Civil Law and UAE Algorithmic Decision Liability

1. Introduction

Algorithmic decision liability concerns civil responsibility arising when an automated or AI-based system makes, recommends, influences, or materially contributes to a decision that causes legally recognised harm.

Examples include algorithms used for:

• credit approval and scoring;
• insurance underwriting;
• employee recruitment;
• performance assessment;
• automated fraud detection;
• healthcare risk assessment;
• customer classification;
• government services;
• contract management;
• legal and judicial decision-support systems.

In the UAE, there is currently no single comprehensive civil-liability statute exclusively governing algorithmic decisions. Therefore, liability is generally analysed through existing principles of contractual liability, fault, negligence, causation, damage, professional responsibility, evidentiary rules, administrative legality, proportionality, and judicial reasoning, together with technology-specific legislation.

The central question is:

Who is legally responsible when an algorithm makes or contributes to a harmful decision?

The answer normally depends upon the role played by the developer, supplier, operator, employer, professional, financial institution, or public authority.

2. Meaning of Algorithmic Decision Liability

Algorithmic decision liability can be defined as:

The legal responsibility arising when an automated computational or AI system produces, recommends, or materially influences a decision and that decision causes legally compensable damage because of defective design, inadequate supervision, unlawful use, contractual breach, negligence, or another legally recognised ground of liability.

The algorithm itself is generally not treated as an independent legal person.

Therefore, liability must ordinarily be traced to a legally responsible human or juridical entity.

Basic chain

Algorithm → Decision → Harm → Legal duty → Breach/fault → Causation → Damage → Liability

3. Difference Between Algorithmic Decision and Algorithmic Decision Liability

These concepts should be distinguished.

Algorithmic decision

This simply means that software or AI contributes to a decision.

Algorithmic decision liability

This arises only where the decision results in conduct satisfying the applicable legal requirements for liability.

For example:

AI rejects a loan application.

That alone does not establish liability.

But if:

defective AI → unjustified decision → contractual/professional/legal breach → financial loss → proven causation,

a civil claim may potentially arise.

4. UAE Legal Framework

Algorithmic decision disputes may involve several legal sources.

A. UAE Civil Transactions Law

The new Federal Decree-Law No. 25 of 2025 on the Civil Transactions Law, effective from 1 June 2026, provides the modern general civil-law framework for private-law relationships.

Its importance for AI liability lies in applying general civil principles to technologically novel conduct.

B. Civil Procedure Law

Federal Decree-Law No. 42 of 2022 governs civil and commercial procedure and therefore becomes relevant to bringing, proving and adjudicating algorithmic-liability claims.

C. Law of Evidence

Federal Decree-Law No. 35 of 2022 on Evidence in Civil and Commercial Transactions is especially important because it expressly recognises electronic evidence.

D. Electronic Transactions and Trust Services

Federal Decree-Law No. 46 of 2021 provides the legal framework for electronic transactions, electronic signatures, electronic records and automated electronic transactions.

E. Sector-specific regulation

Additional requirements may apply to:

• banking;
• insurance;
• employment;
• healthcare;
• telecommunications;
• financial technology;
• public administration.

5. Who Can Be Liable?

Algorithmic decision liability can potentially involve multiple actors.

A major issue is allocation of responsibility.

6. Developer Liability

An AI developer could potentially face liability where the system was:

• defectively designed;
• inadequately tested;
• improperly trained;
• supplied with materially defective specifications;
• known to generate unreliable outcomes;
• inadequately documented;
• represented as more accurate than it actually was.

The developer's liability, however, depends upon the applicable contractual and civil-law relationship.

7. Vendor Liability

An AI vendor may have contractual obligations concerning:

• accuracy;
• reliability;
• security;
• system availability;
• testing;
• compliance;
• data processing;
• performance standards.

If a vendor promises that an algorithm meets a particular standard but it materially fails to do so, contractual remedies may become relevant.

8. User or Operator Liability

Even a technically sound algorithm can produce liability if the operator uses it improperly.

Examples include:

• using an employment algorithm for a purpose for which it was not designed;
• relying upon outdated data;
• failing to update the system;
• ignoring known errors;
• using an automated risk score as the sole basis for a consequential decision.

