What AI cannot do for a Dubai brokerage, and the consent risks to check with a lawyer

What AI cannot do for a Dubai brokerage

AI is good at drafting, summarising and sorting. It is not good at being accountable. A chatbot does not hold a licence, cannot be fined and does not know when it is wrong. In a brokerage, four kinds of work should stay with a person:

• Promises about price: a bot that says "the owner will accept 2 million" or offers a discount has made a commitment the business may have to explain. Misleading price claims are also an advertising risk.
• Fee and legal statements: transfer fees, mortgage rules, visa eligibility, contract terms. These change and must come from a checked source.
• Negotiation: reading a buyer's mood, knowing when to hold and when to move. A model does not know the owner's real position.
• Anything regulated or tied to a permit: advertising needs a Trakheesi permit (the official ad permit from DLD and RERA, the Real Estate Regulatory Agency) with its number in every ad, and an AI cannot generate or verify that number. Video cuts have their own required fields, listed in Dubai property video rules.

Can AI replace agents in Dubai? Not in the work that makes money: trust, local knowledge, negotiation and being present. It can take the typing and the first reply off their plate. I cover the useful parts in real estate AI in Dubai.

Where AI goes wrong: five typical errors and how to catch them

1. Invented facts: an amenity the building does not have, a metro station that does not exist. Catch it by requiring the AI to use only pasted facts and list what it used.
2. Wrong or outdated numbers: a fee, price or yield from memory. Catch it by keeping figures as placeholders filled from official sources.
3. Confident wrong answers on the rules: a bot explaining escrow (the regulated account that holds buyer payments for a project), Oqood (registration of an off-plan sale) or ownership rules incorrectly. Catch it by blocking the bot from legal explanations and routing to an agent.
4. Promises nobody authorised: a discount, a deadline, a guaranteed return. Catch it with a hard instruction and a sample of conversation logs read every week.
5. Wrong person, wrong record: a message sent to the wrong contact or a note filed against the wrong lead. Catch it with a confirm step before anything is saved or sent.

I do not have a measured error rate for any of these in Dubai, so I will not quote one. Test your own setup on real conversations.

Tasks to keep human, with the reason for each

Task	Why it stays human
Price and discount statements	Creates a commitment and an advertising risk
Fee, tax and legal explanations	Wrong statements damage trust and can harm the client
Negotiation	Needs judgement about the owner's real position
Buyer-protection explanations (escrow, Oqood)	A mistake affects the client's money and your standing
Anything with a permit number	AI cannot generate or check it
Deciding who may be contacted	This is a consent and conduct question

What the sources agree on about consent, and where they disagree

I read vendor guides, law-firm notes, government pages and the platform rules of Meta (the company that owns WhatsApp). They agree on the basics: get clear permission before marketing to someone, say who you are, make stopping easy and keep a record. They disagree on details such as how long to keep records, whether the law covers WhatsApp by name, and whether secondary-source claims about fines are right. Several vendor guides contradict each other, and some mix certifications with legal compliance. Treat vendor compliance guides as a starting list of questions, not as the law.

It helps to separate four layers that guides tend to blend:

1. Federal data protection law: the PDPL (Personal Data Protection Law), covered below.
2. Your trade regulator: DLD and RERA conduct rules.
3. Telecom and marketing rules: the national telemarketing rules and the telecoms regulator's guidance.
4. Platform policies: Meta's rules for WhatsApp.

The one official Dubai rule on contacting owners: DLD Circular 02-2026

This is the clearest official text I found. DLD Circular 02-2026, dated 26 February 2026 and addressed to brokerage offices, prohibits obtaining data on property owners or investors by unlawful means, and prohibits direct contact with them by phone or other communication channels to offer, market or purchase property. The exception is clients with duly documented prior transactions or a contractual relationship, where the office keeps an approved record and submits it to the authority on request. On a complaint, the stated penalties include a violation against the office and the broker, a fine of AED 50,000 and/or a three-month suspension, and permanent revocation of the broker's registration for repeat violations.

Two points for AI. First, the rule applies to the office whatever the channel, so a bot or an automated sequence is covered in the same way as a person. Second, a purchased list of owner numbers is exactly the kind of data the circular warns against. I stress that this circular is about owners and investors. I did not find it saying anything about consented lists of buyers or renters, and I would not describe it as a general ban on WhatsApp marketing. Older RERA enforcement shows the same direction: in April 2022 RERA fined a brokerage AED 50,000 and suspended nine brokers for three months over cold calling. For more on calls, see cold calling rules and tools in the UAE.

PDPL in plain words: what is confirmed and what is still reported

The PDPL is the UAE's federal personal data protection law (Federal Decree-Law 45 of 2021). The UAE government portal says it applies to personal data processed wholly or partly through electronic systems, prohibits processing without the owner's consent subject to listed exceptions, and names the UAE Data Office as the federal regulator. An independent law-firm reference (status as of January 2025) adds that the law gives people a right to object to direct marketing, and that the law itself sets no penalties. The same source said the executive regulations (the detailed rules) had not been published at that time.

