UAE telemarketing law: can AI agents make sales calls? The rules explained

Why the UAE regulates marketing calls, and who the rules cover

The UAE Cabinet issued two linked decisions on 10 June 2024, and both took effect on 27 August 2024, 60 days after they appeared in the Official Gazette. Cabinet Resolution No. 56 of 2024 sets the rules for marketing by phone. Its stated aims are to organise telemarketing, make companies keep to permitted channels and times, and reduce unwanted calls so that consumers are not disturbed and their privacy is respected (Article 2). Cabinet Resolution No. 57 of 2024 puts a price on breaking each of those rules.

The rules apply to every company licensed in the UAE that markets products or services by phone, including companies in free zones (Resolution 56, Article 3(1)). Telemarketing is defined broadly. It covers calls from a landline or mobile number made to market, advertise or promote a product or service, and it includes marketing text messages and marketing messages sent through social media apps (Article 1). A follow-up text or chat message from an AI agent that promotes a product is therefore covered as well as the call itself.

One definition matters more than it first appears. An unwanted marketing call is one made in breach of the resolution, and the definition expressly excludes calls made at the consumer's request (Article 1). A callback that someone asked for, such as a reply to a web enquiry, is in a different position from a cold call. The duties on hours, recording and disclosure are still written for every marketing call, though, so the safe course is to apply them to requested calls too.

What the resolution bans outright is selling from a personal line. An individual may not make marketing calls for products or services from a landline or mobile number registered in their own name (Article 3(2)). This is the cold calling ban that UAE residents talk about. Telemarketing itself is not banned, but a personal SIM card can no longer serve as a sales tool, and the penalty for using one falls on the individual.

Can an AI voice agent make sales calls in the UAE?

Yes. Resolution 56 says companies may use automated communication systems to market, advertise and promote their products and services "in accordance with the provisions of this resolution" (Article 5(6)). The wording cuts both ways. Automation is allowed, but it buys no exemption. Using automated calling in breach of the rules is a fine of its own: AED 10,000 for a first violation, rising to AED 50,000 for a third (Resolution 57, Table 1, item 16).

An AI agent therefore carries every duty a human telemarketer does, and several are easier to meet in software than with a room of callers. A dialler can refuse to place a call outside permitted hours, count retries for each number and block a number for good after a refusal. On Sonex, for example, each outbound calling campaign has its own calling window, time zone and retry limit, and every call is kept as a recording and a transcript.

What the rules do not settle is whether the caller must say it is an AI. Neither Resolution 56 nor the Central Bank's telemarketing regulation requires an "I am an AI" statement. The regulation says only that the use of AI is subject to applicable laws and regulations (Article 16.2). For banks and insurers, the Central Bank's AI guidance note of 11 February 2026 goes further: firms "should be transparent" when customers are interacting with an AI application, with disclosures in Arabic and English (paragraph 4). That is guidance rather than a binding rule, and nothing equivalent exists for other sectors.

Our recommendation, which goes beyond what the UAE text requires, is to say it plainly in the opening line anyway. The rules already demand a scripted opening, so one more sentence costs little, and it removes any later argument that a person was misled about who was calling. Companies that also call Europe will need it regardless, because the EU AI Act's transparency rule for AI voice agents makes disclosure a legal duty there.

• English: "Hello, this is the virtual assistant for [Company]. You are speaking with an AI assistant, not a person. I'm calling about [purpose]. This call is recorded. Is it OK to continue?"
• Arabic: "مرحباً، معك المساعد الافتراضي لشركة [اسم الشركة]. أنا مساعد يعمل بالذكاء الاصطناعي ولست موظفاً بشرياً. أتصل بك بخصوص [الغرض]، وهذه المكالمة مسجلة. هل يناسبك أن نكمل؟"
• If the person says no: end the call politely, mark the number as refused, and never call it again about that product.

Who you may call: the Do Not Call Register and your own opt-in list

Before the clock or the script matters, a company has to know whether it may call a number at all. The first filter is the Do Not Call Register (DNCR), a national list of people who do not want marketing calls, supervised by TDRA. People add their number to stop marketing calls (Resolution 56, Article 6(5)), and TDRA says they can do it by texting "DNCR" to 2211 or 1012.

Calling a listed number is one of the most expensive mistakes in the rules: AED 50,000 for a first violation, AED 75,000 for a second and AED 150,000 for a third (Resolution 57, Table 1, item 4). Because people can join the register at any time, a list that was clean last month may not be clean today. Check every number before it enters a calling list, and again before each campaign. Callers must also be trained in how to use the register, and skipping that training is a separate fine (Article 4(2)).

