Civil Law and UAE: Self-Modifying Legal Frameworks in Autonomous Systems

1. Introduction

Self-modifying legal frameworks in autonomous systems refers to the legal problem created when an autonomous technological system can change its own operational behaviour, parameters, software, decision rules or responses without a human making each individual decision.

Examples include:

autonomous vehicles;

AI-controlled machines;

autonomous drones;

robotic systems;

algorithmic trading systems;

smart contracts;

decentralised autonomous organisations (DAOs);

AI agents;

automated insurance or financial systems;

industrial robots;

autonomous cybersecurity systems.

The legal difficulty is that traditional civil liability assumes relatively stable human actors:

Human decision → conduct → harm → liability

An autonomous system may instead produce:

Developer → training/data → algorithm → autonomous adaptation → decision → physical/economic harm

This creates difficult questions about attribution, causation, fault, proof, updating, supervision and responsibility.

The UAE is particularly important because Dubai has already enacted a specific law regulating autonomous vehicles, while the DIFC Courts have established a Digital Economy Court framework expressly covering artificial intelligence, robotics, autonomous organisations, digital assets and cyber-physical systems. (Dubai Land Department)

2. Meaning of a Self-Modifying Autonomous System

A self-modifying system is one capable of changing some part of its operational behaviour based upon:

new data;

machine learning;

environmental conditions;

feedback;

optimisation;

software updates;

automated rules;

interaction with other systems.

For example:

An autonomous vehicle receives new traffic data → modifies its route-selection behaviour → makes a different driving decision.

Or:

An AI financial system observes market conditions → changes its trading strategy → executes transactions automatically.

The legal problem is:

Who is responsible when the system's changed behaviour causes legally recognised harm?

3. UAE Legal Position: The Machine Is Not Automatically a Legal Person

Under the present UAE framework, an autonomous system is generally regulated as a technology, vehicle, product, service or system, rather than as an independent legal person.

This is important.

A robot cannot normally be treated as:

“the defendant”

simply because it made the immediate decision.

Instead, liability may be traced to:

owner;

operator;

manufacturer;

developer;

supplier;

maintenance provider;

authorised agent;

service provider;

programmer;

data controller;

other legally responsible person.

Dubai's autonomous-vehicle legislation demonstrates this approach particularly clearly.

4. Dubai Autonomous Vehicle Law

Dubai's Law No. 9 of 2023 Regulating the Operation of Autonomous Vehicles defines an autonomous vehicle as a vehicle operated by an autonomous driving system and defines the autonomous driving system as devices and software enabling the vehicle to interact with roads and control its movement without human intervention. (Dubai Land Department)

The law specifically aims to:

implement smart mobility using AI;

regulate autonomous-vehicle operation;

maintain safety and quality;

attract investment;

address legal and regulatory challenges caused by AI in transportation. (Dubai Land Department)

This is significant because the legislature has moved away from simply applying traditional traffic rules and has created a technology-specific responsibility structure.

5. Operator Liability

The most important rule is Article 14 of Dubai Law No. 9 of 2023.

It provides that the Operator is liable for compensating property damage or personal harm caused by the autonomous vehicle, while preserving the Operator's right of recourse against the person actually responsible under the general rules of liability. The RTA itself is not liable to third parties merely because autonomous vehicles are being used. (Dubai Land Department)

This produces a sophisticated liability model:

Victim

↓

Operator

↓

Compensation

↓

Recourse

↓

Manufacturer / developer / maintenance provider / other responsible person

This is highly relevant to self-modifying systems.

6. Why Operator Liability Is Important

Suppose an autonomous vehicle changes its driving behaviour because of machine-learning adaptation and causes an accident.

The victim should not necessarily have to investigate:

source code;

neural-network weights;

training data;

software architecture;

algorithmic decisions.

