Civil Law and UAE Smart Infrastructure Failure Liability

1. Introduction

Smart infrastructure means physical infrastructure that uses digital technology, sensors, software, networks, artificial intelligence, automated decision-making or connected devices to operate or manage services.

Examples include:

smart traffic lights;

intelligent transport systems;

automated parking systems;

smart electricity grids;

connected water systems;

smart buildings;

automated elevators;

digital surveillance infrastructure;

intelligent waste-management systems;

autonomous infrastructure-control systems;

IoT-based environmental monitoring;

AI-controlled public utilities.

Smart infrastructure failure liability concerns the legal responsibility arising when such infrastructure malfunctions and causes:

personal injury;

property damage;

economic loss;

service interruption;

environmental damage;

business interruption;

data-related loss;

contractual loss.

The central legal question is:

Who legally bears responsibility when an interconnected technological infrastructure system fails and causes damage?

Under the current UAE mainland civil-law framework, the starting point is the Federal Decree by Law No. 25 of 2025 promulgating the Civil Transactions Law, which came into force on 1 June 2026. Its harmful-act provisions are now principally found in Articles 245–258. Article 246 establishes the general rule that an act causing harm gives rise to compensation, while Article 247 distinguishes direct harm from harm caused through causation. (UAE Legislation)

For smart infrastructure, however, civil liability may also arise from contract, construction obligations, professional negligence, defective products, maintenance failures, cybersecurity failures, employment relationships and special regulatory legislation.

2. Meaning of Smart Infrastructure Failure

A smart infrastructure failure occurs when an infrastructure system does not perform its intended function because of a:

hardware failure;

software defect;

programming error;

sensor malfunction;

communication failure;

cybersecurity incident;

incorrect data;

AI decision error;

maintenance failure;

human error;

defective component;

inadequate system design;

interoperability problem;

power or network failure;

failure of an automated control system.

Example

A smart traffic-management system incorrectly detects congestion and changes traffic signals.

The resulting sequence causes an accident.

The legal investigation might ask:

Was the accident caused by:

defective software?

incorrect sensor data?

negligent maintenance?

inadequate testing?

a cyberattack?

an unforeseeable power failure?

incorrect human intervention?

This is fundamentally a causation and allocation-of-responsibility problem.

3. Basic Liability Formula

A useful examination formula is:

Infrastructure Duty → Failure/Breach → Damage → Causation → Attribution → Liability → Compensation

For a smart system:

Design/Operation/Maintenance Failure → System Malfunction → Physical/Economic Harm → Causal Link → Responsible Person/Entity → Civil Liability → Remedy

The claimant normally has to establish the legally relevant elements applicable to the particular cause of action.

4. Current UAE Civil-Law Foundation

Article 245 — Scope of Harmful-Act Liability

The current Civil Transactions Law states that, subject to special legislation, the harmful-act provisions apply to liability arising from a harmful act committed by a natural or legal person. (UAE Legislation)

This is important because smart infrastructure is frequently operated by companies and other legal persons, not merely individuals.

Article 246 — General Compensation Principle

Article 246 provides that an act causing harm to another obliges its perpetrator to compensate for the damage, even where the perpetrator lacks discernment. (UAE Legislation)

Therefore, the basic civil-law inquiry is:

Harm → Responsible conduct → Legal causation → Compensation

Article 247 — Direct and Causal Harm

Article 247 expressly distinguishes:

direct harm, and

harm occurring through causation.

The provision also deals with situations where direct conduct and causal conduct combine. (UAE Legislation)

This distinction is particularly useful for smart infrastructure.

Example

A contractor installs defective traffic sensors.

The sensor gives incorrect data.

The traffic-control AI changes the signals.

A vehicle crashes.

The legal chain could be:

Defective sensor → incorrect data → AI decision → traffic alteration → accident

The court must determine which event legally caused the damage and which persons or entities are responsible.

5. Who Can Be Liable?

Smart infrastructure normally involves several participants.

1. Infrastructure owner

For example:

government entity;

utility company;

property developer;

transport operator.

2. Designer

The designer may be responsible for:

unsafe system architecture;

inadequate specifications;

failure to anticipate foreseeable risks.

