At a press conference on September 30, 2026, launching the UAE's Cyber Security Awareness Month, Dubai Police said it had set up a department dedicated to AI related crime, and that its Electronic Evidence Lab can now examine faces, voices and videos for signs of deepfakes. A Ministry of Interior official warned that deepfakes are no longer limited to short clips and can now produce complete, film quality content and convincing voice imitations.
For compliance teams, that matters in two ways. AI makes some forms of misconduct easier to commit, and makes it easier to fabricate the evidence around them. The UAE government's own Deepfake Guide lists creating false evidence among the ways the technology can be misused. At the same time, AI is changing how organizations receive, understand and investigate reports of wrongdoing.
Both of the UAE's major financial free zones now require structured whistleblowing arrangements. This guide covers what AI enabled misconduct looks like inside an organization, what AI fabricated evidence means for investigations, what the UAE's whistleblowing rules expect, and how AI can strengthen a whistleblowing program without weakening the protections those rules are built on.
What AI enabled misconduct looks like at work
Dubai Police has reported advanced uses of AI in fraud, phishing, data theft and deepfakes. Inside an organization, that translates into misconduct a reporting channel should be ready to receive:
| Type of misconduct | What a colleague might notice | What the reporting channel needs |
|---|---|---|
| Fabricated documents: AI generated invoices, receipts, contracts or screenshots | Documents with details that do not match records, or suppliers nobody has dealt with | A way to attach files, and for investigators to ask follow up questions |
| Impersonation: cloned voices or video of executives used to push payments or extract information | Urgent or secretive requests from a senior person that bypass normal approvals | A fast route to raise a concern before acting, with escalation for urgent cases |
| Misuse of AI tools: confidential company or customer data entered into public AI services | Colleagues uploading files or internal data to free AI tools | A clear category for data and confidentiality concerns, routed to the right team |
| Fabricated allegations: AI generated recordings or images that make a colleague appear guilty | A recording or image about a colleague circulating without a clear source | Confidential handling, so allegations are assessed before they spread |
The misuse of AI tools is easy to overlook because it rarely looks like wrongdoing to the person doing it. Security experts at Gisec Global in Dubai warned that data entered into free AI services may be used to train their models, which can put confidential information beyond the organization's control.
Setting up reporting categories for AI misconduct in advance helps reports reach the right reviewer quickly, and tells employees that the organization wants to hear about them.
The last category is the hardest for compliance teams, because it turns an allegation, and the process for handling it, into a weapon.
When the evidence itself is fake
The best documented example so far comes from the United States.
In January 2024, an audio recording was emailed to teachers at Pikesville High School in Maryland and then spread on social media. It appeared to capture the school's principal making racist and antisemitic remarks. The principal was removed from his post, and his family faced harassment serious enough that police posted a patrol car outside their home.
The recording was fake. Police said the school's athletic director had used AI to clone the principal's voice, and that the principal had opened an investigation into the athletic director's handling of school funds weeks earlier. Proving the recording was fake took months, including review by a forensic analyst contracted with the FBI and a second opinion from a university forensic expert. The athletic director was arrested in April 2024. A year later he entered an Alford plea, maintaining his innocence while accepting there was enough evidence to convict, to a charge of disturbing school operations.
The case was not a fraud in the usual sense. It was a fabricated allegation of misconduct, and it holds three lessons for compliance teams:
- An allegation can now arrive with convincing evidence that is entirely made up. A recording, screenshot or document is no longer proof on its own.
- Acting before evidence is tested can do serious, lasting harm. The person accused was removed from his post and publicly condemned on the strength of a file that turned out to be fabricated.
- Fabrication can be a form of retaliation. Police said the fake targeted the person who had raised concerns about the athletic director's conduct. Protecting people who raise concerns includes protecting them from this.
The recording never went through a reporting channel. It went to inboxes and social media, where nobody assessed it before the damage was done. A confidential, structured process, in which allegations are assessed and evidence is tested before anyone acts, is the alternative.
