Is AI Cold-Calling Legal in the UAE? 2026 TDRA Guide

Is AI cold-calling actually legal in the UAE?

Yes. Using an AI voice agent to make outbound marketing calls is entirely legal in the UAE — provided the business follows the rules set out in Cabinet Resolution No. 56 of 2024 (the conduct rules) and Cabinet Resolution No. 57 of 2024 (the penalty schedule). Both resolutions were issued on 10 June 2024 and came into effect on 27 August 2024.

The technology itself — whether a human agent, a scripted IVR, or a modern AI voice agent — is not the variable the law cares about. What the law regulates is the act of making unsolicited marketing calls to UAE consumers. That means the same obligations apply regardless of whether a person or a machine places the call.

The regulations draw a clear line between outbound telemarketing (calls a business initiates to promote or sell) and inbound service calls (calls a customer initiates themselves). Only the former sits inside the telemarketing regime. This distinction matters enormously for how you design a compliant AI calling programme — and we will return to it under the exemptions section below.

What do TDRA Resolutions 56 and 57 of 2024 require?

Resolution 56 lays out a specific set of obligations for any entity making outbound marketing calls in the UAE. These are not guidelines — they are legal requirements enforceable under the penalty framework in Resolution 57. The core obligations are:

• Prior TDRA approval. You must obtain authorisation from the Telecommunications and Digital Government Regulatory Authority before running any outbound telemarketing programme.
• Licence-registered numbers only. Every outbound call must originate from a number registered to your company's UAE commercial licence. Spoofed, masked, or unregistered caller IDs are prohibited.
• DNCR screening before every dial. The Do Not Call Registry must be checked and any registered numbers must be excluded. There is no grace period — a single call to a DNCR-registered number is a first-offence violation.
• Calling window: 09:00–18:00 only. Outbound marketing calls outside this window are unlawful, seven days a week.
• Record the call and notify the consumer. Every call must be recorded, and the consumer must be informed of that recording at the start of the call. The agent — human or AI — must also disclose the company name and purpose at the outset.
• Frequency cap. You may not call the same number more than once per day. If a call goes unanswered, the cap rises to twice per week. If the consumer rejects the call on first contact, no further call may be made to that number on the same day.

These requirements are summarised consistently across independent legal analyses. Clyde & Co and Morgan Lewis both published detailed analyses in July 2024, shortly after the resolutions were issued. The Khaleej Times covered the rules for a general business audience when they took effect in August.

Reading Resolution 56 directly is worth the effort. The official Arabic text with an English translation is available at the UAE Legislation Portal. Regulators rarely care whether a business knew the rule — only whether it was followed.

When are AI calls exempt? (Inbound is the big one)

The telemarketing rules apply to calls that a business initiates for promotional or sales purposes. They do not apply to calls that a customer initiates. Resolution 56 defines "Telemarketing" (Art. 1) as calls made to a consumer for marketing, advertising or promoting a product or service, and its definition of "Unwanted Marketing Phone Calls" separately excludes calls "made at the request of the Consumer." A call that begins because the customer dialled you, or a callback made at their request, does not fit the definition the rules are built around — and that distinction, not a standalone "inbound exemption" clause, is the most commercially significant one in the legislation for businesses running AI voice platforms.

When a patient calls a clinic's main number, when a property buyer calls a brokerage back after seeing a listing, or when a website visitor clicks a call button — all of those conversations begin with the customer. The AI receptionist answering those calls is handling customer-initiated inbound, which sits entirely outside the telemarketing regime. DNCR screening, the 09:00–18:00 window, the prior TDRA approval requirement — none of those obligations attach.

For businesses that do want to run AI-powered outbound campaigns, this distinction still matters indirectly: a warm lead who called you first, or a former customer who previously consented, may fall into a different consent category. Your legal counsel should map those flows carefully before launch.

What are the penalties for getting it wrong?

Cabinet Resolution No. 57 of 2024 sets out a tiered administrative penalty structure. Fines escalate with repeat offences, and some violations carry per-call exposure rather than a flat annual fine. The table below covers the two most practically relevant violations for AI calling programmes.

These are not the only violations in the schedule. Legal 500's comprehensive guide to the enforcement framework is the clearest secondary-source overview of the full penalty schedule. The escalation structure — where a third DNCR offence costs three times the first — signals regulatory intent: authorities are not building tolerance for repeat non-compliance.

Inbound versus outbound — which rules apply to your use case?

Most UAE businesses running AI receptionists and immediate-callback systems are operating in the first row — responding to customers who raised their hand. Businesses running proactive outbound campaigns fall into the second row and need the full compliance stack in place before going live.

How does an AI voice agent stay compliant automatically?

One of the practical arguments for AI-powered calling — beyond cost and availability — is that software enforces rules more consistently than manual processes. A properly configured AI calling system can bake compliance into the call flow rather than relying on individual agents to remember it.

DNCR scrubbing can happen programmatically before every dial attempt. Unlike a manual outreach team working from a spreadsheet, an automated system can check the registry on each call, not just at list-import time. This matters because the DNCR is a live database — a number added after your last export is still a number you cannot legally call.

Time-gating is trivially easy to enforce in code. The system simply does not place calls before 09:00 or after 18:00, regardless of how many leads are queued. No escalation required, no human judgement call at 17:55.

Call recording can be enabled at the infrastructure level — every call recorded, timestamped, and stored without relying on an agent to press a button. Caller ID is set at account level, ensuring every outbound call displays the number registered to your commercial licence.

Frequency caps are straightforwardly enforced by a CRM integration that tracks dial attempts per number per day and per week. Once the cap is reached, the contact is automatically suppressed for the relevant period.

At MAJ Leads, we configure all of the above as standard in our outbound deployments. As a matter of company policy — and as what we consider strong practice for consumer trust — our AI agents also introduce themselves by name and purpose at the start of every call, including that the caller has reached an AI assistant. That transparency is our own standard, not a statutory requirement under the current resolutions.