3. Contractor

The contractor may be responsible for:

defective installation;

failure to follow specifications;

poor workmanship;

failure to test systems.

4. Software developer

Potential responsibility may arise from:

coding defects;

inadequate testing;

security vulnerabilities;

failure to implement agreed functionality.

5. Hardware manufacturer

Potential issues include:

defective sensors;

defective controllers;

defective networking equipment;

defective safety mechanisms.

6. Maintenance provider

Liability may arise from:

missed inspections;

incorrect maintenance;

failure to update software;

failure to replace defective components.

7. Cybersecurity provider

Questions may arise concerning:

inadequate security;

failure to detect attacks;

failure to respond appropriately.

8. Operator

An operator may be responsible for:

incorrect configuration;

failure to respond to warnings;

improper human intervention.

6. Contractual Liability

Many smart infrastructure projects are based on contracts.

For example:

Government Entity → Main Contractor → Technology Supplier → Software Developer → Maintenance Provider

The contract may contain:

performance specifications;

safety requirements;

service levels;

uptime obligations;

cybersecurity requirements;

maintenance obligations;

testing requirements;

warranties;

indemnities;

limitation-of-liability clauses.

A failure may therefore constitute a breach of contract, even if it does not independently constitute a harmful act.

7. Tort/Harmful-Act Liability

A claimant may also have a civil claim where infrastructure failure causes damage independently of a contractual relationship.

Examples:

a smart elevator injures a visitor;

an automated gate damages a vehicle;

a defective traffic system causes an accident;

an intelligent electrical system causes a fire.

The current Civil Transactions Law's harmful-act provisions provide the general framework for such claims. (UAE Legislation)

8. Duty of Care

For technological infrastructure, the relevant duty may involve taking reasonable precautions against foreseeable harm.

Examples:

Smart elevator

The operator should reasonably maintain:

sensors;

emergency brakes;

door controls;

software;

monitoring systems.

Smart road system

The responsible entity may need to consider:

sensor accuracy;

signal reliability;

emergency overrides;

software updates;

communication failures.

Smart electricity system

Relevant safeguards may include:

overload protection;

cybersecurity;

redundancy;

monitoring;

emergency shutdown.

9. Failure of Design

Design failure is different from operational failure.

Design failure

The infrastructure was fundamentally designed in an unsafe or inadequate manner.

Operational failure

The design may have been adequate, but the system was improperly operated.

Maintenance failure

The system was originally safe but became unsafe because maintenance was inadequate.

This distinction matters because different parties may be responsible.

10. Software Failure

Software is increasingly part of physical infrastructure.

Suppose an automated water-management system contains a programming error that causes a valve to remain open.

The resulting flooding damages nearby property.

Potential questions include:

Was the software defective?

Did the developer breach a contractual specification?

Was adequate testing performed?

Was the error foreseeable?

Did the operator ignore warnings?

Was the software updated?

Did a third-party system cause the failure?

A software defect may therefore become a physical infrastructure liability issue.

11. AI Failure

AI-controlled infrastructure introduces another level of complexity.

Suppose AI controls traffic signals.

The AI receives incorrect sensor data.

It then makes a technically consistent but unsafe decision.

The legal inquiry cannot stop at:

"The AI made the decision."

The court may need to examine:

Who designed the AI?

Who trained it?

Who selected the data?

Who deployed it?

Who monitored it?

Were safety limits programmed?

Was human intervention available?

Was the decision foreseeable?

Which failure actually caused the damage?

12. Sensor Failure

Sensors are critical to smart infrastructure.

A sensor may:

give a false reading;

stop transmitting;

transmit delayed information;

be incorrectly calibrated;

be hacked;

become physically damaged.

The legal causal chain may be:

Sensor defect → false data → automated decision → infrastructure malfunction → damage

A claimant must connect the sensor failure to the actual loss rather than merely showing that a sensor was defective.

13. Cyberattack and Smart Infrastructure

Cybersecurity is especially important.

Imagine a hacker enters a smart-city control network and changes:

traffic lights;

water valves;

building controls;

electricity distribution;

railway signalling.

The infrastructure owner may argue:

"The damage was caused by a third-party hacker."