Dubai's legislation instead creates an identifiable responsible party—the Operator—while preserving recourse against the person actually responsible. (Dubai Land Department)

This is an example of risk allocation replacing purely fault-based attribution.

7. Self-Modifying Systems and the Attribution Problem

Traditional negligence asks:

Who made the mistake?

Autonomous systems create a different question:

Who created or controlled the conditions in which the system made the decision?

Potential defendants include:

8. Case Law 1 — Thamer Abdulaziz Albulaihid v Health Insights

Thamer Abdulaziz Albulaihid & Moustafa El Sayed Abdulghani El Shafaei v Nasser Shehata & Health Insights FZ-LLC & Health Insights Asia [2023] DIFC CFI 079

This case concerned software development, ownership and responsibility for the Medica CloudCare software.

The defendants argued that the claim should fail because there was insufficient technical evidence, including source code and formal development records.

The Court rejected the proposition that the absence of particular technical artefacts automatically defeated the claim. It examined authorship based upon the whole evidentiary record, including evidence concerning who directed, supervised and controlled the development process. (DIFC Courts)

Relevance to autonomous systems

This provides an important analogy:

Responsibility for an autonomous system need not depend entirely upon identifying the person who wrote every line of code.

The court can examine:

control;

supervision;

development responsibility;

contractual relationships;

technical evidence;

surrounding circumstances.

This is particularly important for machine-learning systems where no individual programmer can explain every output.

9. Case Law 2 — Brookfield Multiplex v DIFC Investments

Brookfield Multiplex Constructions LLC v DIFC Investments LLC & DIFC Authority [2016] DIFC CFI 020

The Court dealt extensively with expert evidence concerning technical deficiencies, causation and damage.

Importantly, the Court distinguished:

technical evidence

from

ultimate legal responsibility.

Experts may explain defects and their technical causes, but determining negligence, breach and legal liability remains the function of the court or tribunal. (DIFC Courts)

Application to autonomous AI

This principle becomes critical where an AI system causes harm.

An AI expert might explain:

why the algorithm selected an action;

what data influenced it;

whether the model behaved unexpectedly;

whether the system departed from its design;

whether the software contained a defect.

But the expert should not decide:

“Therefore the manufacturer is legally liable.”

That remains a judicial question.

10. Case Law 3 — Gate Mena / Huobi v Tabarak Investment

Gate Mena DMCC & Huobi Mena FZE v Tabarak Investment Capital Ltd & Christian Thurner [2023] DIFC CA 002

This case is useful for the general law of negligence.

The DIFC Court of Appeal discussed the requirements for establishing a duty of care, including:

foreseeability;

proximity;

whether it is fair, just and reasonable to impose a duty.

The Court also examined assumption of responsibility and reasonable reliance. (DIFC Courts)

Relevance

For autonomous systems, the same framework can help determine whether:

AI developer → user

or

autonomous-system provider → third party

creates a legally recognised duty of care.

The question is not merely whether the system caused the loss.

The court must identify the legally relevant relationship.

11. Case Law 4 — Larmag Holding v First Abu Dhabi Bank

Larmag Holding B.V. v First Abu Dhabi Bank PJSC & FAB Securities LLC [2019] DIFC CFI 030

This case concerned banking/securities relationships and the use of legal mechanisms surrounding financial transactions.

Its relevance to autonomous systems is indirect but important: automated financial systems may create complex relationships among:

bank;

broker;

platform;

client;

algorithm;

data provider.

The case illustrates the importance of identifying the actual legal relationship and applicable legal duty rather than assuming liability merely because a financial system produced a result. (DIFC Courts)

Principle

Technology does not eliminate the need to identify the underlying legal relationship.

12. Case Law 5 — DFSA v Commissioner of Data Protection

Dubai Financial Services Authority v Commissioner of Data Protection & Anna Waterhouse [2018] DIFC CFI 051/085

The Court considered data-protection obligations and the relationship between regulatory powers and data rights.

