Civil Law and UAE Liability in Platform-Mediated Economic Ecosystems

1. Introduction

A platform-mediated economic ecosystem is an economic arrangement in which a digital platform connects or coordinates several participants rather than simply selling its own goods or services.

Examples include:

• e-commerce marketplaces;
• food-delivery and logistics platforms;
• ride-hailing platforms;
• digital-payment platforms;
• property and accommodation platforms;
• fintech marketplaces;
• cryptoasset platforms;
• online freelance/gig platforms;
• software-as-a-service ecosystems;
• app stores and digital-content platforms;
• AI-enabled marketplaces.

The difficult legal question is who should bear liability when harm occurs inside such an ecosystem.

A transaction may involve:

Customer → Platform → Seller/Service Provider → Payment Provider → Delivery Provider → Cloud/Technology Provider → AI system.

The platform may argue that it is merely an intermediary, while the consumer may argue that the platform controlled the transaction, collected payment, made representations, selected providers, or created the conditions that caused the loss.

UAE law increasingly addresses these relationships through civil obligations, consumer protection, electronic transactions, sector-specific regulation, and specialised digital-economy dispute mechanisms.

The current Federal Civil Transactions Law is Federal Decree by Law No. 25 of 2025, which repealed the 1985 Civil Transactions Law and entered into force on 1 June 2026.

2. Meaning of Platform-Mediated Liability

Platform-mediated liability concerns the allocation of legal responsibility among participants where the platform organises, facilitates, controls, processes, or materially influences an economic transaction.

The central question is not simply:

“Who technically performed the act?”

It is:

Who had the legal duty, contractual responsibility, authority, control, or legally relevant relationship connected with the loss?

This requires examining several relationships simultaneously:

1. Platform–customer
2. Platform–merchant
3. Platform–worker/service provider
4. Platform–payment provider
5. Platform–delivery provider
6. Platform–technology provider
7. Platform–advertiser
8. Platform–regulator
9. Customer–merchant
10. Customer–third-party provider

Thus, one harmful event can potentially generate multiple independent causes of action.

3. UAE Legal Framework

A. Civil Transactions Law

The new Civil Transactions Law provides the general civil-law framework for contractual and non-contractual obligations.

Its Article 1 establishes a hierarchy under which applicable legislation governs matters expressly or implicitly addressed; where legislation does not provide an answer, the law refers successively to Sharia principles, custom where appropriate, and then principles of natural law and justice. Article 2 provides for the use of principles of Islamic jurisprudence in interpreting legislative texts.

For platforms, this framework is important because platform relationships frequently involve contracts that are:

• standardised;
• digitally accepted;
• multi-party;
• continuously modified;
• partly automated.

B. Electronic Transactions and Trust Services

Electronic transactions legislation is particularly important because platforms frequently use:

• click-wrap agreements;
• electronic signatures;
• automated contracting;
• electronic records;
• automated payment systems;
• digital authentication.

UAE Federal Decree-Law No. 46 of 2021 recognises automated electronic systems and provides rules for attribution of electronic documents generated through such systems.

Therefore, a platform generally cannot avoid legal consequences merely because an action was performed electronically or automatically.

4. Consumer Protection and Platforms

The UAE consumer-protection framework is particularly significant.

Cabinet Resolution No. 66 of 2023, implementing Federal Law No. 15 of 2020 on Consumer Protection, expressly addresses e-commerce. Importantly, the regulations provide that an e-commerce provider can bear responsibility for defects in goods supplied through a third party using its electronic platform.

This is important because it limits the effectiveness of a simplistic:

“We are only a platform.”

argument.

Where legislation imposes responsibility on the platform/provider, the contractual description of the platform as an intermediary cannot automatically eliminate statutory responsibility.

5. Contractual Liability of Platforms

A platform's first potential source of liability is its own contract.

A platform may have contractual obligations relating to:

• payment processing;
• delivery;
• refunds;
• account security;
• data handling;
• dispute resolution;
• verification;
• escrow/custody;
• marketplace operation;
• quality standards;
• fraud prevention.

The court therefore examines the actual contractual allocation of functions and risk, rather than merely the platform's marketing description.

6. Negligence and Duty of Care

A platform may also face non-contractual liability where its conduct causes foreseeable harm.

Relevant questions include:

1. Was there a duty?

For example, did the platform undertake to:

• safeguard money?
• verify a provider?
• maintain a secure payment system?
• prevent unauthorised access?
• control delivery?
• supervise an intermediary?