The legal question then becomes whether the external attack:

was foreseeable;

was preventable;

was caused partly by inadequate security;

constitutes an external cause;

breaks the causal chain;

triggers contractual cybersecurity obligations.

Thus, cybersecurity can become a civil-liability issue, not merely a criminal-law issue.

14. Causation

Causation is usually the most difficult issue in complex infrastructure litigation.

The court must distinguish:

Factual causation

Would the damage have occurred without the defendant's failure?

Legal causation

Is the connection sufficiently close for the law to impose responsibility?

Intervening cause

Did another event interrupt the causal chain?

Multiple causes

Did several failures combine to cause the damage?

15. Haya Spa LLC v Harper Real Estate / Hasan Real Estate

[2016] DIFC SCT 150

This is a particularly useful UAE-based authority for causation.

The DIFC Court applied a "but-for" and "substantial cause" analysis. It also considered whether a supervening event had broken the causal connection. The Court found that, for the relevant period, the defendants' conduct was both a "but-for" and substantial cause of the claimant's losses. (DIFC Courts)

Relevance to smart infrastructure

Suppose:

Defective smart-system design → system malfunction → business interruption.

The court could ask:

Would the loss have occurred without the defective system?

Then:

Was the defect a substantial cause of the loss?

And:

Did another event later break the causal chain?

This is highly relevant to interconnected infrastructure.

16. Dubai Commercial Appeal 445/2020/1034

The principle reproduced in BAM Higgs & Hill v Affan Innovative Structures states that civil liability requires:

fault;

damage; and

causal connection.

The decision also recognised possible intervening factors such as force majeure, an external cause, creditor fault or a third party's act. (DIFC Courts)

Smart infrastructure application

If a smart infrastructure system fails because of:

Contractor negligence + cyberattack + operator error

the court may have to determine how each factor contributed to the damage.

17. Graciela Limited v Giacobbe

[2014] DIFC CFI 027

This case involved deliberate interference with an IT system.

A former employee was found responsible for sabotaging the claimant's IT system. The Court treated the conduct as wrongful interference with property and awarded compensatory damages for restoration, investigation, emergency servers and related employee time. (DIFC Courts)

Importance

The case demonstrates that digital infrastructure can itself become the subject of civil liability.

The technological nature of the property did not prevent the court from identifying:

wrongful interference;

damage;

causation;

compensation.

For smart infrastructure, this is particularly relevant to:

smart-building systems;

control networks;

data infrastructure;

connected devices;

operational technology.

18. Panther Real Estate Development LLC v Modern Executive Systems Contracting LLC

[2022] DIFC CA 016

This construction dispute concerned delay, contractual obligations and project completion.

The Court of Appeal emphasised that the cause of delay remains the underlying act or default, while failure to follow a contractual notice requirement may affect the contractual remedy available for that delay. (DIFC Courts)

The earlier proceedings also concerned defective works, completion costs and losses allegedly resulting from delay. (DIFC Courts)

Smart infrastructure relevance

Smart infrastructure is frequently embedded within major construction projects.

Examples:

smart buildings;

intelligent transport systems;

automated warehouses;

digital utility networks.

A contractor cannot necessarily avoid responsibility simply because a project also involves software or automated systems.

The court can separate:

technical failure → contractual breach → actual delay/damage → recoverable loss.

19. BAM Higgs & Hill LLC v Affan Innovative Structures LLC

[2021] DIFC CFI 106

This construction dispute is highly relevant to infrastructure liability.

The Court stressed that breach alone is insufficient to establish compensation; the claimant must establish the relevant elements of liability and prove the damage claimed. The judgment also referred to UAE jurisprudence requiring fault, damage and causal connection. (DIFC Courts)

A September 2026 DIFC order records that the Court had dismissed BAM's claims in the February 2026 judgment and subsequently refused permission to appeal in September 2026. (DIFC Courts)

Smart infrastructure relevance

A smart-infrastructure claimant therefore should not simply establish:

"The system was defective."

It must connect the defect to a legally recoverable loss.

20. Larmag Holding B.V. v First Abu Dhabi Bank & Others

[2019] DIFC CFI 054

Larmag is useful for the UAE civil-law treatment of harmful conduct and damages.

