Dubai's KHDA — Age-Staged AI Access and Data-Protection Rules for Private Schools

Dubai's Knowledge and Human Development Authority (KHDA), which regulates the emirate's large private-school sector, has built generative-AI governance around a staged, age-based access model rather than a blanket ban or blanket permission. Early years and lower-primary students get no independent access to open generative-AI tools — usage is teacher-led. Upper-primary and lower-secondary students are introduced gradually in supervised, group-based activities teaching ethical prompting, bias recognition and fact-checking. Only secondary and older students move to supervised individual use, and AI use is banned outright during formal assessments across all age groups.

Schools must document what personal student data they collect, where it is stored and who has third-party access; no personally identifiable or sensitive health/behavioural data may be entered into public models; vendors must be contractually barred from using student inputs to retrain their models; and schools are expected to run Data Protection Impact Assessments before deploying new AI services, under the UAE's federal Personal Data Protection Law (PDPL). This sits alongside a separate national policy: in May 2025 the UAE Ministry of Education made AI instruction compulsory in public schools from kindergarten through secondary school.

The framework is honestly incomplete by KHDA's own account: a school principal told reporters there is presently no approved or centrally issued list of AI platforms from KHDA for school use, leaving individual schools to conduct their own due diligence — a real gap between the stated principles and centralised enforcement. As KHDA's Rumaisah Wajid put it, 'The challenge is no longer access to tools, but ensuring their quality, safety, and relevance.'