2. Was the duty breached?

Examples include:

• inadequate security;
• negligent verification;
• failure to implement promised safeguards;
• negligent handling of customer funds;
• failure to perform an expressly assumed intermediary function.

3. Did the breach cause the loss?

The claimant must connect the platform's conduct with the actual damage.

The DIFC Law of Obligations illustrates this analytical structure: negligence requires a duty of care, breach, and causation of loss, with reduction for contributory negligence.

7. Agency and Apparent Authority

Platform ecosystems frequently resemble agency structures.

For example:

Platform → merchant → customer

or:

Platform → delivery agent → customer.

The legal issue becomes whether the platform:

• authorised the intermediary;
• represented that the intermediary was acting on its behalf;
• exercised sufficient control;
• created a reasonable appearance of authority.

This is particularly important where the customer deals principally with the platform rather than directly with the underlying provider.

8. Vicarious Liability

Vicarious liability may arise where the legally required relationship exists between the responsible organisation and the person committing the relevant wrong.

However, it should not automatically be assumed merely because a person or company is economically connected to the platform.

For example, in Emirates NBD Bank PJSC & Others v Advanced Facilities Management LLC & Others, the DIFC Court rejected a vicarious-liability argument where there was insufficient basis for the required relationship and connection.

Thus:

Economic association ≠ automatic vicarious liability.

The court examines the actual legal relationship.

9. Platform as Intermediary

An important modern question is whether an intermediary is merely a conduit or has assumed substantive responsibility.

The Gate Mena/Huobi v Tabarak litigation is particularly useful.

The dispute concerned Tabarak's role as an intermediary in a cryptocurrency transaction involving 300 BTC. The DIFC Court examined the functions Tabarak actually undertook, including custody and control of the cryptocurrency and its role in preventing transfer until payment.

The case demonstrates an important principle for platform ecosystems:

An intermediary's legal responsibility may depend upon the functions it actually undertakes, not simply the label “intermediary.”

An entity accepting custody, control, verification, payment, or transaction-management responsibilities may assume significantly greater legal obligations than a passive information provider.

10. Six Important Case Laws

Case 1 — Gate Mena DMCC v Tabarak Investment Capital Ltd

Gate Mena DMCC (formerly Huobi OTC DMCC) & Huobi Mena FZE v Tabarak Investment Capital Ltd & Christian Thurner

DIFC Digital Economy Court / Court of Appeal

This is highly relevant to platform-mediated digital transactions.

Tabarak acted as an intermediary in a cryptocurrency transaction. The dispute required the court to examine what responsibilities the intermediary had actually undertaken.

The court considered factors including:

• control of cryptocurrency;
• custody arrangements;
• transaction execution;
• communications between participants;
• payment arrangements;
• the intermediary's undertaking.

The Digital Economy Court subsequently analysed whether Tabarak had assumed a contractual obligation to achieve a particular result or merely an obligation to exercise reasonable care.

Principle

An intermediary may acquire substantive contractual obligations when its actual conduct goes beyond merely introducing the parties.

Platform relevance

A platform that:

• controls customer funds;
• holds digital assets;
• manages the transaction;
• controls access;
• makes assurances concerning security;

may face obligations substantially different from those of a passive advertising platform.

Case 2 — Nisan v Neysa

Nisan v Neysa [2024] DIFC SCT 174

This case directly involved an online marketplace.

The claimant was a seller registered on the defendant's online marketplace. The marketplace had onboarding procedures and required sellers to accept a Business Service Agreement containing contractual provisions concerning the relationship and dispute resolution.

The court ultimately focused on jurisdiction, rather than determining substantive platform liability.

Principle

A platform's contractual relationship with marketplace participants matters independently of the underlying customer transaction.

Platform relevance

Platforms should clearly establish:

• who is contracting with whom;
• applicable terms;
• governing law;
• dispute resolution;
• jurisdiction;
• role of the platform;
• responsibilities of sellers.

This is particularly important where sellers and customers are located in different emirates or jurisdictions.

Case 3 — Najjar v Nazira

Najjar v Nazira [2024] DIFC SCT 256

The dispute involved digital-payment services. The claimant alleged that it used the defendant's digital-payment services while believing that the defendant was properly licensed and regulated. The claim included requests for cessation of activities and compensation.

Principle

Digital-payment platforms operate within a regulatory environment in which questions of:

• licensing;
• authorisation;
• customer reliance;
• regulatory status;
• jurisdiction;

can become legally significant.

Platform relevance

A platform cannot necessarily treat regulatory status as irrelevant to its civil exposure where customers rely upon its representations or regulatory position.