The judgment discussed the UAE Civil Code's harmful-act framework and explained the traditional three elements of liability:

harmful conduct + damage + causal relationship.

The Court also discussed the identification and quantification of actionable loss. (DIFC Courts)

Smart infrastructure relevance

The principle can be applied to technological infrastructure:

System failure → actual harm → causal connection → compensation.

It prevents the claimant from treating technological malfunction itself as sufficient proof of unlimited liability.

21. Globemed Gulf Healthcare Solutions LLC v Oman Insurance Company PSC

[2017] DIFC CFI 051

Globemed is relevant to the assessment of future and economic loss.

The Court examined UAE-law principles concerning the certainty or inevitability of future loss and distinguished the question of whether a loss is actionable from the question of how the loss should be remedied. (DIFC Courts)

The later quantum proceedings involved expert evidence and assessment of the parties' competing calculations. (DIFC Courts)

Smart infrastructure relevance

Suppose failure of a smart-city system causes:

immediate repair costs;

business interruption;

lost future revenue;

reputational loss.

The claimant must distinguish actual/provable loss from speculative future losses.

22. Faizal Babu Moorkath v Expresso Telecom Group Ltd

[2023] DIFC CFI 008

The case concerned alleged negligence and an economic-loss counterclaim.

The Court explained that negligence requires:

duty of care;

breach;

causation of loss.

It also stressed that actionable loss must be established before a negligence claim can succeed. The counterclaim for AED 7,356,500 was dismissed. (DIFC Courts)

Smart infrastructure relevance

This is particularly important where infrastructure failure produces pure economic loss rather than physical injury.

For example:

Smart traffic system failure → traffic disruption → business loses customers.

The claimant may need to establish the legal basis for the duty and prove actionable loss.

23. Summary of the Case Authorities

These are primarily DIFC authorities or UAE cases discussed within DIFC proceedings. They should not be treated as automatically binding precedents for every mainland UAE court.

24. Multiple-Cause Infrastructure Failure

Smart infrastructure rarely fails because of one event.

Consider:

Poor software + defective sensor + inadequate maintenance + cyberattack

all contributing to a failure.

The court may need to identify:

each contributing event;

each responsible party;

whether each event was legally significant;

whether one event superseded another;

whether the claimant contributed to the damage.

The current Civil Transactions Law expressly addresses causation and external causes within its harmful-act provisions. (UAE Legislation)

25. Force Majeure and External Causes

An infrastructure operator may argue that the failure resulted from an external event such as:

extraordinary natural disaster;

unexpected network failure;

third-party attack;

extraordinary power interruption;

government action.

But the existence of an external event does not automatically eliminate liability.

The relevant questions include:

Was the event genuinely external?

Was it foreseeable?

Could reasonable safeguards have prevented the damage?

Was the system adequately maintained?

Did another negligent act contribute?

Does the contract allocate the risk differently?

26. Human Override Failure

Smart infrastructure is not always fully autonomous.

Many systems provide a human override.

Example:

AI-controlled railway signalling detects an abnormal condition.

An operator receives an alert but does nothing.

An accident follows.

Potential responsibility may therefore exist at multiple levels:

Software → Operator → Infrastructure owner → Maintenance provider

The existence of automation does not automatically eliminate human responsibility.

27. Failure to Update Software

A smart infrastructure system may be safe when installed but become vulnerable because its software is not updated.

Examples:

cybersecurity vulnerability remains unpatched;

outdated operating system;

obsolete encryption;

unsupported software;

outdated AI model.

If the responsible party had a contractual or regulatory duty to maintain the system, failure to update may become evidence of breach or negligence.

28. Cybersecurity and Third-Party Attack

Consider:

Smart electricity network → hacker → incorrect control signal → power failure → factory damage.

Three possibilities may arise:

Scenario A

The attack was extraordinary and unavoidable.

The external event may significantly affect causation.

Scenario B

The system was inadequately secured.

The infrastructure operator may face an argument that inadequate security contributed to the damage.

Scenario C

Both occurred.

The court may need to determine the respective causal significance of the cyberattack and the security failure.

29. Product Defect

Smart infrastructure frequently combines:

hardware + software + network + AI.