The dispute concerned a subject-access request and the statutory framework governing personal information. The Court considered the relevant data-protection legislation and regulatory responsibilities. (DIFC Courts)

Relevance to self-modifying AI

Autonomous systems frequently depend upon:

personal data;

behavioural data;

location information;

biometric information;

customer profiles;

automated analysis.

Therefore, an autonomous system may produce civil liability even when the immediate output is not physically harmful.

For example:

AI processes personal data improperly → privacy harm → civil/regulatory consequences.

13. Case Law 6 — Fidel v Felecia & Faraz

Fidel v Felecia & Faraz [2015] DIFC CA 002

This case concerned how non-DIFC UAE law should be established and applied before the DIFC Courts.

The Court rejected a rigid rule that all non-DIFC UAE law must automatically be treated as foreign law requiring expert proof. It recognised judicial expertise and the DIFC Court's discretion concerning applicable evidentiary approaches. (DIFC Courts)

Relevance to autonomous systems

Autonomous technology often crosses legal boundaries.

A single system may involve:

UAE federal law;

Dubai regulation;

DIFC law;

foreign software;

foreign manufacturers;

foreign cloud services.

Therefore, identifying the applicable legal system becomes an essential part of AI liability.

14. Case Law 7 — MAG Development Services v Collection Club

MAG Development Services Ltd v Collection Club Restaurant Ltd & Others [2024] DIFC CFI 092

This case concerned expert evidence and the role of technical experts.

The Court emphasised that expert evidence should be limited to evidence reasonably required to resolve the proceedings and that experts must independently assist the Court within their expertise. (DIFC Courts)

Relevance

For autonomous systems, expert evidence could concern:

AI architecture;

software engineering;

cybersecurity;

data integrity;

machine-learning behaviour;

hardware failure;

system logs.

But courts should avoid allowing technical complexity to transform expert witnesses into substitute decision-makers.

15. Case Law 8 — Krystal Financial Consultants v Nextgen Robopark

Krystal Financial Consultants LLC v Nextgen Robopark Investment LLC [2025] DIFC CA 007

This is a recent DIFC Court of Appeal decision involving Nextgen Robopark Investment LLC.

The case is significant for current UAE technology-related commercial litigation because it illustrates that disputes involving technologically oriented businesses remain subject to ordinary principles of:

contractual rights;

evidence;

appellate review;

judicial evaluation.

The Court of Appeal judgment was issued on 16 June 2026. (DIFC Courts)

Relevance

The important doctrinal lesson is:

The presence of advanced technology does not automatically create an entirely separate body of civil law.

Existing contract, evidence and liability principles continue to provide the foundation unless specialised legislation changes the result.

16. Direct Autonomous-Vehicle Legislative Example

Unlike many areas of AI, Dubai has already legislated directly for autonomous vehicles.

Law No. 9 of 2023 creates obligations for:

Operators;

Agents;

Passengers;

RTA;

manufacturers/authorised agents.

The Operator must, among other things:

comply with the law and RTA requirements;

report accidents;

secure a malfunctioning autonomous vehicle;

follow operational rules;

comply with data restrictions. (Dubai Land Department)

The Agent must:

provide warranty and after-sales services;

maintain spare parts;

update autonomous-driving systems;

maintain compatibility with government systems;

provide qualified technical staff. (Dubai Land Department)

This is effectively a distributed responsibility model.

17. Self-Modification and Software Updates

This is one of the most important issues.

An autonomous system may change after:

software updates;

security patches;

AI model updates;

new training data;

environmental learning;

sensor recalibration.

Dubai law specifically regulates this.

Under Article 10 of Law No. 9 of 2023, modifications, upgrades or updates affecting the autonomous driving system, operational design domain or electronic applications require RTA approval. (Dubai Land Department)

The implementing bylaw further requires:

timely and secure software updates;

preservation of operational data;

maintenance records;

accident and malfunction records;

protection against alteration or deletion of operational data. (Dubai Land Department)

This is extremely important for civil liability.

