Your client just asked if you use AI. What do you say?

It's becoming a normal question in client meetings across Dubai and Abu Dhabi right now. A client asks, almost casually: “Do you use AI to handle our documents?” Most lawyers freeze for a second. Not because they don't use AI. Because they're not sure what the honest answer actually is. Here's why that pause is happening more and more in the UAE specifically, and what's really going on underneath it.

Why this question is becoming common in the UAE

Clients in the UAE are sophisticated. Many of them run banks, family offices, real estate groups, and multinational businesses that operate across borders. They've seen the headlines about data leaks through AI tools. Banks operating out of DIFC have started asking outside counsel directly: where does our information go once it leaves your office? This isn't paranoia. It's a fair question, and one that's becoming standard practice across the region. A real estate developer handing over a AED 200 million transaction file wants to know that file isn't sitting on a server in another country with no oversight. A family business going through a succession dispute wants to know their private financial history isn't floating around outside the room. In a market built on trust and relationships — and the UAE legal market runs heavily on both — this question is only going to come up more often, not less.

The problem is most UAE firms don't actually know the answer

Many firms here use AI quietly. A junior associate finds ChatGPT useful, starts using it daily on contract summaries and translations, and nobody officially approved it or banned it. Partners often don't know the full extent of how their own team is using these tools. So when the question comes up in a client meeting, the honest answer is messy. “Some of our team uses ChatGPT sometimes, I think, for some things.” That's not a confident answer to give a client paying premium rates for premium advice. And in the UAE, where firms compete heavily on reputation and word of mouth between family businesses and corporate groups, an unclear answer to a basic question like this can quietly cost you the next referral.

What actually happens to a file you upload

When you put a document into a regular AI tool like ChatGPT, here's the simple version of what happens. Your file travels over the internet to a server owned by another company, usually based outside the UAE entirely — often in the United States. That company processes your file there. Depending on the settings, your file might be stored. It might even be looked at by someone reviewing how the AI is performing.

What this means under UAE law specifically

The UAE brought in a proper data privacy law called PDPL in January 2026 — think of it as the UAE's own version of GDPR, the well-known European privacy law. PDPL says you need to know exactly where personal data goes, and you need proper protections in place if an outside company is handling it. On top of that, if you're working on a matter inside DIFC or ADGM, there are separate data protection rules specific to those zones. DIFC has its own data protection law. ADGM has its own regulations. Both are stricter than the federal baseline. So a single transaction — say a property sale where the buyer is registered in DIFC — might actually be touching three different privacy frameworks at once. If a client's data ends up on a foreign server with no contract covering how it's protected, that's a real gap under at least one of those frameworks. Not a future risk. A gap that exists right now, today, in plenty of UAE firms.

What a better answer sounds like

The UAE firms getting ahead of this aren't avoiding AI. They're just being precise about how they use it. The better answer to a client's question sounds like this: “Yes, we use AI, and it runs entirely inside our own systems. Nothing leaves our firm. Your file never touches a server outside the UAE.” That's the difference between private AI and public AI. Private AI runs on the firm's own computers or its own private cloud space, located wherever the firm chooses — including right here in the UAE. Public AI runs on someone else's servers, shared across millions of users, usually sitting in a different country altogether. It's not a technical detail anymore. In a market where reputation moves fast through word of mouth between family businesses, banks, and corporate groups, it's a client relationship detail. And in 2026, it's increasingly a compliance one too.