ISO 42001 certification in the UAE: questions buyers ask