18. The “Modification Responsibility” Problem

Imagine:

Manufacturer releases Version 1.0

↓

Operator receives vehicle

↓

AI system learns

↓

Software automatically updates

↓

Vehicle behaves differently

↓

Accident occurs

Who is responsible?

Potential possibilities include:

Manufacturer

If the underlying system was defective.

Operator

If the operator failed to maintain or operate the system properly.

Agent

If required updates or maintenance were not performed.

Software provider

If an update introduced the defect.

Data provider

If inaccurate data caused the decision.

Cyber attacker

If the system was compromised.

The law therefore needs traceability across the entire system lifecycle.

19. Dubai's 2026 Autonomous-Vehicle Development

Dubai's Executive Council Resolution No. 14 of 2026 establishes operational phases:

verification of data and maps;

operation with a safety operator;

operation without a safety operator.

The RTA determines when each phase begins and ends. (Dubai Land Department)

This represents a particularly important legal model:

Autonomy is introduced progressively rather than treated as an all-or-nothing legal status.

20. Safety Operator

The 2026 framework defines a Safety Operator as a person present in the autonomous vehicle who can take manual control where necessary to prevent loss of control or an accident. (Dubai Land Department)

This creates a transitional liability question:

If the system fails while a safety operator is present, when is the operator liable and when is the manufacturer/system provider responsible?

The answer will depend on:

whether intervention was required;

whether intervention was reasonably possible;

whether the operator was properly trained;

whether the system gave adequate warning;

whether the operator complied with prescribed procedures.

21. Personal Autonomous Vehicles

The 2026 rules impose additional controls on personally owned autonomous vehicles.

An individual may activate autonomous driving only in the prescribed operational phase and after RTA approval. The owner must:

coordinate activation with or under supervision of the authorised agent;

use approved roads/areas;

comply with safety standards;

report malfunctions;

accept legal responsibility for damage arising from unauthorised activation. (Dubai Land Department)

This is an example of risk allocation by regulation rather than waiting for courts to develop the rules after accidents occur.

22. Self-Modifying Systems and Evidence

Autonomous systems create a unique evidence problem.

After an accident, the court may need to know:

What did the system know?

What data did it receive?

What did the model predict?

What decision did it make?

Why did it make that decision?

Had its software been updated?

Who authorised the update?

Was the system operating within its approved environment?

Was the system malfunctioning?

Was there human interference?

Dubai's implementing bylaw requires an integrated electronic system storing operational information, including:

movement;

travel;

maintenance;

repairs;

accidents;

malfunctions.

The data must be securely stored and protected against unauthorised alteration or deletion. (Dubai Land Department)

23. Importance of Data Integrity

This creates an important civil-law principle:

The entity controlling an autonomous system should preserve the evidence necessary to reconstruct its operation.

Otherwise, a victim may face an impossible evidentiary burden.

This is particularly significant where the system is:

proprietary;

opaque;

continuously learning;

controlled by a foreign company;

dependent on cloud computing.

24. Data Protection

The UAE's Federal Decree-Law No. 45 of 2021 on Personal Data Protection expressly defines automated processing as processing carried out by an electronic programme or system operating automatically, either completely independently without human intervention or partially with limited human supervision. (UAE Legislation)

This is directly relevant to autonomous systems.

The legal framework therefore recognises the existence of automated decision/processing environments without granting the system independent legal personality.

25. AI in Judicial Proceedings

The DIFC Courts have already issued specific guidance concerning generative AI.

Their 2023 Practical Guidance Note warns of risks including:

inaccurate information;

misleading evidence;

confidentiality breaches;

intellectual-property problems;

data-protection breaches.

The Courts expect transparency regarding AI-generated material and require verification of its accuracy and reliability. (DIFC Courts)

This establishes an important broader principle:

Human legal responsibility remains even when technology is used to generate or process information.

