Cold outreach rules in the UAE: what AI lead generation can and can't do

AI does not change the law. UAE rules attach to the activity, such as a marketing call, a marketing text or the handling of personal data, whether a person or an AI agent does the work. Extra rules apply in regulated sectors. Check your specific case with a UAE lawyer.

SarabTech's Lead Generation Agent drafts call scripts and runs outreach by email and messaging, and people make the calls. A person approves everything customer-facing before it goes out. Whatever tool you use, the legal duties stay with the business sending the message. This guide sets out what we could verify on official UAE sources, and where you need a lawyer.

Does AI change the rules for cold outreach?

No. Cabinet Resolution No. 56 of 2024 on telemarketing says automated communication systems may be used for marketing 'in accordance with the provisions of this resolution'. It does not mention AI agents, so treat one as you would any system that contacts people. The business behind the message still needs the right approvals, a lawful source for its contacts and a record of what it sent.

What do the UAE telemarketing rules say?

Cabinet Resolution No. 56 of 2024, dated 10 June 2024, regulates telemarketing. Cabinet Resolution No. 57 of 2024 sets the penalties. From the text we read, the main points are:

• Who it covers. All companies licensed in the UAE that market products or services by telemarketing, including companies in free zones. The definition includes marketing text messages and marketing messages through social media applications, sent through a landline or mobile number.
• Approval and numbers. Companies need prior approval from the competent authority and must use local numbers registered under their commercial licence.
• The Do Not Call register. The national register, supervised by the Telecommunications and Digital Government Regulatory Authority (TDRA), lets consumers stop marketing calls, and companies may not call numbers listed on it.
• When and how often. In the text we read, marketing calls may be made only between 9:00 am and 6:00 pm. There is no call-back after a refusal on the first call, and call-backs after an unanswered call are capped at once a day and twice a week.

Resolution 57 lets the competent authority apply a graded scale of penalties to companies: a warning, then fines under an annexed table, then suspension of activity, and finally cancellation of the licence. The Cabinet can amend the fines, so check the current table rather than relying on figures quoted online.

How do personal data and consent apply?

The government portal summarises Federal Decree-Law No. 45 of 2021 on personal data protection, which it says came into force on 2 January 2022. Points relevant to outreach:

• Consent. The law prohibits processing personal data without the owner's consent, with exceptions the portal does not list in detail. Whether an exception covers your outreach is a question for a lawyer.
• Cross-border processing. The law sets requirements for transferring and sharing personal data across borders. If an AI tool processes lead data outside the UAE, ask where, and take legal advice on the transfer.
• Bought lists. The telemarketing resolution bars disclosing consumers' personal data without consent, or trading it to companies that want to market by phone. Know where each list came from.

The portal also says the UAE Data Office will act as the federal data regulator. Implementing rules and enforcement details can change, so confirm the current position with a lawyer.

What are the rules for email and messaging?

For text messages, TDRA publishes a regulatory policy on unsolicited electronic communications, version 1.1, issued on 13 June 2022. It applies to text messages with a UAE link, meaning those sent from, to or within the UAE. In the policy:

• Consent. Spam is defined as marketing communications sent to a recipient without their consent. The process of obtaining consent must be clear and transparent, and evidence of it must be kept.
• Opt-out. Every marketing text must include a way to opt out, and subscribing or unsubscribing must be free of charge.
• Timing. Marketing texts may not be sent between 9:00 pm and 7:00 am.
• Who it binds. The policy sets duties for telecoms licensees, and requires them to pass the rules on to business customers through their messaging contracts. A business that breaches them can have its messaging service suspended.

The TDRA policy we read covers text messages. We did not find an official UAE source that sets out marketing-email rules in the same detail, so do not assume email is unregulated, because personal data and sector rules can still apply. Treat messaging-app outreach to individuals as covered by the telemarketing resolution unless a lawyer advises otherwise. Check the current rules with a UAE lawyer before emailing people you have not contacted before.

Do sector rules apply?

Yes, in regulated sectors. Resolution 56 gives the Central Bank responsibility for telemarketing by banks, other financial institutions and insurance companies, and the Securities and Commodities Authority responsibility for securities and commodities trading services. The competent local authority in each emirate covers other telemarketing. If you work in or sell to a regulated sector, ask that regulator and a lawyer what applies.

Is business-to-business outreach treated differently?

Do not assume it is. The telemarketing resolution defines a consumer as a natural person, so whether it reaches a call to a named individual at a company is a question for a lawyer. The TDRA text-message policy we read draws no exemption for business recipients. Personal data rules can also apply to a named individual's details, even in a work context.

A compliance checklist for AI lead generation

1. Confirm with a UAE lawyer which rules apply to your business, sector and free zone.
2. Record where every contact came from, and be ready to disclose it if a regulator asks.
3. Check phone numbers against the Do Not Call register before any marketing call.
4. Keep evidence of consent for every contact you message: the date, the wording and who gave it.
5. Put a free, working opt-out in every marketing message, and honour it at once.
6. Keep a suppression list of everyone who opted out or asked you to stop, and check it before every send.
7. Respect the permitted times and call-back limits, and identify your company and purpose at the start of every call.
8. Ask where any AI tool processes lead data, and take advice before sending personal data abroad.
9. Have a person approve every message before it goes out, and keep the approval record.
10. Re-check the rules on a set schedule, because they change.

What does a careful AI outreach workflow look like?

1. Research. Build the target list from sources you can name, and record each source. The Data Research Agent is SarabTech's agent for research work.
2. Screen. Remove numbers on the Do Not Call register, past opt-outs and anyone you should not contact.
3. Draft. The agent drafts emails, messages and call scripts that name your company, state the purpose and include an opt-out line.
4. Approve. A person reads each draft, checks facts and rules, and approves or rejects it. Nothing customer-facing goes out without that approval.
5. Send. Approved messages go out only within permitted times, on the channels you have cleared, with the opt-out working.
6. Call. People make any phone calls, using the draft script, inside the permitted window and after checking the register.
7. Log and review. Record every send, reply and opt-out, apply opt-outs straight away, and review the log on a schedule.

Where does this leave you?

AI can prepare outreach faster. It cannot make unlawful outreach lawful, and no tool, ours included, makes you compliant on its own. If you want outreach drafted for human approval, see how the Lead Generation Agent works, and take the checklist above to a UAE lawyer first.