Whether the regulations have been issued since, I could not confirm from an official page. Secondary sources mostly say not yet, but some vendor pages say otherwise and give a 2027 deadline. Treat all of that as reported, and ask the UAE Data Office or your lawyer. I would also not quote any PDPL fine: I did not find one in an official source, and one law-firm source says the law does not set penalties itself. For a practical view of client data, see PDPL and client data for Dubai brokerages.

Marketing calls and messages: what I can state

Separately from the PDPL, UAE telemarketing rules exist. Under Cabinet Resolution 56 of 2024, the telemarketing rules are described as covering marketing text messages and marketing messages sent through social media apps, not just phone calls, and as applying to licensed companies including free zones. Marketing calls are limited to 9am to 6pm and you must not call numbers on the national Do Not Connect Register. The telecoms regulator (TDRA) guidance for marketing text messages requires prior explicit consent, a free unsubscribe option in every message and sending only between 07:00 and 21:00. Penalties are set by Cabinet Resolution 57 of 2024, with company fines in a range of AED 10,000 to AED 150,000 and possible suspension of 7 to 90 days or licence cancellation.

Caveats: the resolution does not name WhatsApp, and I would not say the 9am to 6pm window strictly applies to WhatsApp messages. The prudent approach is to treat WhatsApp marketing like other marketing messages: only to people who asked or opted in, within the daytime window, always with a way to stop. Confirm the exact scope with a lawyer or the relevant authority. I checked the resolutions' English texts and TDRA's own guidance, but rules change, so confirm the current text.

WhatsApp is a platform policy as well

Meta, which owns WhatsApp, requires businesses to get opt-in before messaging people on its business platform. The opt-in must say the person is agreeing to receive communication from the business and name the business. Meta leaves the method to the business and recommends clear opt-out instructions and separate opt-ins per message category. That is a Meta rule, not UAE law, but breaking it can get your number restricted. If you plan broadcasts, see WhatsApp Business API.

How software helps: consent records, opt-out handling and review queues

This is where tools earn their keep, because the failures are mostly about process, not intention.

• Consent records: store who consented, to what wording, when, on which channel and for which purpose. A field in your CRM (the database of leads and deals) plus a timestamp does it. This satisfies Meta's policy and is consistent with every guide, whatever the law ends up requiring.
• Opt-out handling: a "stop" reply should immediately remove the contact from every sequence. Test this. A sequence that keeps sending after an opt-out is a classic failure.
• Source tagging: mark each lead's origin (portal enquiry, referral, event) so you can show the lawful route for contacting them, and keep owner contacts from unknown sources out of campaigns. See QR code lead capture at show units and events.
• Review queues: AI drafts replies and a person approves anything involving price, fees or legal points.
• Guard-rails in the bot: a rule that any question on fees, legal or discounts is handed to an agent.

I build consent and opt-out tracking into brokerage CRMs and bots as a small custom piece when the ready-made tool does not do it. What the software cannot do is decide whether you have a lawful basis. That is the lawyer's job.

Try it yourself with Claude, an AI assistant. Paste in your own message template and sequence plan, with no client data, and ask:

Review this outreach sequence. List every point where a recipient might not have consented, where there is no clear way to stop, and where the message states a price, fee, return or legal point. Do not give legal advice. Produce a list of questions I should ask my lawyer.

Calls and recordings: what to ask a lawyer

Recording rules are commonly reported as requiring consent, and some sources quote criminal penalties. The article numbers and fine amounts in those sources conflict, and I could not retrieve primary text, so I will not repeat any. A practical habit is to tell the caller that the call is recorded and transcribed and to log that you did. Do not rely on that alone: ask a lawyer about notice wording. My general article is call recording and AI calls consent rules, and the brokerage version of the workflow is in AI call notes and CRM entry for agents.

Disclosure that a caller is speaking to a bot: I did not find a federal rule requiring it, and one source says the DIFC (the financial free zone) has a regulation requiring notice of non-human processing, which I could not check against the primary text. Telling people is good practice anyway.

On record keeping, anti-money-laundering (AML) law is a separate duty. Under the UAE AML rules, brokers as designated non-financial businesses must keep due diligence and transaction records, including business correspondence, for at least five years from defined end dates. The rules do not name chat apps, so whether a client WhatsApp thread counts is an interpretation. Client messages tied to a customer or transaction are likely to count as business correspondence. Ask your lawyer, and note that this is not a DLD or RERA chat rule.

A checklist to bring to your lawyer

1. Does the PDPL apply to our brokerage, and have the executive regulations been issued?
2. What is our lawful basis for contacting portal leads?
3. What notice wording should the brokerage use for call recording and transcription?
4. Must the brokerage tell people they are talking to an AI?
5. Which AI vendors will hold client data, and where is it stored?
6. How long should the brokerage keep chats, recordings and consent records?
7. Does transferring data to AI vendors abroad raise issues?
8. Who handles opt-outs and data requests?
9. Do our vendor contracts cover data use and training?
10. How do the telemarketing rules apply to our WhatsApp marketing?

How would I approach this?

I would write the human-only list into your team rules first, then add consent and opt-out tracking before any bot goes live, and keep every price, fee and legal answer with an agent. I would take the checklist above to a UAE lawyer before switching on recording or broadcasts. I would not rely on any vendor's compliance claim, including mine, as a substitute for that advice.