Thus:

Correctly functioning technology can still be negligently used.

9. Human Oversight

Human oversight is particularly important for high-impact decisions.

A safer structure is:

AI recommendation → human examination → verification → decision

rather than:

AI recommendation → automatic implementation

Human oversight can help identify:

• erroneous data;
• unusual circumstances;
• discriminatory outcomes;
• model failures;
• false positives;
• incorrect classifications.

The UAE case law concerning judicial reasoning and administrative discretion supports the broader principle that automated outputs should not eliminate meaningful human/legal evaluation.

10. Elements of Algorithmic Decision Liability

A claimant generally needs to establish the relevant elements of the applicable cause of action.

1. Duty

The defendant owed a contractual, professional, statutory, administrative or civil duty.

2. Breach or fault

The defendant failed to comply with the relevant standard.

3. Algorithmic involvement

The algorithm materially contributed to the relevant decision.

4. Causation

The breach and algorithmic decision caused the claimant's damage.

5. Damage

The claimant suffered legally recognised loss.

6. Remedy

The law provides an appropriate remedy.

11. Case Law 1 — UAE Civil Cassation No. 647 of 2021

In Civil Cassation No. 647 of 2021, the UAE Court of Cassation emphasised that a judgment must demonstrate proper understanding and examination of the facts and evidence. It also stressed the importance of addressing a material defence capable of changing the outcome.

Relevance to algorithmic decisions

Suppose an AI system produces:

“Applicant = high risk.”

The defendant cannot necessarily argue that the numerical classification itself proves the correctness of the decision.

A claimant can challenge:

• the input data;
• the algorithm;
• the methodology;
• the assumptions;
• the reliability of the output.

The court must ultimately evaluate the relevant evidence.

Principle

Automated output does not replace reasoned legal evaluation.

12. Case Law 2 — UAE Commercial Cassation No. 215 of 2020

In Commercial Cassation No. 215 of 2020, the Court considered the proper use of expert evidence and emphasised the need for reasons supporting reliance upon an expert report.

Algorithmic application

An AI developer may submit an expert report stating:

“The system operates correctly.”

That report should not automatically resolve the dispute.

The opposing party can question:

• testing methodology;
• dataset quality;
• error rates;
• system limitations;
• validation procedures;
• assumptions.

Principle

Technical evidence must still be evaluated through reasoned judicial analysis.

13. Case Law 3 — UAE Commercial Cassation No. 767 of 2021

In Commercial Cassation No. 767 of 2021, the Court distinguished between the expert's technical role and the court's legal role.

An expert can assist with factual and technical questions, but legal conclusions remain for the court.

Application to AI

An AI expert may establish:

• how a model works;
• whether an input affected the output;
• whether an error occurred;
• whether the model was properly validated.

But the expert cannot ultimately determine:

“The defendant is civilly liable.”

That is a legal determination for the court.

Principle

AI may assist technical fact-finding but cannot replace judicial determination of liability.

14. Case Law 4 — UAE Federal Supreme Court Administrative Cassation No. 212 of 2021

In Administrative Cassation No. 212 of 2021, the Federal Supreme Court emphasised the requirement for adequate reasoning, examination of facts and evidence, and consideration of material defences.

The decision also addressed administrative disciplinary authority and the requirement that relevant procedures be properly followed.

Algorithmic relevance

Where a public authority uses an algorithm to make or recommend a decision, the authority may still need to comply with applicable:

• procedural safeguards;
• reasoning requirements;
• evidentiary requirements;
• fairness obligations.

An algorithm cannot simply become a shield against legal review.

Principle

Automation does not remove administrative accountability.

15. Case Law 5 — UAE Federal Supreme Court Administrative Cassation No. 891 of 2019

In Administrative Cassation No. 891 of 2019, the Federal Supreme Court addressed the limits of administrative discretion and the prohibition against abusive exercise of authority.

Application

Imagine a government algorithm generates:

“Risk level: 95%.”

An authority then automatically imposes a severe consequence.

The numerical output cannot necessarily be treated as an unlimited exercise of governmental discretion.