26. Digital Economy Court

The DIFC Courts' current rules are especially significant.

The Digital Economy Court can hear claims concerning:

artificial intelligence;

AI-controlled devices;

digital assets;

blockchain;

automated dispute resolution;

DAOs;

DeFi;

DApps;

digital signatures;

software;

unmanned aerial vehicles;

robotics;

insurance claims connected with these technologies;

data-protection claims. (DIFC Courts)

Therefore, UAE legal institutions are moving toward specialised procedural capacity for autonomous and digital technologies.

27. Self-Modifying Legal Framework vs Self-Modifying AI

These concepts must be distinguished.

Self-modifying AI

The technology changes its behaviour.

Self-modifying legal framework

The legal/regulatory environment adapts its rules as technology changes.

For example:

Autonomous vehicle technology changes
↓
New safety requirements
↓
New operational phase
↓
New approval standards
↓
New liability rules

Dubai's 2026 autonomous-vehicle framework demonstrates this second phenomenon: regulation itself is designed to evolve through operational phases and RTA standards. (Dubai Land Department)

28. Regulatory Sandbox Approach

Autonomous systems create uncertainty because regulators may not initially know:

all possible risks;

all failure modes;

all appropriate safety standards;

how liability should be allocated.

A sandbox allows:

controlled experimentation → data collection → regulatory adjustment → wider deployment

Dubai's earlier 2019 autonomous-vehicle test-run framework illustrates this approach. It allowed authorised testing while imposing obligations and assigning responsibility for damage to the testing establishment rather than the RTA. (Dubai Land Department)

29. Civil Liability Model

For an autonomous system, a useful UAE liability model is:

S-A-C-D-R

S — System

What autonomous technology caused the event?

A — Actor

Who owned, operated, developed, supplied or maintained it?

C — Conduct

What was done or omitted?

D — Damage

What legally recognised damage occurred?

R — Responsibility

Which legal rule allocates responsibility?

This avoids the mistaken assumption:

“The AI made the decision, therefore the AI is liable.”

30. Fault-Based Liability

Traditional negligence can still operate.

The claimant may need to show:

duty;

breach;

causation;

damage.

For example:

Manufacturer knew a sensor was unreliable → failed to correct it → autonomous vehicle misread obstacle → collision → injury.

Here, ordinary negligence/product-liability principles may provide a basis for liability.

31. Risk-Based Liability

But autonomous systems also justify risk allocation.

This is where Dubai's Article 14 approach is important.

The injured person may claim against the Operator even if the precise internal technical failure is not initially known. The Operator can then seek recourse against the person actually responsible. (Dubai Land Department)

This produces:

Primary compensation

Victim → Operator

Secondary allocation

Operator → responsible manufacturer/developer/etc.

This is more practical than forcing the victim to reverse-engineer an AI model.

32. Product Defect and Software

Autonomous systems blur the boundary between:

product

and

software service.

Suppose a vehicle is physically perfect but its software contains an error.

Is the problem:

defective product;

negligent software development;

contractual breach;

professional negligence;

regulatory non-compliance?

The answer will depend on the applicable legislation and contractual structure.

The DIFC's Digital Economy Court expressly recognises disputes concerning the design, supply and installation of computer software and related IT systems, demonstrating the need for specialised treatment. (DIFC Courts)

33. Cybersecurity and Autonomous Systems

Self-modifying systems may be attacked.

Example:

Hacker alters autonomous vehicle software → vehicle changes behaviour → accident.

Potential liability questions include:

Was cybersecurity adequate?

Was there a known vulnerability?

Was the system patched?

Was the operator negligent?

Was the manufacturer warned?

Was the attack reasonably foreseeable?

Did the attacker break the chain of causation?

Therefore, cybersecurity becomes part of civil liability.

34. Insurance

Autonomous systems create difficulty for traditional insurance.