The register is only the first filter. Article 4(4) asks companies to set up a channel for people who want marketing information and to market only to them, which in practice means an opt-in list you built, not a bought database. The authority can also demand to know where you got each number and each person's data, and failing to say is a fine of AED 25,000 to AED 75,000 (Article 4(12)). A bought list makes both duties hard to meet.

A number that is not on the register can still be off limits. If the person refused on an earlier call, or you cannot show they came through your opt-in channel, calling them is a breach even though the DNCR check passed. Keep a refusal list alongside the register check, and screen against both.

Calling hours, weekends and how often you can call back

Once a number is cleared, the clock decides. Marketing calls are allowed only between 9:00 am and 6:00 pm (Resolution 56, Article 5(3)). The resolution names no time zone, but the Central Bank's version of the rule says "the State's time" (CBUAE Article 15.1). The safe reading for everyone is UAE time, which is Gulf Standard Time (GST), or UTC+4. The UAE has no daylight saving, so the window is the same all year.

Neither text limits calls to weekdays or rules out public holidays, so the same window applies on Saturdays, Sundays and holidays. Some guides still describe weekend hours of 12 pm to 5 pm and a public-holiday ban. Those were in the Central Bank's draft, as reported by the law firm Al Tamimi, but they are not in the final Article 15.

Apply the window wherever your contact centre or servers are. A team in India, an hour and a half ahead of the UAE, would dial UAE numbers only between 10:30 am and 7:30 pm India time. Setting the dialler to the called person's time zone, rather than the server's, avoids that kind of conversion error.

How often you call is limited too. If the person rejects the product or service on the first call, you may not call them back about it (Article 5(4)). If they do not answer or they end the call, you may try again at most once a day and twice a week (Article 5(5)). For an AI dialler, the hours and retry rules become three hard settings: a 09:00 to 18:00 GST window, a per-number counter for daily and weekly retries, and a permanent stop after a refusal. The calling rules by country tool sets these out next to other markets.

Fines, suspensions and how the rules are enforced

Resolution 57 gives authorities a ladder of penalties for companies (Article 3, First). It starts with a warning, then a fine from Table 1, then suspension of all or part of the company's activity for 7 to 90 days. At the top is cancellation of the licence, with deletion from the commercial register, cut communication services and loss of the phone number. Authorities are meant to climb the ladder in order. If a company repeats a violation within six months of being penalised for it, they may skip straight to the most severe penalty.

Each duty has its own fine, and the amounts rise for a second and third violation. Resolution 57 does not say whether every call counts as a separate violation. Even counted once per type of breach, a campaign that calls listed numbers after 6 pm without a recording notice commits three violations, which at first-violation rates comes to AED 70,000 (our arithmetic: 50,000 plus 10,000 plus 10,000).

Banks, insurers and other Central Bank-licensed firms are handled differently. Resolution 57 leaves their penalties to a regulation the Central Bank makes with Cabinet approval (Article 3, Third). The Central Bank's telemarketing regulation says breaches may lead to supervisory action, administrative action or financial sanctions as it sees fit (CBUAE Article 20.1).

Individuals who sell from a personal number pay AED 5,000, and every number in their name is cut until they pay. A repeat within 30 days costs AED 20,000 and a three-month cut, and a third costs AED 50,000 and a 12-month ban from all UAE telecom services (Resolution 57, Table 2).

The penalties are being used. Between August 2024 and June 2026, TDRA issued 3,301 violations against individuals, worth about AED 19.19 million in fines, and cut 9,433 numbers after public reports. The figures come from Khaleej Times on 5 August 2026 and The National a day later; we did not find TDRA's own release. A penalised company or person can appeal within 15 days of being notified. The authority has 30 days to decide, and silence counts as a rejection (Resolution 57, Article 6).

Stricter Central Bank rules for banks and insurers

Banks, insurers and other firms licensed by the Central Bank sit under a second, stricter layer: the CBUAE Telemarketing Regulation, Circular No. 3/2026, issued on 19 February 2026. It took effect on publication in the Official Gazette on 31 March 2026 (Article 24.1), and firms had 90 days from then to comply (Article 24.2). Resolution 56 gives the Central Bank this role (Article 9(2)), and where the regulation conflicts with another regulator's requirements, the regulation prevails (Article 21.1).

Its reach is wider than the general rules in three ways. It applies to a firm and its whole group, including subsidiaries and foreign branches. It also applies when calling is outsourced, and any third-party provider must comply in full (Scope, Article 19.2). Telemarketing means any communication that promotes a financial product, by call, text, chat box, email, website or social media (Article 1.30). A telemarketer may include automated systems and artificial intelligence (Article 1.29), so an AI agent is squarely inside the rules.

For a bank or insurer, the AI vendor is therefore part of the compliance perimeter, not outside it. That is the context for AI calling for banks and lenders: the institution keeps every duty, and the vendor must be able to show it follows them.

Key dates