The authority may have to consider:

• accuracy;
• proportionality;
• individual circumstances;
• reliability of the information;
• applicable legal standards.

Principle

Algorithmic discretion remains subject to legal constraints.

16. Case Law 6 — UAE Civil Cassation No. 79 of 2020

In Civil Cassation No. 79 of 2020, the Court emphasised the importance of considering material defences and evaluating admissions and evidence properly and in context.

Algorithmic application

AI systems frequently compress complex information into:

• scores;
• labels;
• summaries;
• classifications.

For example:

“Customer = fraudulent.”

But the underlying evidence may contain information contradicting that conclusion.

The claimant should therefore be entitled, subject to applicable procedural and evidentiary rules, to challenge the factual foundation of the automated classification.

Principle

An algorithmic summary should not obscure the underlying evidentiary context.

17. Case Law 7 — UAE Civil Cassation No. 880 of 2021

Civil Cassation No. 880 of 2021 is particularly relevant to the damage element.

The Court recognised the possibility of compensation for qualifying material damage and loss of opportunity.

Algorithmic application

Suppose an algorithm improperly rejects a business financing application.

The company might allege:

• lost business opportunity;
• additional financing costs;
• loss of expected revenue;
• other financial damage.

The claimant must still establish the legally required connection between the wrongful conduct and the alleged loss.

Principle

Algorithmically caused economic harm can potentially be assessed through established civil-law damage principles.

18. Case Law 8 — UAE Commercial Cassation No. 240 of 2021

In Commercial Cassation No. 240 of 2021, the Court emphasised the importance of properly addressing material objections to expert evidence.

Application to algorithmic disputes

A claimant may challenge an AI-related expert report by arguing:

• the wrong data was examined;
• the sample was inadequate;
• the model was not independently tested;
• relevant variables were omitted;
• the methodology was defective;
• the expert misunderstood the algorithm.

If those objections are material, they cannot simply be ignored.

Principle

Algorithmic expertise remains subject to adversarial scrutiny.

19. Case Law 9 — UAE Civil Cassation No. 261 of 2000

The UAE Court of Cassation has also addressed the evidentiary reliability of technologically transmitted information, including telegram and fax evidence.

The broader principle is important for modern algorithmic disputes:

The technological form of information does not automatically establish its authenticity, attribution or reliability.

This principle becomes even more significant with AI-generated evidence because AI can:

• alter information;
• summarise information;
• generate synthetic content;
• transform original data.

Therefore, the court must distinguish between the original evidence and the AI-generated interpretation of that evidence.

20. Algorithmic Decisions and Electronic Evidence

The UAE Evidence Law is highly relevant.

Federal Decree-Law No. 35 of 2022 recognises electronic evidence and gives electronic evidence a legally recognised evidentiary status subject to statutory requirements.

This is important because an algorithmic-liability case may depend upon:

• system logs;
• electronic records;
• emails;
• electronic contracts;
• automated decisions;
• database entries;
• audit trails;
• electronic communications.

The legal question is not simply:

“Was the decision generated by a computer?”

Instead:

“Can the relevant electronic evidence establish what happened, who controlled the system, what data was used, and how the decision was produced?”

21. Algorithmic Decision Liability and Causation

Causation is often the hardest part of the case.

Consider:

Defective algorithm → incorrect risk score → financing rejection → lost business

The claimant must connect the stages.

The defendant may respond:

“Even without the algorithm, the financing would have been rejected.”

This creates a counterfactual question:

What would have happened if the allegedly defective algorithm had not been used?

Evidence may include:

• comparable applications;
• alternative scoring methods;
• historical decisions;
• human review;
• expert statistical analysis.

22. Multiple Causes

Algorithmic decisions may involve several causes.

For example:

Applicant's financial condition + incomplete data + algorithmic error + human decision-maker

The court may have to determine the significance of each factor.

This prevents simplistic reasoning such as:

“The algorithm produced the decision, therefore the algorithm caused all the damage.”

Causation must be established according to the applicable civil-law principles.

23. Algorithmic Decision Liability and Professional Negligence

Professionals increasingly use AI for:

• legal research;
• accounting;
• medical analysis;
• financial assessment;
• engineering;
• compliance.