A defective component may cause infrastructure failure.

Examples:

faulty sensor;

defective circuit;

defective automated brake;

defective smart meter;

defective controller.

Liability may therefore involve both contractual and statutory product-liability principles, depending on the parties and applicable legislation.

30. Evidence in Smart Infrastructure Cases

Evidence is particularly important because infrastructure failures can involve millions of digital events.

Important evidence includes:

Technical evidence

source code;

system architecture;

logs;

sensor records;

network records;

API records;

software versions;

update history.

Physical evidence

damaged components;

electrical equipment;

machinery;

CCTV;

maintenance records.

Contractual evidence

specifications;

warranties;

service-level agreements;

maintenance contracts;

testing certificates.

Cyber evidence

access logs;

intrusion records;

authentication information;

malware reports;

firewall records.

31. Role of Experts

Smart infrastructure disputes frequently require technical experts.

Experts may determine:

how the system operated;

where the failure occurred;

whether the software functioned as designed;

whether the sensor was defective;

whether the system was properly maintained;

whether a cyberattack occurred;

whether the failure was technically foreseeable.

But the court determines the legal consequence.

Therefore:

Expert establishes technical causation; court determines legal causation and liability.

32. Damage Assessment

Possible categories of damage include:

Physical damage

buildings;

vehicles;

machinery;

infrastructure.

Personal injury

medical expenses;

lost earnings;

other legally recoverable consequences.

Economic loss

business interruption;

lost revenue;

additional operating expenses.

Repair costs

replacement components;

software restoration;

cybersecurity remediation.

Consequential loss

The claimant must establish the applicable legal basis and sufficiently prove the loss.

Globemed illustrates the importance of distinguishing actionable loss from speculative future loss. (DIFC Courts)

33. Insurance

Smart infrastructure operators may carry:

property insurance;

construction insurance;

professional indemnity insurance;

cyber insurance;

business interruption insurance;

equipment insurance.

Insurance does not necessarily determine who is legally responsible for the original failure.

The insurer may subsequently pursue recovery against the responsible party where legally permitted.

34. Contractual Risk Allocation

Smart infrastructure contracts should ideally identify:

who owns the system;

who operates it;

who maintains it;

who controls software;

who controls data;

who handles cybersecurity;

who bears upgrade costs;

who bears downtime risk;

who bears third-party claims;

insurance requirements;

indemnities;

limitation clauses;

incident-reporting duties.

This reduces uncertainty when a failure occurs.

35. Special Problem of Autonomous Infrastructure

Autonomous infrastructure creates a difficult question:

Who is responsible when nobody directly instructed the harmful action?

For example:

AI traffic controller → incorrect decision → accident

Potentially relevant parties include:

AI developer;

infrastructure owner;

system integrator;

sensor provider;

operator;

maintenance contractor.

The law therefore needs to move from simple:

"Who pushed the button?"

toward:

"Who had the legal duty to design, control, supervise and maintain the system safely?"

36. Smart Infrastructure and Government Projects

Many UAE smart-city projects involve public authorities.

This can create additional questions concerning:

public contracts;

statutory duties;

administrative law;

procurement;

concessions;

PPP arrangements;

sovereign/public-entity protections;

contractual jurisdiction;

arbitration.

The applicable legal regime must therefore be identified before determining liability.

37. Practical Example: Smart Traffic System

Suppose a Dubai smart traffic system contains a defective sensor.

Step 1

Sensor gives incorrect information.

Step 2

AI traffic platform receives the information.

Step 3

Traffic lights are automatically changed.

Step 4

A vehicle enters an intersection.

Step 5

An accident occurs.

Step 6

The claimant suffers physical and economic loss.

The court may ask:

Question 1: Was the sensor defective?

Question 2: Was the AI system properly designed?

Question 3: Was the system properly maintained?

Question 4: Did the operator have warning information?

Question 5: Did the sensor failure actually cause the accident?

Question 6: Did driver conduct contribute?

Question 7: Was another event an intervening cause?

Question 8: What damage is legally recoverable?

38. Practical Example: Smart Building

A smart building uses AI to control:

air conditioning;

elevators;

fire alarms;

access control;

electricity.