Case 4 — AES Middle East Insurance Broker LLC v GSB Capital Ltd

AES Middle East Insurance Broker LLC & Others v GSB Capital Ltd [2023] DIFC CFI 060

This case examined claims involving employees, confidential information, contractual obligations and alleged vicarious liability.

The Court explained that vicarious liability cannot simply be asserted without establishing the applicable legal basis. It also distinguished contractual breaches from tortious liability.

Principle

A company does not become automatically liable for every wrongful act connected economically with it.

Platform relevance

This is important in ecosystems involving:

• independent contractors;
• marketplace sellers;
• outsourced service providers;
• technology vendors;
• delivery companies.

A platform must be distinguished from its independent ecosystem participants unless the legal requirements for attribution are established.

Case 5 — Emirates NBD Bank PJSC v Advanced Facilities Management LLC

Emirates NBD Bank PJSC & Others v Advanced Facilities Management LLC & Others [2022] DIFC CA 012

The dispute involved agency and vicarious-liability allegations.

The Court emphasised that there must be a proper factual and legal basis for an agency relationship and that simply pleading vicarious liability is insufficient.

Principle

Liability attribution requires evidence of the relevant legal relationship.

Platform relevance

A platform cannot automatically be liable merely because:

• it introduced the parties;
• processed the transaction;
• earned commission;
• provided software;
• hosted the seller.

The exact degree of control and responsibility remains important.

Case 6 — Haya Spa LLC v Harper Real Estate / Hasan Real Estate

Haya Spa LLC v Harper Real Estate / Hasan Real Estate [2016] DIFC SCT 150

The case involved a landlord and its appointed agent. The court proceeded on the basis that vicarious and joint-and-several liability applied in the circumstances, particularly because the relevant individual was an authorised agent acting in the relevant business context.

Principle

Where an authorised agent performs functions within the relevant relationship, responsibility may extend beyond the individual actor.

Platform relevance

This provides an analogy for platform ecosystems where the platform appoints or controls service providers to perform functions central to the platform's business.

Case 7 — Al Khorafi v Bank Sarasin-Alpen

Rafed Abdel Mohsen Bader Al Khorafi v Bank Sarasin-Alpen (ME) Ltd [2011] DIFC CA 003

The case involved allegations concerning agency, misrepresentation, negligence and vicarious liability between entities operating within a financial-services structure.

Principle

Where separate corporate entities operate within a common commercial structure, liability depends on the legally established relationship rather than merely their economic association.

Platform relevance

This is particularly relevant to:

• platform groups;
• parent companies;
• subsidiaries;
• payment affiliates;
• technology affiliates;
• marketplace operators.

Case 8 — Khaled Salem Musabeh Humad Al Mheiri v John Cameron

Al Mheiri v Cameron [2025] DIFC CA 008

The case involved questions concerning agency, apparent authority and attribution of conduct to a principal.

The Court considered UAE-law concepts concerning when conduct of an agent may affect a principal, including the circumstances creating an appearance of authority.

Principle

The legal consequences of an intermediary's conduct may depend upon:

• actual authority;
• apparent authority;
• the principal's conduct;
• the third party's reasonable reliance;
• the relationship between the actor and principal.

Platform relevance

If a platform presents a merchant, driver, adviser, agent, or service provider as part of its controlled commercial system, questions of apparent authority can become important.

11. The Platform's Degree of Control

A useful UAE liability analysis is to classify platforms according to their degree of involvement.

The more functions a platform assumes, the more complex the attribution analysis becomes.

12. Consumer Protection Creates an Important Exception

The distinction between:

“seller”

and

“platform”

cannot always determine liability.

The UAE consumer-protection regulations expressly contemplate responsibility for defects in goods provided through third parties using an electronic platform.

Therefore, a platform's contractual disclaimer must be examined alongside mandatory statutory obligations.

This is especially important where the platform:

• controls payment;
• controls product presentation;
• handles complaints;
• provides warranties;
• selects sellers;
• controls fulfilment;
• makes quality representations.

13. Platform Terms and Exclusion Clauses

Platform agreements commonly contain provisions such as:

• limitation of liability;
• indemnity;
• disclaimer;
• arbitration;
• governing-law clause;
• maximum compensation;
• force majeure;
• third-party-provider disclaimer.

Their effectiveness depends upon applicable law.

A contractual clause cannot necessarily defeat:

• mandatory statutory provisions;
• public policy;
• consumer protections;
• liability for legally non-excludable conduct.

The recent Al Mheiri v Cameron judgment, for example, discusses the limits of contractual exclusions where mandatory legal rules and criminal conduct are involved.

