In short In short: from 6 October 2026, any licensed UAE event with more than 200 simultaneous attendees or a temporary network (ticketing, cashless payment, check-in or live broadcast) must report confirmed cyber incidents to the relevant emirate authority within four hours of detection, and disclose the use of biometric or AI-driven crowd analytics on the event's public data sheet. Carving Dreams is updating its planner pre-flight pack to capture both obligations before a permit is filed, because the disclosure boxes are now checked at permit stage, not after.
Last checked against the sources below: 6 October 2026.
Why the rule lands now, and what actually triggers it
The TDRA addendum, issued on 29 September 2026 and effective 6 October 2026, is technically a tightening of the existing National Cybersecurity Standards rather than a new law. What is new is the carve-out for licensed events, which until now sat in a grey area between venue operations, telecom licensing and the personal data protections already enforced by the UAE Data Office. From 6 October, the regulator has decided that if an event looks like a network to a customer, it is a network to the regulator as well.
Two thresholds, both of which must be met in practice, bring a planner inside the regime. The first is scale: more than 200 simultaneous attendees on site, or any ticketed capacity above 500 in a 24-hour window. The second is technology: a temporary network of any kind used to process attendees, including but not limited to ticketing, cashless payment wristbands, RFID or QR check-in, live broadcast uplinks, and any on-site biometric or AI-driven crowd analytics. A corporate retreat with 150 guests and a paper sign-in sheet is unaffected. A 300-person product launch with facial recognition gates and a live stream is fully in scope.
For Carving Dreams, the operational change is small and the paperwork change is large. We have added a single-page cybersecurity annex to our standard planner pack, covering the four-hour reporting clock, the disclosure language for biometric and AI crowd analytics, and the named accountable person the authority will want to see on the form. That person does not have to be the IT vendor. Under the addendum they can be the event manager, but they must be reachable on the number written on the form for the full duration of the event plus 72 hours.
It is worth saying what the rule is not. It is not a data protection law in the GDPR sense. It does not require a privacy impact assessment at permit stage. It does not override the UAE Data Office's consent rules for biometric processing, which still apply and are still enforced separately. What it does is create an obligation to tell the regulator that you are doing these things, and to tell the regulator very quickly if something goes wrong with them. The cultural shift is from a planner being able to say we have a great IT partner to a planner being able to say we have a great IT partner and I am personally accountable for what they do.
The four-hour reporting clock: what counts, what does not
The four-hour clock starts at confirmed detection, not at suspicion. Confirmed detection, in the regulator's own guidance, means an event's accountable person has received a written notification from their IT vendor, security operations centre, or hosting provider that an incident has occurred. A vague phone call is not confirmed detection. A Slack message that says we are looking into something is not confirmed detection. A signed incident report from a named technician with a date, time and a one-line description of impact is confirmed detection.
What is reportable within the four-hour window is narrower than the press releases around cybersecurity usually suggest. The addendum lists three trigger categories. The first is unauthorised access to attendee personal data, which in this context means the contact, payment, or biometric data processed through the event's temporary network. The second is service disruption to ticketing, check-in, or payment systems lasting more than 15 minutes and affecting more than 10 percent of attendees in the affected window. The third is any compromise of biometric or AI crowd analytics systems, regardless of whether data was exfiltrated, because the regulator has decided the integrity of those systems is itself the protected interest.
What is not reportable under the addendum, and planners should not waste the four hours on, is general venue Wi-Fi issues that do not touch attendee data, social media account takeovers for marketing handles, and the failure of an unrelated third party such as a national telecom outage. These remain operational matters and are handled through normal venue and provider channels.
The reporting destination depends on the emirate. In Dubai, the addendum routes to the Dubai Electronic Security Center (DESC) via the existing cybersecurity incident portal. In Abu Dhabi, it routes to the Abu Dhabi Digital Authority's Cyber Defence unit. Sharjah and Ras Al Khaimah route through TDRA's federal portal with a copy to the local municipality. The form is short, but the four-hour window is not generous, so the practical advice is to pre-register the event and its accountable person on the relevant portal before the event opens its doors, not after. Carving Dreams now does this as a default step in the permit pack.