Traditional model:

Human driver → accident → driver's insurer.

Autonomous model:

Owner + operator + manufacturer + software + data + AI + infrastructure.

Dubai's autonomous-vehicle implementing framework requires licensed comprehensive insurance coverage as part of vehicle licensing. (Dubai Land Department)

This supports the policy of ensuring that compensation is available even where technical attribution is complex.

35. Infrastructure Liability

Autonomous vehicles do not operate independently of their environment.

They depend on:

road sensors;

traffic signals;

digital maps;

GPS;

communications infrastructure;

charging systems;

electronic road infrastructure.

Dubai's implementing rules specifically require electronic infrastructure capable of communicating operational and risk-related information to autonomous vehicles and require infrastructure to accommodate changes in autonomous-vehicle technology. (Dubai Land Department)

Therefore, future cases may involve:

Vehicle + software + infrastructure + data

rather than a single defendant.

36. Causation in Self-Modifying Systems

Causation is one of the hardest issues.

Suppose:

Bad training data

↓

AI changes its decision pattern

↓

Human operator fails to intervene

↓

Cybersecurity vulnerability contributes

↓

Accident occurs

Who caused the damage?

The court may have to consider:

multiple causes;

concurrent negligence;

contribution;

intervening acts;

foreseeability;

system design;

human supervision.

The traditional “single wrongdoer” model may therefore be inadequate.

37. Explainability

A self-modifying AI system may be a black box.

The operator may know:

Input → Output

but not:

Why did the model choose that output?

This creates a civil-procedure problem.

The claimant may need access to:

logs;

model versions;

training information;

sensor data;

system alerts;

update history.

The Dubai autonomous-vehicle framework's operational-data requirements are therefore highly significant. (Dubai Land Department)

38. Human Oversight

A major legal principle emerging from autonomous-system regulation is:

Autonomy does not eliminate responsibility.

Instead, legal systems can shift responsibility from:

moment-to-moment decision-making

to:

system design + authorisation + supervision + maintenance + monitoring.

This is particularly visible in Dubai's phased autonomous-vehicle system, where a safety operator is required during an intermediate phase before fully driverless operation. (Dubai Land Department)

39. Can an AI System Be Negligent?

Technically, an AI system may behave negligently in the ordinary-language sense.

Legally, however, the better question is:

Which human or legal entity owed the relevant duty concerning the system?

The machine's behaviour becomes evidence of breach rather than necessarily becoming an independent legal defendant.

40. Can the Developer Be Automatically Liable?

No.

The developer may be responsible if the evidence establishes a relevant:

design defect;

coding error;

inadequate testing;

failure to warn;

cybersecurity failure;

failure to update;

contractual breach;

statutory breach.

But the fact that software produced an unexpected result does not automatically establish developer liability.

41. Six Important Case Laws — Quick Revision

Important: these are predominantly DIFC authorities and analogous technology cases, not reported UAE mainland cases deciding that an autonomous AI system itself has independent legal personality or liability. As of the present research, the most direct UAE autonomous-system liability rule is statutory—especially Dubai's autonomous-vehicle legislation. (Dubai Land Department)

42. Important Distinction: Current Law vs Future Doctrine

At present, UAE law is developing toward:

human/legal-entity responsibility for autonomous technology

rather than:

independent legal personality for AI.

The likely legal questions in future litigation are therefore not simply:

“Is the AI liable?”

but:

Who authorised the system?

Who controlled it?

Who benefited from it?

Who maintained it?

Who supplied the software?

Who controlled the data?

Who was required to supervise it?

Who was required to insure it?

Who failed to update it?

Who should bear the risk under the applicable legislation?

43. Relationship With the New UAE Civil Transactions Law

The UAE's new Civil Transactions Law became effective on 1 June 2026 and is intended to create a more contemporary and integrated framework for civil rights and obligations. The Government specifically describes it as part of the modernisation of the UAE's legal framework and reduction of duplication with specialised legislation. (UAE Legislation)

This is important for autonomous systems because general civil law will continue to interact with specialised technology legislation.