The fire alarm software fails because of an outdated update.

A fire spreads before occupants receive adequate warning.

Potential liability may involve:

Software provider + building owner + maintenance contractor + system integrator

The court would need to examine the contractual allocation of responsibilities and the applicable civil-liability rules.

39. Practical Example: Smart Electricity Grid

Suppose an automated grid-management system incorrectly balances electricity demand.

The resulting overload damages industrial equipment.

The investigation may identify:

defective software;

incorrect sensor data;

inadequate testing;

maintenance failure;

operator negligence.

This is a classic multi-causal infrastructure liability problem.

40. Main Defences

Potential defences include:

1. No breach

The system complied with contractual specifications.

2. No causation

The failure did not cause the alleged damage.

3. External cause

The damage was caused by an independent external event.

4. Third-party act

Another person's conduct caused the loss.

5. Claimant's own fault

The claimant contributed to the damage.

6. Force majeure

An extraordinary event prevented performance.

7. No actionable loss

The claimant cannot prove legally recoverable damage.

8. Contractual limitation

A valid contractual clause may limit or allocate liability, subject to mandatory law.

41. Important Legal Distinction

It is important not to confuse:

System failure

The technology stopped working.

with:

Legal breach

A party failed to perform a legal or contractual obligation.

and:

Civil liability

The legally responsible party must compensate for recoverable damage.

Therefore:

Not every technical failure creates civil liability.

A claimant normally needs to connect the technical failure with a legally recognised obligation, breach or harmful act and a recoverable loss.

42. Examination Framework

For a UAE smart-infrastructure liability problem, use this sequence:

Step 1 — Identify the infrastructure

What failed?

Step 2 — Identify the parties

Who designed, built, supplied, operated and maintained it?

Step 3 — Identify the legal duty

Contractual, statutory, tortious/harmful-act or other duty?

Step 4 — Identify the failure

Was it design, software, hardware, maintenance, human or cybersecurity failure?

Step 5 — Establish damage

What actual harm occurred?

Step 6 — Establish causation

Did the failure cause the harm?

Step 7 — Examine intervening causes

Was there a cyberattack, force majeure or third-party act?

Step 8 — Examine contributory conduct

Did the claimant or another participant contribute?

Step 9 — Quantify damages

What loss can actually be proved?

Step 10 — Determine remedy

Damages, repair costs, restitution, injunction or other appropriate relief.

43. Quick Revision Table

44. Conclusion

UAE smart-infrastructure failure liability is essentially the application of traditional civil-law principles to technologically complex infrastructure.

The basic structure is:

Duty/Obligation → Infrastructure Failure → Damage → Causation → Attribution → Liability → Compensation

The current UAE Civil Transactions Law expressly recognises harmful-act liability and distinguishes direct harm from harm occurring through causation. (UAE Legislation)

The UAE/DIFC authorities demonstrate several important principles:

Haya Spa — causation requires a connection between conduct and loss and considers intervening events. (DIFC Courts)

Graciela — interference with IT infrastructure can constitute actionable wrongful interference causing compensable loss. (DIFC Courts)

Panther — construction responsibility and causation must be analysed carefully in infrastructure projects. (DIFC Courts)

BAM Higgs & Hill — breach alone does not establish compensation; damage and causal connection must also be established. (DIFC Courts)

Larmag — UAE harmful-act liability depends upon harm and causal connection and involves careful assessment of recoverable damage. (DIFC Courts)

Globemed — future/economic loss must satisfy the applicable requirements of certainty and proof. (DIFC Courts)

Faizal Babu Moorkath — duty, breach, causation and actionable loss remain distinct requirements in negligence analysis. (DIFC Courts)

One-line exam definition

Smart infrastructure failure liability in UAE civil law is the legal responsibility arising when a defective, improperly designed, operated, maintained, secured or controlled intelligent infrastructure system causes legally recoverable harm, requiring analysis of duty, breach or harmful conduct, causation, attribution, external causes, proof of damage and appropriate compensation.

Important: The DIFC authorities above are UAE-based but arise under the DIFC's separate legal framework; they should not be treated as automatically binding precedents for mainland UAE courts.