A common question is whether the four-hour clock runs during the event or only after. It runs continuously, including overnight and across weekends. There is no after-hours extension. If a planner is running a 24-hour activation with a live broadcast uplink, the accountable person must be reachable on the form-listed number for the full 24 hours, and for 72 hours after the event closes. This is the part of the addendum that has caused the most friction in the early industry briefings, because it puts a real human on the hook for a real window of time.
The biometric and AI crowd analytics disclosure box
The second, and in many ways more interesting, part of the addendum is the disclosure box for biometric and AI crowd analytics. From 6 October, if an event uses any system that captures, infers, or acts on biometric data of attendees (facial recognition, fingerprint, iris, or voice) or any AI system that makes per-attendee decisions about crowd flow, dwell time, queue placement, or content targeting, this must be disclosed on the public event data sheet that is published on the venue or organiser's site before ticket sales open.
The disclosure is short, written in plain language, and is meant to be read by attendees. The required text covers three things: what the system is, what it is used for, and how long the data is held before deletion. Planners who have been using AI camera analytics for queue management and have not thought about this as a public-facing disclosure are the planners most at risk, because the disclosure box is now checked at permit stage by the municipality, not by the data protection authority after the fact. If the box is not filled in accurately, the permit can be returned for amendment, which in a tight production window is the same as a denial.
For most events this is a paperwork issue rather than a system change. The systems that already exist at the venue, such as a hotel ballroom's existing facial recognition access control, do not need to be re-disclosed by the planner. The disclosure applies to systems brought in for the event, or systems that are used in a new way for the event. A corporate conference using a venue's existing badge readers does not need to disclose. The same corporate conference hiring a temporary facial recognition wall for VIP fast-track entry does.
The disclosure is not a consent mechanism. Consent for biometric processing remains a separate requirement under the UAE Data Office's rules, and the addendum explicitly says so. What the addendum does is make sure that the existence of the system is not a surprise to attendees when they walk in. The regulator's working assumption, repeated in the early industry briefings, is that attendees have a right to know whether they are being scanned, fingerprinted, or algorithmically routed before they decide to enter.
What Carving Dreams is changing in the planner pack
Our planner pack now has a single cybersecurity annex that captures the four-hour reporting destination, the named accountable person with their 24/7 number for the event plus 72 hours, a one-line description of any biometric or AI crowd analytics system in use, and a tick-box for the four trigger categories. The annex is signed by the planner, the venue's duty manager, and the IT vendor's named lead before permit submission. This is a small change, but it is the change that will keep a permit moving.
For productions where the planner is also the accountable person, we recommend a deputy. The four-hour clock is unforgiving, and the regulator has made clear that a deputy with delegated authority is acceptable, provided the delegation is in writing and is filed with the permit. We have a template for this, and we are sharing it without charge to planners we work with on recurring events.
For productions that sit just below the thresholds, such as a 180-person corporate retreat with paper sign-in and no cashless payment, the annex is not required. We will still run a short pre-flight on the IT vendor's data retention policies, because a planner who promises attendees a paper sign-in and then quietly runs a digital one is in a worse position than a planner who is fully in scope and has filled the form in correctly.
Questions
- Does the four-hour clock apply if the IT vendor discovers the incident but the planner does not?
- No, the clock starts at confirmed detection, which the regulator defines as a written notification from the IT vendor or security operations centre. A planner who has not received such a notification is not yet on the clock, but is expected to chase a status update from the vendor as soon as a credible issue is raised.
- Is a venue's existing facial recognition access control something the planner has to disclose?
- No, the disclosure applies to systems brought in for the event or used in a new way for the event. A venue's existing badge readers and access control do not need to be re-disclosed by the planner, though the venue's own disclosures to attendees may apply.
- What happens if we fill the disclosure box in but the system is later removed?
- The disclosure is a snapshot at permit submission. If the system is removed before the event opens, the planner should notify the municipality in writing and the permit will be updated. If the system is added after permit submission, the permit must be returned for amendment before doors open, which in practice means a same-day re-submission.
Sources
Planning something in the UAE?