The likely structure is:

General civil law

specialised autonomous-system regulation

data protection

consumer protection

insurance

sector-specific regulation

=

Autonomous-system liability framework

44. Main Legal Limitations on Autonomous Systems

Self-modifying systems are legally constrained by:

1. Human responsibility

The machine does not automatically become the legal person responsible.

2. Regulatory approval

Autonomous systems may require permits and technical approval.

3. Software-update controls

Material modifications may require regulatory approval.

4. Data protection

Autonomous systems processing personal information remain subject to data-protection requirements.

5. Safety standards

The system must satisfy prescribed technical and operational standards.

6. Insurance

Certain autonomous systems must carry appropriate insurance.

7. Traceability

Operational information may have to be preserved.

8. Expert evidence

Technical evidence must be properly established.

9. Human oversight

Some autonomous operations require safety operators.

10. Civil compensation

Special legislation may place primary liability on an identifiable operator.

45. Practical Problem Example

Assume:

A Dubai autonomous vehicle receives incorrect mapping data.

The AI adapts its route.

It enters an unsafe area.

The safety system fails.

A pedestrian is injured.

Step 1 — Identify the system

Autonomous vehicle.

Step 2 — Identify the operator

Who holds the relevant permit?

Step 3 — Check compliance

Was the vehicle operating within its authorised area and phase?

Step 4 — Check software

Was the autonomous system properly updated?

Step 5 — Check data

Was incorrect mapping data supplied?

Step 6 — Check maintenance

Was the vehicle properly maintained?

Step 7 — Establish damage

What personal/property damage occurred?

Step 8 — Apply Article 14

Operator compensation liability is considered first.

Step 9 — Recourse

Operator may pursue the person actually responsible.

Step 10 — Expert evidence

Technical experts reconstruct the system's operation.

This demonstrates how UAE law can manage autonomous-system harm without first giving AI independent legal personality.

46. Examination Formula

Use:

A-U-T-O-N-O-M-Y

A — Actor
Who is legally responsible?

U — Update
Did software or system behaviour change?

T — Technical evidence
What happened inside the system?

O — Obligation
What duty applied?

N — Nexus
Did the system's behaviour cause the damage?

O — Oversight
Was human monitoring required?

M — Mandatory regulation
Were licensing, safety, data and operational rules satisfied?

Y — Yield/remedy
What compensation or other remedy follows?

47. Conclusion

The UAE's approach to self-modifying autonomous systems is developing through a combination of general civil liability, specialised regulation, data protection, insurance and technology-specific procedural mechanisms.

The most important development is Dubai's autonomous-vehicle framework. Law No. 9 of 2023 expressly defines autonomous vehicles and autonomous driving systems, allocates primary civil liability to the Operator for property and personal damage, and preserves recourse against the person actually responsible. (Dubai Land Department)

The 2025 implementing bylaw adds important requirements concerning software updates, operational-data preservation, maintenance, malfunction records, cybersecurity and insurance. (Dubai Land Department) The 2026 operational-phase framework then moves autonomy progressively from data/map verification, to operation with a safety operator, and ultimately to operation without one. (Dubai Land Department)

At the institutional level, the DIFC's Digital Economy Court framework expressly covers AI, AI-controlled devices, robotics, autonomous organisations, drones and other cyber-physical systems, showing that UAE dispute-resolution structures are adapting to autonomous technology. (DIFC Courts)

The central civil-law principle can therefore be stated simply:

Autonomy of technology does not mean autonomy from law.

The system may make decisions independently, but UAE law continues to locate responsibility through operators, owners, manufacturers, developers, service providers, regulators and other legally recognised persons, supported by rules concerning causation, evidence, data, insurance, safety and risk allocation.