Jurisdictions

Which regulators Iqrar currently supports, the canonical jurisdiction codes the SDK accepts, and what each one obligates your agent to do.

A jurisdiction is the regulatory domain whose rules your agent operates under. The SDK fetches that jurisdiction's signed ruleset from the foundation registry, classifies your risk tier from your declared , and applies the obligations the regulator has published.

Iqrar currently supports one jurisdiction in production:

Code	Name	Authority	Status
`AE`	United Arab Emirates	UAE AI Authority	Live

Additional jurisdictions (EU, AE-DIFC, SA-IFWG) are on the roadmap — see for the governance timeline.

United Arab Emirates (`AE`)

Authority — UAE AI Authority Source law — UAE AI Act 2026 (effective March 2026), supplemented by the UAE Charter for the Development and Use of AI (2024) Ruleset version — 2026.03.0

Configure your SDK like this:

const iqrar = Iqrar({
  org: "acme",
  jurisdiction: "AE",
  capabilities: ["consumer_chatbot"],
});

Tier framework

The UAE AI Act 2026 defines four risk tiers. Your tier is computed from your declared capabilities against the ruleset's tier_classifiers — see for the full mapping.

Tier	UAE name	Triggering capabilities (examples)
`minimal`	Tier 1	`internal_tooling`
`limited`	Tier 2	`consumer_chatbot`, `content_generation`, `personalisation`
`high`	Tier 3	`credit_decision`, `employment_decision`, `healthcare_recommendation`, `biometric_identification`, `law_enforcement_support`, `education_assessment`
`critical`	Tier 4	`autonomous_physical_action`, `critical_infrastructure_control`

Obligations summary

Every tier carries the registration and invocation-logging obligations. Higher tiers add to the floor — they don't replace it.

All tiers

Registration & self-assessment — UAE AI Act §4. All operators must register and self-assess risk tier within six months of deployment.
Operational logging — §7. Every invocation logged with timestamp, model, tools, outcome. Minimum retention 12 months. The SDK satisfies this automatically through iqrar.wrap().

Tier 2+ (Limited risk and above)

Consumer disclosure — §11. Consumers must be unambiguously informed they are interacting with AI. The SDK's iqrar.disclose() returns a regulator-quality string in Arabic and English.
Tool invocation logging — §7.2. Tool/function calls logged with hashed arguments and outcomes. Automatic via iqrar.wrap().

Tier 3 (High risk)

Annual algorithmic audit — §15. Third-party audit, report filed with the UAE AI Authority within 30 days of completion.
Quarterly bias testing — §16. Documented mitigation when disparate impact is identified.
AI Ethics Officer — §17. Designated officer with a direct reporting line to the board.
72-hour incident notification — §19. Material incidents notified to the UAE AI Authority within 72 hours.
Consumer rights — §22. Right to explanation, human review, opt-out from AI-only decisions, and compensation for AI-caused harm. The SDK records recordHumanReview() calls into the audit chain.
Full payload retention — §7.3. Full input/output retained for 5 years on consumer-affecting decisions. Triggered automatically when you call iqrar.decision({...}) at Tier 3.

Tier 4 (Critical risk)

Pre-authorisation — §25. May not operate without prior written authorisation from the UAE AI Authority. The SDK will not silently let a Tier 4 agent run.
Continuous human oversight — §26. Human-in-the-loop required for every decision. Real-time supervisory dashboard mandatory.

Penalties

Up to AED 10 million for material non-compliance with the Act.

Charter principles

The UAE Charter for the Development and Use of AI (2024) provides 12 ethical principles that inform the Act: fairness, accountability, transparency, explainability, resilience, safety, human values, sustainability, privacy protection, inclusivity, dignity, and governance. The principles are embedded in the ruleset and surface in regulator-side dashboards; they do not impose direct technical obligations on your SDK integration.

Choosing your jurisdiction

If your agent is operating in or serving consumers in the UAE — register against AE. That's currently the only supported jurisdiction in Iqrar.

If your agents serve consumers outside the UAE, Iqrar isn't the right fit yet — watch the roadmap or open an issue to register interest in a specific jurisdiction.

Why this is signed

The UAE ruleset isn't a config file we ship. It's a signed bundle authored by the UAE AI Authority's key, validated against a foundation registry the SDK pinned on first boot, and merged with any active runtime directives the regulator has issued. If Iqrar disappeared tomorrow, the chain of signatures still proves what your agent was bound to enforce on a given date. See for the full cryptography.