UAE regulators are seeing AI fabricated proof as well. In September 2026, the Dubai Financial Services Authority (DFSA) warned the public about fraudsters impersonating the regulator, and listed AI generated images presented as proof among the scam's warning signs.
How to test AI generated evidence
A reporting channel receives whatever people submit: screenshots, documents, recordings and video. Some of it may be AI generated. A reporter might attach a fabricated file to support a false allegation, or forward something that looks genuine without realizing it has been manipulated. Either way, investigators need to test the evidence as well as the account. Practical steps include:
- Corroborating against independent records. Check attachments against payment logs, system data, access records and approval trails that the reporter could not have altered.
- Checking suspect media with deepfake detection tools. In September 2026, the Dubai Electronic Security Center (DESC) unveiled Saraab, an AI model developed by an Emirati team that scans videos frame by frame for signs of manipulation. DESC says it reaches up to 91% accuracy and plans to release it as an open source tool by the end of 2026. No single tool can prove a video is genuine or fake, so detection results should support corroboration, not replace it.
- Asking about the source. Where did the file come from, who sent it, and does an original exist?
- Keeping an open mind both ways. A suspect attachment does not mean the underlying concern is false, and a convincing one does not prove it is true. Evidence deserves scrutiny, but reporters should not be treated as suspects.
The third step is harder when the reporter is anonymous. Investigators cannot pick up the phone to ask where a file came from or request the original. Without a way back to the reporter, the report may stall.
Two way anonymous messaging keeps that line of communication open. Investigators can send questions to the reporter through the reporting channel, and the reporter can reply, add context or upload further evidence, without either side learning who the reporter is. Verification can happen inside the channel, so reporters do not have to choose between staying anonymous and being believed.
Why reporting channels remain the strongest detection tool
None of this is a reason to treat reports with suspicion. Tips remain the most common way organizations uncover fraud .
The Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations analyzed 2,402 fraud cases across 143 countries and territories. Its findings make a clear case for investing in reporting:
- Tips detected 43% of frauds, more than any other method, and more than half of those tips came from employees.
- Speed reduces losses. The median scheme ran for 12 months before detection. Frauds caught within six months had a median loss of US$40,000, while those lasting more than five years exceeded US$1.1 million.
- Seniority raises the stakes. Median losses caused by owners and executives were more than nine times greater than those caused by employees.
- People increasingly report online. Web based reporting has overtaken telephone hotlines as a way of submitting tips.
AI does not change this logic. A fabricated recording or document still has to fit the facts around it: who had access, what the records show, what colleagues actually saw. The people best placed to notice when something does not add up are usually those close to the work. That is why a trusted channel, and a careful process behind it, matter more as fabrication gets easier, not less.
What UAE whistleblowing rules require
The UAE's two financial free zones have each introduced a dedicated whistleblowing framework. ADGM's Whistleblower Protection Regulations 2024 came into force on July 5, 2024, with arrangements required by May 31, 2025. The DFSA launched its whistleblowing regime in the DIFC on April 7, 2022. The full requirements are covered in our guides to what DIFC companies need to know about whistleblowing , the whistleblower protection law across the UAE and Saudi Arabia , and whistleblowing policies in the UAE . Three points matter most for this guide:
- Protection applies to disclosures made in good faith. That extends to anonymous reports under ADGM's framework. It makes careful assessment doubly important: it is how genuine reporters are protected, and how bad faith reports, including those built on fabricated evidence, are identified.
- Confidentiality is a core expectation. Protecting reporter identity and the confidentiality of disclosures is expected under both ADGM and DFSA rules, which is why any AI feature has to operate inside it.
- Arrangements must work in practice. According to DLA Piper, ADGM requires written records of protected disclosures to be kept for at least six years, and the DFSA has said it expects every regulated entity to be ready to demonstrate how its whistleblowing policies and procedures work in practice.