14. Platform Liability for Third-Party Providers

Consider a food-delivery platform.

The ecosystem may contain:

Customer → Food Platform → Restaurant → Delivery Partner → Payment Provider

Suppose the customer suffers loss.

Potential questions include:

Restaurant

Was the food defective?

Delivery partner

Was the food damaged through negligent delivery?

Platform

Did it undertake responsibility for:

• selecting the restaurant?
• payment?
• delivery?
• customer support?
• refunds?
• food safety assurances?

Payment provider

Was the payment transaction incorrectly processed?

The court therefore needs to disaggregate the ecosystem rather than automatically assign all liability to one participant.

15. Platform Liability for Digital Payments

Digital-payment platforms create additional risks:

• unauthorised transactions;
• fraudulent accounts;
• mistaken transfers;
• cybersecurity failures;
• account takeover;
• regulatory non-compliance;
• payment delays.

Nazira demonstrates how questions concerning digital-payment services, licensing and customer reliance can reach the courts.

A platform's responsibility may therefore depend upon the precise service it promised to provide.

16. Platform Liability for Cryptocurrency and Digital Assets

Digital assets create an even more complicated ecosystem:

Investor → Exchange → Custodian → Wallet → Blockchain → Smart contract.

The DIFC Digital Economy Court expressly covers disputes involving:

• digital assets;
• blockchain;
• fintech;
• AI;
• cloud systems;
• e-commerce;
• online intermediaries;
• digital-payment platforms;
• marketplaces. 

This specialised jurisdiction is particularly important for platform-mediated economic disputes.

17. Digital Economy Court

The DIFC's Part 58 rules provide a dedicated procedural framework for Digital Economy Court claims.

The rules expressly cover e-commerce, online intermediaries, digital-payment platforms and marketplaces. They also contain special procedures for consumer digital-economy claims.

This reflects a major development in UAE civil justice:

Digital economic ecosystems are increasingly being treated as a distinct category of civil dispute.

18. AI and Automated Platform Liability

AI can introduce additional layers:

Platform owner → AI model → automated decision → seller/customer → economic loss.

Potential questions include:

• Who selected the AI system?
• Who trained or configured it?
• Who monitored it?
• Who had authority to override it?
• Was the AI used for pricing?
• Did it reject a customer?
• Did it generate a false representation?
• Did it incorrectly classify a transaction?
• Did it trigger an automated payment?

The fact that an algorithm made the decision does not itself answer the legal question of attribution.

The liability analysis must identify the legally responsible person or entity behind the system.

19. Multi-Level Attribution Model

For a platform ecosystem, liability can be analysed through six levels.

Level 1 — Direct conduct

Who actually performed the wrongful act?

Level 2 — Contract

Who promised to perform the relevant service?

Level 3 — Agency

Was the actor authorised to act for another?

Level 4 — Control

Who controlled the relevant activity?

Level 5 — Causation

Whose act or omission legally caused the loss?

Level 6 — Statutory responsibility

Does legislation expressly place responsibility on a particular participant?

This produces a more accurate model than simply asking:

“Who owns the platform?”

20. Joint Liability and Multiple Defendants

A platform dispute can involve several potentially responsible parties.

For example:

Platform + merchant + delivery company + payment processor.

The claimant may need to establish separate legal grounds against each defendant.

The existence of multiple participants does not automatically mean that liability is joint and several. The applicable legal basis and facts must establish the necessary connection.

21. Evidence in Platform Liability Cases

Evidence is particularly important because platforms control substantial quantities of digital information.

Important evidence includes:

• platform terms;
• click-wrap records;
• transaction logs;
• payment records;
• IP information;
• device identifiers;
• access logs;
• customer communications;
• internal policies;
• seller onboarding records;
• algorithmic decision logs;
• AI audit trails;
• delivery records;
• complaints;
• refund records;
• cybersecurity records.

A platform may therefore face evidentiary issues concerning both what happened and who controlled what happened.

22. Contractual Allocation of Risk

A sophisticated platform agreement may allocate risk through:

1. indemnities;
2. insurance;
3. limitation clauses;
4. warranties;
5. representations;
6. service-level agreements;
7. escrow arrangements;
8. security requirements;
9. audit rights;
10. termination rights.

But contractual allocation between platform participants does not necessarily determine the rights of third parties or consumers.

For example:

Platform and merchant agree that merchant bears all liability.

That agreement may allocate risk between them, but it does not necessarily eliminate a statutory duty owed by the platform to a consumer.

23. “Platform” Is Not a Single Legal Category

One of the most important conclusions is that platform status by itself does not determine liability.

