[Home](/)/[Resources](/resources)/UAE Cybersecurity Law for Hardware UAECybersecurity # UAE Cybersecurity Law: What Connected Hardware Makers Must Know The UAE Federal Decree-Law No. 34 of 2021 on Combating Cybercrimes is the UAE's primary cybersecurity legislation — a criminal law that makes it an offence to exploit, access without authorisation, or damage electronic systems and devices. For hardware companies, the relevance is less about being prosecuted for cybercrime and more about understanding the security expectations the law creates for connected products placed on the UAE market. The UAE Cybersecurity Council, established by Cabinet Resolution No. 11 of 2020, is developing a broader product security framework that will progressively shape what IoT and connected device makers must implement. Understanding the current framework and its direction is essential for hardware companies building connected products for UAE customers. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fuae-cybersecurity-law-hardware) At a glance Key legislation Federal Decree-Law No. 34 of 2021 Policy body UAE Cybersecurity Council Telecoms regulator TDRA Max fine AED 5 million ## UAE cybersecurity framework for connected hardware ### Federal Decree-Law No. 34 of 2021 The Cybercrimes Law criminalises unauthorised access to electronic systems, interception of electronic communications, distribution of malware, and exploitation of security vulnerabilities. For hardware companies, the relevant exposure is in products that ship with known, exploitable vulnerabilities — if a third party uses your product's vulnerability to access another system, the product's security design is scrutinised. ### The UAE Cybersecurity Council The UAE Cybersecurity Council, established in 2020 and chaired by a Minister of State, sets national cybersecurity strategy and policy. The Council is working on product security standards and 'cyber hygiene' requirements for connected products that go beyond the criminal law framework — similar in intent to the EU's Cyber Resilience Act or the US FCC Cyber Trust Mark. ### TDRA's role in connected product security The Telecommunications and Digital Government Regulatory Authority (TDRA) is the operational regulator for telecommunications and digital services. TDRA issues guidance on cybersecurity requirements for telecoms products and services, and its type approval process for radio and telecoms equipment is beginning to incorporate security assessment elements — firmware update capability, default password prohibition, and authentication requirements. ### Critical infrastructure and industrial hardware UAE critical infrastructure operators (energy, utilities, transport, finance) are subject to the National Information Assurance (NIA) framework, administered by the Cybersecurity Council. Hardware sold into critical infrastructure sectors must meet NIA cybersecurity requirements, which include both technical security controls and supply chain security assessments. International suppliers to UAE critical infrastructure must typically agree to security audit rights. ### Dubai's D33 Agenda and smart city requirements Dubai's 33-year Economic Agenda (D33) includes significant smart city and connected infrastructure programs. Hardware entering Dubai government procurement channels is subject to DEWA (Dubai Electricity and Water Authority), RTA, and Smart Dubai cybersecurity specifications — often more detailed than federal minimum requirements. ## Connected product security compliance steps 01 Review your connected product's default security configuration: default passwords (must be unique per device or require change at first use), open network ports (all unnecessary ports must be closed), update mechanism (must be encrypted and authenticated), and vulnerability disclosure policy. 02 Ensure firmware and software update mechanisms are designed for operation in UAE network environments — GCC network operators have specific filtering behaviours that can affect OTA update delivery. Test update mechanisms from UAE-based IP addresses and through local network environments if UAE is a significant target market. 03 For hardware destined for UAE government or critical infrastructure channels, engage directly with the procuring entity about NIA compliance requirements before the sales process advances — NIA requirements are typically included in tender specifications and failure to meet them disqualifies bids. 04 Establish a vulnerability disclosure mechanism and response policy that meets the UAE Cybersecurity Council's expectations. While a formal vulnerability disclosure policy is not yet mandated by law for product manufacturers, the Council has signalled this direction and international cybersecurity procurement standards increasingly require it. 05 Monitor TDRA type approval updates — TDRA periodically updates its type approval requirements and testing standards. Connected hardware that received type approval under earlier requirements may need reassessment when TDRA updates its security requirements for the equipment category. ## Frequently asked questions ### Does UAE cybersecurity law require specific technical security standards for IoT hardware? Not yet — in explicit technical standard form comparable to EU CRA Annex I requirements. The UAE Cybersecurity Council's product security requirements are still being developed. What exists is a criminal law framework (Decree-Law 34/2021) that creates liability exposure for operators of insecure systems, TDRA guidance on telecoms product security, and NIA requirements for critical infrastructure. Hardware companies should build to international IoT security baselines (ETSI EN 303 645, NIST SP 800-213) as a proactive measure. ### Can a UAE consumer take legal action against a hardware maker for a security vulnerability? Directly under the Cybercrimes Law, no — the law targets cybercriminals, not hardware makers. But under the Consumer Protection Law No. 15 of 2020, a consumer who suffers harm from a defective product (including a product with a security defect that enabled a harmful outcome) can seek remedies. UAE courts are still developing jurisprudence on this intersection. ### Is there a UAE equivalent of the EU's 24-hour vulnerability reporting requirement under CRA? Not currently. The UAE doesn't have a statutory vulnerability reporting timeline for product manufacturers equivalent to the EU CRA's 24-hour active exploitation and 72-hour vulnerability notification windows. However, UAE CERT (aeCERT) operates as a national cyber incident response centre and expects voluntary notification of significant incidents from operators — including incidents involving connected hardware products. ### What is the maximum penalty under the UAE Cybercrimes Law? Federal Decree-Law No. 34 of 2021 provides for custodial sentences and fines that vary by offence category. The most serious offences — attacking critical infrastructure, distributing malware at scale — carry imprisonment sentences of up to 15 years and fines up to AED 5 million (approx. USD 1.4 million). For hardware makers, the more direct legal risk comes from civil liability under Consumer Protection Law and the potential loss of TDRA type approval for non-compliant products. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇦🇪 UAE roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇦🇪 UAE compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/51-uae-moiat-ecas-conformity-consumer-electronics)[Prefer to read? Get the book — $24.99](/books/51-uae-moiat-ecas-conformity-consumer-electronics) Related guides * [UAE Cybercrime IoT HardwareUAE Federal Decree-Law 34/2021 cybercrime law for IoT hardware: unauthorised access offences, TDRA type approval for connected devices, ETSI EN 303 645 alignment, UAE Personal Data Protection Law interaction, and criminal penalties for connected device security failures.](/guides/uae-cybercrime-iot-hardware) * [UAE Data Protection PDPLUAE Federal Decree-Law No. 45 of 2021 (PDPL) for connected product makers: data collection obligations, cross-border transfers, and Arabic privacy notices.](/guides/uae-data-protection-pdpl) * [Japan METI IoT Security GuidelinesJapan METI's IoT security guidelines for connected hardware makers: baseline security requirements, the labeling scheme for IoT security conformance, and how this relates to Japan's broader APPI data protection obligations.](/guides/japan-iot-security-guidelines)