UAE e-commerce website requirements: Decree-Law 14/2023 turned into page elements

Two kinds of text dominate what is written about the UAE e-commerce law. Law firms explain what the statute says. Company-formation firms explain which licence you need before you may sell at all. Both are correct and neither answers the question a person building a shop actually has, which is: which sentence of the law produces which element on which page, and how do I check that the element is really there.

This article is that translation. Every clause quoted below was read in the English text of Federal Decree-Law No. 14 of 2023 on Trading by Modern Technological Means, in the PDF published on the Ministry of Economy and Tourism's document server, retrieved on 28 August 2026. The article numbers are the ones printed in that file, so you can open it and read the sentence yourself.

Two notes before the content. This is a description of statutory text and of build decisions, not legal advice, and it does not make any site compliant. It makes elements present and checkable, which is a smaller and more honest claim. And the file quoted here is an English translation of an Arabic statute. Where a single word decides a design question, have the Arabic original read by a lawyer before you build on the English wording.

In force since 2023, enforceable in detail since 2025

The dates matter more than they usually do, because the obligations and the sanctions arrived two years apart.

The decree-law itself was issued at the Presidential Palace in Abu Dhabi on 4 September 2023 (18 Safar 1445 H). Its final provision, Article 21, says it "shall be published in the Official Gazette and shall come into force as of the next day of its publication". So the obligations in Articles 5, 6 and 7 have been live since autumn 2023.

What was missing until recently was the price of ignoring them. Article 19 does not contain a fine schedule. It instructs the Ministry, in coordination with the Competent Authority, to prepare a list of violations and administrative penalties "and it shall be issued by a Cabinet decision", and it adds that these penalties "shall not prejudice the penalties or sanctions stipulated in other legislations".

That Cabinet decision now exists. Cabinet Decision No. 200 of 2025 on the list of violations and administrative penalties for acts committed contrary to the decree-law is published on the Ministry's own initiative page for this law, as an Arabic PDF, alongside the decree-law itself. According to the reading published by BDO Legal in the UAE, which we have not been able to check against the Arabic original because that file has no text layer, the decision came into force on 28 November 2025 and is built as an escalation rather than a flat tariff:

• a written warning first for most violations, with a rectification window of 15 days
• a financial penalty on the repeat, in a range reported as AED 500 to AED 100,000 depending on the breach
• temporary or permanent closure available from the third offence onwards
• continuing a violation after the warning period has expired counted as a new and separate violation, not as a continuation of the first
• discretion for the Ministry to go straight to the maximum where a breach is serious enough
• a grievance that the affected party may file within 30 days of notification and that must be decided within 30 days, with silence treated as rejection and the decision on it final

Two things follow for a shop owner. First, on that structure an initial finding is a deadline rather than a bill, which makes the practical question whether you can fix a missing page or a missing invoice field inside 15 days. Second, the escalation counts violations, so the same unfixed defect found three times is a different matter from three separate small defects.

As of August 2026 we have read the escalation only in law-firm commentary and not in the Arabic source, so treat the amounts above as reported rather than verified, and have the schedule read by a lawyer before you rely on any specific figure.

Who the law applies to, in five lines

Article 2(1)(b) applies the decree-law to any person who engages in a commercial activity through modern technological means "inside the State or those received from outside it", which pulls in foreign sellers shipping into the UAE.

Article 2(1)(c) is the line to read twice if you hold a free-zone licence. The decree-law applies inside free zones in two cases: when goods or services bought through modern technological means are provided or sold "outside the geographical scope of the free zone", and when the free zone has no legislation of its own regulating this kind of trade. A webshop run from a Meydan or IFZA licence that ships to a customer in Deira is selling outside the geographic scope of its zone.

Article 2(1)(d) extends the same test to the financial free zones outside the scope of financial business and services.

Article 2(2) takes four things back out: government procurement, platforms and applications used for non-commercial purposes, digital currencies under Central Bank supervision, and transactions of financial institutions and insurance companies licensed and supervised by the Central Bank.

So: if you are a UAE-licensed company selling goods or services to people through a website or an app, and you are not a bank, assume it applies to you. The free-zone address does not remove you from it.

The table this article exists for

Left column: the norm. Middle: what the text says, shortened. Right: the element it produces.

Article	What the text says	Element it produces
Art. 2(1)(c)	Applies in free zones when the sale reaches outside the zone, or the zone has no own rules	Not an element. Decides whether the rest of the table is yours
Art. 5(5), first limb	Determine prices and the fees for logistics and digital payment services, and make them publicly available on the website or app	Shipping-and-fees page, reachable without cart or login. Same figures in the basket
Art. 5(5), second limb	Provide the digital contract, or the terms where there is none. Buying counts as consent to them	Terms page with version and date. Per order: which version was in force
Art. 5(8)	Provide a detailed non-paper invoice	Invoice file per order, emailed and re-downloadable. Not a confirmation screen
Art. 6(7)	Complaint channels, permanently available, qualified staff, tracking mechanism, clear address, kept updated and easy to reach	Complaints route with its own URL, monitored role address, reference number back, postal address
Art. 6(9)	Make publicly available the licence, address, contact numbers, physical address details and website	Legal-details block in the footer and on its own page. Also in the Arabic version
Art. 7(1)(a-e)	Grounds for return: illegality, defect or mismatch, delay, breach of announced terms, ministerial case	Returns page stating the statutory grounds. Return request creates a dated record
Art. 7(2)(a-d)	Right forfeited by use beyond checking, by lapse of time, for goods expiring within three weeks, for single-use books, films, programs	Exclusions on the same page, plus a per-product flag for short-life and single-use items
Art. 14(3), Art. 15(3)	Logistics fees (14(3)) and digital-payment fees (15(3)) may not depart from those announced	Order total computed from the published figures. Unexplainable surcharge = checkout defect

Element by element

The delivery fee that does not exist until the address is typed

This one is easy to miss. Article 5(5) does not say the fees must be calculable. It says they must be determined and made "publicly available on the digital merchant's website, application, or other modern technological means". A number that appears only after the buyer has entered a postcode into a checkout is not publicly available in any normal sense of the word. It is per-session, it is behind a form, and it is invisible to anyone who has not started buying.