A professional generally cannot avoid responsibility merely by saying:

“The AI told me to do it.”

If professional judgment was required, negligent reliance upon AI may itself become relevant.

Example

A lawyer uses an AI system to generate a critical procedural deadline.

The lawyer fails to independently verify it and misses the deadline.

The relevant legal question may concern the professional's own conduct and applicable professional duties—not whether the AI itself is a legal person.

24. AI Provider vs User

A particularly important issue is allocation of liability.

Example

A bank uses an external AI provider.

The algorithm makes an incorrect decision.

Potential questions include:

1. Did the AI vendor breach its contract?
2. Did the bank negligently rely upon the system?
3. Did the bank fail to supervise it?
4. Did the vendor conceal known defects?
5. Did both parties contribute to the harm?
6. Did the contract allocate responsibility?

Thus, a single harmful decision may potentially generate multiple legal relationships.

25. Contractual Allocation of Algorithmic Risk

Commercial contracts can reduce uncertainty by expressly addressing:

• accuracy standards;
• testing requirements;
• audit rights;
• data quality;
• security;
• compliance;
• human review;
• incident notification;
• indemnities;
• insurance;
• liability caps;
• intellectual property;
• confidentiality.

However, contractual limitations remain subject to applicable UAE law and cannot necessarily eliminate every legally imposed obligation.

26. Algorithmic Decision Liability in Employment

An employer might use AI to:

• shortlist applicants;
• rank employees;
• calculate performance;
• predict turnover;
• recommend termination.

Potential claims may involve:

• wrongful decision-making;
• contractual breaches;
• discriminatory treatment;
• inaccurate evaluation;
• reputational harm;
• economic loss.

The employer should therefore maintain adequate records explaining how consequential automated decisions were made.

27. Algorithmic Decision Liability in Banking

Banks can use algorithms for:

• credit scoring;
• fraud detection;
• AML-related risk assessment;
• transaction monitoring;
• customer classification.

Potential problems include:

• false positives;
• incorrect risk scores;
• account restrictions;
• unjustified financing rejection;
• incorrect customer classification.

A bank's reliance on an automated system does not necessarily eliminate its own responsibility to comply with applicable contractual, regulatory and civil obligations.

28. Algorithmic Decision Liability in Insurance

Insurance algorithms may determine:

• risk levels;
• premiums;
• underwriting outcomes;
• claim classifications.

Potential liability can arise where:

• the system uses inaccurate information;
• the insurer breaches contractual obligations;
• the algorithm generates an erroneous claim assessment;
• contractual or regulatory requirements are violated.

29. Algorithmic Decision Liability in Government

Government use of AI presents an additional dimension.

The relevant principles may include:

• legality;
• competence;
• procedural fairness;
• reasoning;
• proportionality;
• non-abuse of power;
• reviewability.

The jurisprudence in Administrative Cassation Nos. 212/2021 and 891/2019 is therefore especially relevant.

30. Algorithmic Decision Liability in Courts

AI may potentially assist with:

• document classification;
• legal research;
• transcription;
• translation;
• case management;
• evidence organisation.

However, the ultimate judicial function requires legally accountable decision-making.

The reasoning in Civil Cassation No. 647/2021 and the expert-evidence cases indicates why a court cannot simply delegate its legal reasoning to an unexplained algorithmic output.

31. Black-Box Algorithms

A black-box algorithm is a system whose decision-making process is difficult for users or affected persons to understand.

This creates problems concerning:

• proof;
• causation;
• explanation;
• expert examination;
• judicial review.

A claimant might know:

“My application was rejected.”

But not know:

“Which input caused the rejection?”

This information asymmetry can make litigation significantly more difficult.

32. Algorithmic Audit Trail

A strong governance system should preserve:

1. input data;
2. model version;
3. decision date;
4. algorithmic output;
5. human intervention;
6. final decision;
7. relevant system logs;
8. applicable decision rules.

This creates an evidentiary chain:

Input → Processing → Output → Human Review → Final Decision

Without such records, establishing causation may become substantially harder.