Both regimes share one idea: a policy document is not enough. Regulators expect arrangements that work, and evidence that they work.
What AI can do in a whistleblowing program, and what it shouldn't
Used well, AI can remove some of the most common barriers to reporting and some of the biggest bottlenecks in investigation.
Where AI helps
- Language. The UAE is home to more than 200 nationalities with a wide range of languages. A reporting channel that only works well in English or Arabic leaves part of the workforce out. AI transcription lets people report in the language they think in .
- Report quality. Incomplete reports are hard to investigate, especially when the reporter is anonymous. AI can guide reporters with clarifying questions and suggest the kinds of evidence that would help.
- Protecting anonymity. Reporters can reveal their identity by accident, through a job title, a meeting date or a turn of phrase. AI can flag identity revealing language before a report is submitted.
- Triage. When reports arrive in volume, AI can help score urgency, group related cases and highlight patterns across departments or locations , so investigators reach the most serious issues first.
Where humans must stay in control
The UAE's Charter for the Development and Use of Artificial Intelligence, issued in June 2024, sets human oversight as one of its 12 principles, stressing the irreplaceable value of human judgment in correcting errors and biases. In a whistleblowing context, that principle is practical, not abstract:
- Decisions stay with people. AI can summarize, score and recommend. Whether misconduct occurred, and what happens next, should be decided by authorized human investigators.
- AI must not weaken confidentiality. Any AI feature should operate inside the same confidentiality protections as the rest of the program. Protecting confidentiality and reporter identity is a core expectation under both ADGM and DFSA rules.
- Every action should be traceable. If AI assists in a case, its suggestions and the human decisions that followed should be logged, so the organization can demonstrate fair handling .
- Evidence still needs checking. AI can help organize and prioritize reports, but it cannot confirm that an attachment is genuine. Corroboration and follow up with the reporter, covered above, remain human tasks.
An ADGM court ruling shows the same principle in practice. In 2025, ADGM's Court of First Instance ordered a law firm to pay AED 282,508 in wasted costs after its pleadings relied on legal authorities that did not exist and bore the hallmarks of AI "hallucinations." The court held that relying on AI did not remove the firm's duty to verify. The same logic applies to investigations.
A practical checklist for AI assisted whistleblowing
Use these questions to assess a current setup, or any platform you are considering.
| Question | Why it matters |
|---|---|
| Can people report anonymously, in their own language, through web, mobile and voice? | Accessibility drives reporting, and the ACFE data shows tips are the leading detection method |
| Does AI help reporters protect their identity? | Reporters can reveal who they are without realizing it |
| Can investigators follow up with anonymous reporters? | Without follow up, incomplete anonymous reports often cannot be investigated |
| Are AI outputs recommendations, with decisions left to people? | Reflects the human oversight principle in the UAE AI Charter |
| Is every action, including AI suggestions, logged with timestamps? | Supports the DFSA's expectation that firms can demonstrate their procedures |
| Can sensitive cases be routed away from people who may be implicated? | Protects confidentiality and guards against retaliation |
| Are records retained for the required period? | According to DLA Piper, ADGM requires records of protected disclosures to be kept for at least six years |
Where iVoiceUp fits
iVoiceUp was built to help organizations across the Middle East run whistleblowing programs that work in practice. The platform and its AI capabilities are designed around the principle that AI recommends and humans decide, supporting both the reporting process and the investigation that follows:
- AI Hotline. Employees can report by speaking naturally in their own language, including Arabic and English. The report is transcribed, structured and categorized, with voice anonymization.
- Reporter AI Assistant. Guides people through reporting, asks clarifying questions and warns them about details that could reveal their identity.
- Vincent, the AI investigator assistant. Summarizes case history, answers investigators' questions and suggests next steps, helping investigators review information while keeping decisions in human hands.
- Two way anonymous communication. Investigators can ask reporters for more detail through an anonymous follow up chat, so they can check facts, clarify timelines and ask where evidence came from without exposing the reporter's identity. Documents, images and audio can be attached to the case record, giving investigators one place to review evidence.