A platform may be:

• a marketplace;
• agent;
• payment intermediary;
• service provider;
• technology provider;
• custodian;
• broker;
• advertiser;
• logistics coordinator;
• regulated financial entity.

The legal consequences depend upon the functions actually performed and the legal duties arising from those functions.

24. Mainland UAE vs DIFC/ADGM

This distinction is essential.

Mainland UAE

The analysis primarily involves:

• Federal Civil Transactions Law;
• Consumer Protection legislation;
• Electronic Transactions legislation;
• applicable commercial legislation;
• sector-specific regulation;
• federal procedural/evidentiary rules.

DIFC

The DIFC has its own legal framework and has developed a specialised Digital Economy Court framework covering online intermediaries, marketplaces, fintech and digital assets.

ADGM

ADGM has its own courts and legal framework, including English common-law principles.

Therefore, a DIFC decision should not automatically be treated as binding precedent for a mainland UAE court. It is particularly useful as an illustration of how UAE-based digital commercial disputes are being analysed.

25. Practical Examples

Example 1 — E-commerce

A customer buys a defective phone through an online marketplace.

Possible questions:

• Who sold it?
• Who imported it?
• Who displayed the product?
• Who collected payment?
• Who promised the warranty?
• Did the platform fall within statutory e-commerce responsibilities?

Example 2 — Ride-Hailing

A passenger suffers injury.

Potential issues:

• driver negligence;
• driver's employment/agency status;
• platform's contractual role;
• vehicle ownership;
• insurance;
• platform's representations;
• statutory obligations.

Example 3 — Food Delivery

Food arrives contaminated.

Potential defendants may include:

• restaurant;
• delivery provider;
• platform.

The precise contractual and statutory roles determine responsibility.

Example 4 — Crypto Platform

A customer transfers cryptocurrency to an intermediary.

The intermediary loses control of the asset.

Questions include:

• Was the intermediary a custodian?
• Was it merely an introducer?
• Did it assume responsibility for safeguarding the asset?
• Did it control the wallet?
• Was the transfer authorised?
• What contractual standard applied?

The Gate Mena v Tabarak litigation illustrates the importance of analysing the intermediary's actual functions.

26. Key Legal Principles

The UAE platform-liability framework can therefore be reduced to these principles:

1. Platform status alone does not determine liability.
2. Actual functions are more important than labels.
3. Contracts are central to allocation of responsibility.
4. Mandatory consumer legislation may override purely contractual allocation.
5. Agency requires a legally sufficient relationship.
6. Vicarious liability requires the appropriate legal relationship and connection.
7. An intermediary may assume substantive responsibility through its conduct.
8. Control over money or digital assets can materially increase responsibility.
9. Regulated platforms may face additional statutory obligations.
10. Digital evidence is critical to attribution.
11. Automated decision-making does not eliminate human/entity responsibility.
12. DIFC digital-economy jurisprudence must be distinguished from mainland UAE law.

27. Exam-Oriented Case Law Revision Table

28. Conclusion

Liability in UAE platform-mediated economic ecosystems is fundamentally an attribution problem.

The modern digital transaction is rarely performed by one actor. It may involve a platform, merchant, payment processor, logistics provider, technology vendor, AI system and consumer simultaneously.

UAE law therefore requires analysis of:

contract + statutory responsibility + agency + control + duty of care + causation + consumer protection + evidence.

The most important modern development is that digital intermediaries are increasingly being treated according to their actual economic and legal functions, rather than simply according to the label “platform.”

The UAE's specialised Digital Economy Court framework reinforces this development by expressly covering e-commerce, online intermediaries, digital-payment platforms, marketplaces, AI, blockchain and digital assets.

Short exam answer

Platform-mediated liability in UAE civil law concerns the allocation of responsibility among platforms, consumers, merchants, agents, payment providers and other participants in digitally coordinated transactions. Liability depends upon the contractual relationship, statutory duties, actual authority, apparent authority, control, negligence, causation and applicable consumer-protection rules. A platform cannot automatically escape responsibility merely by describing itself as an intermediary, particularly where legislation or its own conduct imposes substantive obligations. At the same time, economic association alone does not create vicarious liability. UAE and DIFC authorities such as Gate Mena v Tabarak, Nisan v Neysa, Najjar v Nazira, AES v GSB Capital, Emirates NBD v Advanced Facilities, Haya Spa v Harper/Hasan, Al Khorafi v Bank Sarasin-Alpen and Al Mheiri v Cameron demonstrate different aspects of contractual, agency, intermediary, regulatory and vicarious-liability attribution.