33. Standard of Care

The standard of care in algorithmic decision-making may depend on:

• nature of the decision;
• foreseeable risk;
• industry;
• sensitivity of data;
• potential harm;
• sophistication of the organisation;
• availability of safeguards;
• contractual commitments;
• applicable regulations.

A system used to recommend restaurant advertisements presents a different risk from one used to determine whether a person receives essential financial services.

34. Foreseeability

Foreseeability is particularly important.

If a company knows that:

• its AI has unusually high error rates;
• certain users are repeatedly affected;
• the model is outdated;
• complaints have been received;

continued reliance upon the system may create a stronger argument concerning fault.

Thus:

Known algorithmic failure + continued use + foreseeable harm = potentially stronger liability case.

35. Algorithmic Transparency

Transparency does not necessarily mean disclosure of every line of source code.

Rather, relevant transparency may include:

• purpose of the system;
• categories of data used;
• important decision factors;
• degree of human involvement;
• system limitations;
• reason for the decision;
• method for challenging an outcome.

The appropriate degree of disclosure depends upon the applicable law, confidentiality obligations and circumstances.

36. Algorithmic Liability and Damages

Potential damages can include, depending on the legal basis and proof:

Material damage

• financial loss;
• additional expenses;
• lost business;
• lost opportunity.

Other legally recognised damage

Depending on the applicable UAE civil rules and facts, claims may also involve non-economic harm where legally compensable.

Future damage

Where sufficiently established under the applicable legal requirements.

The claimant must distinguish genuine legally compensable loss from speculative economic expectations.

37. Defences

A defendant may argue:

Defence 1 — No algorithmic involvement

The algorithm only provided administrative assistance.

Defence 2 — Independent human decision

A human decision-maker independently evaluated the case.

Defence 3 — No fault

The system was properly designed, tested and monitored.

Defence 4 — No causation

The same decision would have occurred without the algorithm.

Defence 5 — No damage

The claimant cannot demonstrate legally compensable loss.

Defence 6 — Contractual allocation

The parties allocated particular risks contractually.

Defence 7 — External cause

The alleged loss resulted from an independent event.

38. Algorithmic Decision Liability vs Algorithmic Bias Liability

These should not be confused.

Algorithmic bias is therefore one important category of algorithmic decision liability, but not the whole field.

39. Eight Key UAE Cases at a Glance

40. Practical Compliance Framework for UAE Organisations

Organisations using AI for consequential decisions should consider implementing:

Before deployment

• algorithmic impact assessment;
• data-quality assessment;
• bias testing;
• validation;
• contractual risk allocation;
• security review.

During deployment

• human oversight;
• monitoring;
• audit logs;
• error tracking;
• complaint mechanisms;
• periodic testing.

After an adverse incident

• preserve system records;
• investigate the decision;
• identify the model version;
• examine relevant data;
• determine human involvement;
• assess causation;
• correct systemic problems.

41. Core Legal Formula

A useful framework for UAE algorithmic decision liability is:

Algorithmic system

↓

Automated recommendation/decision

↓

Human or organisational deployment

↓

Legal duty

↓

Breach/fault/unlawful conduct

↓

Causation

↓

Legally recognised damage

↓

Civil remedy

This demonstrates why the algorithm itself is not necessarily the final legal target.

42. Conclusion

UAE algorithmic decision liability is best understood as the application of established civil-law principles to new technological decision-making.

The absence of a single comprehensive “AI liability” statute does not mean that harmful automated decisions are legally unregulated. Existing principles concerning:

• fault;
• contractual obligations;
• professional responsibility;
• causation;
• damage;
• expert evidence;
• electronic evidence;
• administrative discretion;
• proportionality;
• reasoned decision-making; and
• right of defence

provide the foundation for analysing such claims.

The UAE case law discussed above particularly supports three propositions:

1. An algorithm cannot automatically replace human legal judgment.
2. Technical or expert evidence remains subject to judicial scrutiny and challenge.
3. A claimant must ultimately establish the legally relevant breach, causation and damage.

Therefore, the emerging UAE civil-law approach can be summarised as:

“Automated decision-making may be technologically autonomous, but legal responsibility remains attributable to the persons and entities that design, supply, deploy, control, supervise, or rely upon the system.”