- Human reviewed decisions and full audit trails . Final decisions remain with authorized investigators, and every AI suggestion, action and access event is logged with role based access controls.
The platform also includes AI sentiment and risk scoring, duplicate and related case detection, and configurable categories and routing, so reports about issues such as AI misuse reach the right reviewer. The AI page has the full list. AI features can be enabled per workspace and per workflow, so compliance teams decide where AI is used.
To see how this works for your organization, explore iVoiceUp for compliance teams , legal teams and audit and risk teams , or book a demo .
Frequently asked questions
Is whistleblowing mandatory for companies in the UAE?
In the UAE's two financial free zones, specific rules apply. All ADGM registered entities must have whistleblowing arrangements under the Whistleblower Protection Regulations 2024, and all DFSA Regulated Entities in the DIFC must have whistleblowing policies and procedures. Companies elsewhere in the UAE should check the requirements of their own sector regulator. For the wider picture, see our briefing on whistleblowing compliance in the UAE in 2026 .
Can AI make decisions in a whistleblowing investigation?
It shouldn't. The UAE's AI Charter emphasizes human oversight, and good practice is for AI to support investigators with summaries, scoring and recommendations while authorized people make the decisions.
Are anonymous reports protected in ADGM?
Yes. ADGM's whistleblowing framework includes protection for anonymous reporting made in good faith.
How do deepfakes affect whistleblowing?
AI makes it easier to fabricate convincing evidence, so a recording or document attached to a report is no longer proof on its own. Investigators should corroborate attachments against independent records, use deepfake detection tools, such as DESC's Saraab once it is released, and ask reporters where files came from. The aim is to test evidence carefully without discouraging genuine reporters.
Can employees report in Arabic and other languages?
That depends on the platform. iVoiceUp's AI Hotline supports natural language voice reporting and transcription in the languages used by your workforce, including Arabic and English.
Sources
- ADGM, Whistleblowing: obligations of ADGM registered entities
- DLA Piper, ADGM introduces new protections for whistleblowers, July 2024
- Dubai Financial Services Authority, DFSA introduces Whistleblowing regime, April 7, 2022
- Association of Certified Fraud Examiners, Key Findings from Occupational Fraud 2026: A Report to the Nations, May 2026
- Baltimore County Police Department, Athletic Director Charged in Pikesville High School AI Case, April 2024
- The Baltimore Banner, Pikesville High former athletic director charged over AI generated audio of principal, April 2024
- CBS News Baltimore, Baltimore man accused of framing school principal with an AI generated rant takes a plea deal, April 28, 2025
- The Register, Cops cuff man for allegedly framing colleague with AI generated hate speech clip, April 25, 2024
- WAM, Ministry of Interior rolls out 'UAE is Safe With Your Digital Awareness' campaign to mark Cybersecurity Awareness Month, September 30, 2026
- Emirates 24|7, UAE cyber warning 2026: AI is now being used for deepfakes, fake job ads and home camera hacking, October 1, 2026
- WAM, UAE National Programme for Artificial Intelligence launches guide to illustrate uses of 'Deepfake' technology, July 7, 2021
- The National, Dubai cyber chief urges public to be vigilant over AI powered deepfake threat, September 17, 2026
- Emirates 24|7, Dubai develops AI model that detects deepfake videos with 91% accuracy, October 4, 2026
- Gulf News, Dubai regulator warns of AI scam using fake 'box of cash and gold', September 2026
- UAE Legislation, The UAE Charter for the Development and Use of Artificial Intelligence, issued June 10, 2024
- UAE Ministry of Foreign Affairs, Facts and Figures
- iVoiceUp, AI Powered Whistleblowing and Case Management
- iVoiceUp, Case Management
This article is for general information and is not legal advice. Check the current versions of the relevant regulations and take advice on your organization's specific obligations.
