- The United Arab Emirates has revealed sweeping changes to its national cybersecurity framework
- It is simultaneously accelerating one of the world’s most ambitious public-sector artificial intelligence programmes
- The UAE IA v2.1 introduces stricter expectations around governance, risk management and compliance
The United Arab Emirates has revealed sweeping changes to its national cybersecurity framework while simultaneously accelerating one of the world’s most ambitious public-sector artificial intelligence programmes.
In November 2025, the UAE introduced the Information Assurance Standard v2.1, replacing its 2020 predecessor and marking a significant step forward in national cyber maturity.
The new standard is designed to address this shift by enforcing more consistent practices and enabling a cohesive national response. It positions cybersecurity as central to operational resilience, requiring organisations to anticipate and respond to disruptions affecting digital services and critical operations.
It also places greater accountability on senior leadership, reinforcing that cyber risk must be managed at the board level rather than delegated solely to IT teams.
The UAE IA v2.1 introduces stricter expectations around governance, risk management and compliance, with tangible consequences for organisations that fall short.
Service disruption, regulatory scrutiny and erosion of public trust are all cited as potential outcomes, particularly for entities delivering essential or citizen-facing services.
At the same time, the framework encourages early action, with proactive implementation seen as more cost-effective than reactive remediation following incidents or audits.
A notable feature of the update is its focus on emerging technologies.
For example, new controls address the governance and secure deployment of artificial intelligence, introduce heightened requirements around data sovereignty and control in cloud computing, and expand safeguards for Internet of Things environments, particularly those supporting critical infrastructure. The aim is to enable innovation while limiting the additional exposure created by rapid digital transformation.
To this, KPMG said organisations will need structured, risk-driven approaches to meet the new requirements, including gap assessments, resilience roadmaps and stronger governance models to ensure sustainable compliance.
Alongside the cybersecurity overhaul, the UAE has announced plans to move 50per cent of government services and operations to agentic AI within two years.
Announcing the initiative, Sheikh Mohammed bin Rashid Al Maktoum said AI would evolve beyond a supporting role, explaining: “AI is no longer a tool. It analyses, decides, executes and improves in real time. It will become our executive partner to enhance services, accelerate decisions and raise efficiency.”
The UAE’s dual focus on cybersecurity and AI is indicative of a new global trend, with research from Malt showing that demand for governance, risk, and compliance expertise is rising sharply as organisations respond to new regulatory pressures and technological complexity.
More than half of cybersecurity projects on the platform now relate to governance and compliance, showing the shift away from technical security work.
What’s next?
