Jurisdictions

A jurisdiction is the regulatory domain whose rules your agent operates under. The SDK fetches that jurisdiction's signed ruleset from the foundation registry, classifies your risk tier from your declared , and applies the obligations the regulator has published.

Iqrar currently models the following jurisdictions:

Every shipping bundle is interpreted (modelled from public regulator publications and Foundation-signed). No authority has yet co-signed its bundle directly — authority co-signature flows are the active build.

Dubai International Financial Centre (AE-DIFC)

Authority — DIFC Commissioner of Data Protection Source law — DIFC Data Protection Law No. 5 of 2020 + Regulation 10 (Processing of Personal Data through Autonomous and Semi-Autonomous Systems, in force 1 September 2023) Live consultation — DIFC Consultation Paper No. 3 of 2026 proposes Regulation 11 on recognised external certification schemes; consultation closes 18 July 2026. Iqrar tracks the proposed amendments as advisory obligations.

Configure your SDK like this:

const iqrar = Iqrar({
  org: "acme",
  jurisdiction: "AE-DIFC",
  capabilities: ["consumer_chatbot"],
});

Reg 10's structure

Regulation 10 uses a binary high-risk gate, not a four-tier framework. Where personal data is processed through an autonomous or semi-autonomous System (any AI/ML system whose outputs materially affect a natural person), commercial high-risk processing is prohibited unless ALL of the following hold cumulatively:

1. The Commissioner has established corresponding audit and certification requirements.
2. The System is compliant with those requirements (certified via an accredited body).
3. The System processes personal data solely for purposes that are human-defined or human-approved.
4. The Deployer or Operator has appointed an Autonomous Systems Officer (ASO) with substantially similar status, competencies and tasks to a Data Protection Officer.

The Iqrar schema maps the binary gate into the four-tier RiskTier enum so it composes with EU AI Act bundles: high and critical correspond to Reg 10 "high-risk processing"; limited triggers Reg 10's notice obligations; minimal covers internal-only Systems with no consumer effect.

Key obligations

• Role designation — every System must have an identifiable Deployer (deemed Controller) and, where applicable, Operator (deemed Processor).
• System notice — clear and explicit notice to data subjects at first use, identifying processing not initiated by humans, scope of System-defined vs. human-defined purposes, outputs and uses, design safeguards, and applicable certifications.
• AI register — a Controller-held register of Systems processing personal data, producible to the Commissioner on request.
• System DPIA — mandatory before deploying any System processing personal data; reviewed on material changes.
• Evidentiary explainability — explanations in non-technical terms, with supporting evidence (algorithmic safeguards, bias and risk outputs, certification status).
• ASO appointment — required for any high-risk processing for commercial purposes.
• High-risk certification — the four cumulative conditions above. Modelled as severity: "blocking" with a requires_prior_authorisation gate on the DIFC Commissioner.

Breach notification follows DIFC DPL Art. 41: "as soon as practicable" after the Controller becomes aware. The Iqrar bundle models this as "asap", the strictest value in the schema.

United Arab Emirates — federal (AE)

Authority — Federal Authority for Artificial Intelligence and Data Source law — Federal Decree-Law No. 45 of 2021 (PDPL); UAE Charter for the Development and Use of AI (30 July 2024, soft law); plus the institutional consolidation announced on 14 June 2026.

There is no enacted federal UAE AI statute. The federal layer is data-protection plus soft-law principles plus a newly-formed coordinating institution. PDPL's Executive Regulations have not yet been issued as of June 2026, so operational mechanics (consent forms, breach SLAs, adequacy lists) await further rule-making.

Configure your SDK like this:

const iqrar = Iqrar({
  org: "acme",
  jurisdiction: "AE",
  capabilities: ["consumer_chatbot"],
});

What the bundle carries

• PDPL obligations (lawful basis, data-subject rights, breach notification, cross-border transfer, DPO designation) — marked required where the law itself is unconditional, otherwise apply_and_explain until Executive Regulations land.
• An info notice that Executive Regulations are pending — operators should monitor publication by the Federal Authority.
• An advisory attestation against the UAE Charter's 12 principles — soft-law alignment, no statutory hook.
• An institutional notice of the Federal Authority's establishment, with sources.

What the bundle does not carry

• No "UAE AI Act" §-numbered obligations. References on certain marketing sites to a "UAE AI Act 2026" with §4 / §7 / §15 / §17 / §19 / §22 are not traceable to any government source.
• No four-tier AI risk framework — federal UAE does not publish one. Tier classification is performed at the DIFC layer (AE-DIFC) or EU layer (EU) when those bundles also apply.

Free zones (DIFC, ADGM) are expressly excluded from federal PDPL under PDPL Art. 3 and operate their own data-protection regimes. If your agent operates inside DIFC, use AE-DIFC rather than (or in addition to) AE.

Choosing your jurisdiction

• DIFC-registered firm — AE-DIFC. This is the live AI-specific binding regime in the UAE today.
• UAE mainland firm processing personal data of UAE natural persons — AE (federal PDPL).
• Serving customers across multiple jurisdictions — register against every applicable code; the SDK merges obligations strictest-wins.

Why this is signed

A ruleset isn't a config file we ship. It's a signed bundle authored by the publishing authority (or, for interpreted bundles, the Iqrar Foundation), validated against the foundation registry the SDK pinned on first boot, and merged with any active runtime directives the regulator has issued. If Iqrar disappeared tomorrow, the chain of signatures still proves what your agent was bound to enforce on a given date. See for the full cryptography.