The build answer is a fees page that exists as a page: zones or emirates in one column, prices in another, plus the cash-on-delivery charge, the packaging surcharge, the express option and any payment-related fee. Then the same numbers appear again in the basket before the pay button, computed from the same source, so the two can never drift apart. Article 14(3) closes the loop from the other side, within its own scope: additional fees for logistics services may not be imposed on the consumer in contravention with those specified and announced. Article 15(3) does the same for fees tied to digital payment. Neither article is a general ban on surcharges, so read them for what they cover rather than as a blanket rule. If your checkout can produce a total that the fees page cannot explain, that is a bug with a legal shadow.

Related, from a different instrument: Article 5(3) of Cabinet Decision No. 66 of 2023, the executive regulation of the Consumer Protection Law, tells suppliers not to "add any further amounts on the value of commodity, if credit cards are used in the purchase of commodities and services". A card surcharge line in a UAE checkout deserves a conversation with your lawyer before it ships.

The terms nobody can prove were accepted

Article 5(5) ends with a sentence that changes what your checkout has to store: the purchase of goods and services "shall be deemed and considered as consent by the consumer to the digital contract or those terms and conditions". Consent is inferred from the act of buying, which is convenient until there is a dispute and the question becomes which text the buyer consented to. A terms page that is silently edited four times a year cannot answer that.

What we build instead: the terms page carries a version and a date, every published version is kept, and the order record stores the version identifier and the timestamp. The buyer sees a normal page, the dispute sees a specific document. It costs an afternoon at build time and is close to impossible to reconstruct afterwards.

The invoice that is a link that expires

Article 5(8) is one sentence: provide a detailed non-paper invoice. It does not enumerate fields, and anyone who tells you it does is quoting a different instrument. The field list that actually exists in UAE law for a consumer invoice is in Article 6(1) of Cabinet Decision No. 66 of 2023: supplier name, address and contact information, invoice date, description of the commodity or service, unit of sale and quantity, condition if used, price in local currency, warranty period, delivery or performance date, serial numbers where the nature of the goods calls for it, commercial registration number, and tax number if any.

Two engineering consequences follow from the words "detailed" and "non-paper", and they are ours, not the legislator's. First, an invoice must be an artefact the buyer keeps: a file attached to an email and re-downloadable from the order record. A confirmation screen and a signed URL that dies in seven days are not records. Second, the line items on it must be generated from the same data the buyer approved, not re-keyed, or the invoice and the order will disagree the first time somebody edits a price.

The language of the invoice is a separate question with a hard answer, and it is not in this decree-law. It is in the Consumer Protection Law, and we wrote it up in the article on when your UAE site and invoice have to be in Arabic. The tax fields are a third question again, treated in VAT on your UAE online store.

The complaints route that ends in a mailbox nobody opens

Article 6(7) is the longest obligation in the consumer-rights list, and it is worth reading as several separate requirements rather than one: phone numbers and means of communication for complaints; permanently available without interruption; qualified staff; a mechanism to track complaints; communication with a clear address; updated periodically; easily accessible, whether through the website or otherwise.

"A mechanism to track complaints" is not a mailto link. Technically it means intake that produces a stored record with an identifier, a state, and a timestamp, and a reference sent back to the complainant so they can refer to it. "Permanently available without interruption" means the route survives staff turnover, which in practice means it points at a role address that at least two people can open, never at a personal one. "Updated periodically" is the clause that is hardest to evidence, and it becomes evidenceable the moment the intake is logged: a monthly test message that arrives, is logged, is answered and is closed leaves a trail that shows the channel was alive in that month.

We treat this as a build item rather than a policy item, because a form that silently loses submissions looks identical to a form that works. That is exactly why we let prospective clients send a test enquiry through our own site and watch it land, as one of the checks you can run on us before paying anything. Run the same test on your own shop today, from a phone, on mobile data, with an address that is not in your company domain.

The licence number that lives only inside a PDF

Article 6(9) reads as a right of the consumer, but it produces a merchant obligation: make publicly available the digital merchant's licence from the Competent Authority, their address, contact numbers, details of their physical address, and website. Publicly available means on the site, in text.

Four things are worth checking on your own shop, because each of them defeats that sentence in a way that looks fine from the inside: the trade licence linked as a scanned PDF, so the number is not text and not machine-readable; the licence number on an About page but nowhere near the checkout; an English-only footer block sitting on the Arabic pages; an address that is the registered agent's mailbox, with no indication of the physical place that Article 6(9) asks for by name.

The element is a legal-details block: legal name exactly as licensed, licence number and issuing authority, physical address, phone numbers, email, website. It sits in the footer of every page, and it has its own page for the version that can be linked to and cited. In the Arabic version it exists in Arabic, for the reason set out in the Arabic article linked above.

The returns page that only contains your own rules

Article 7 works differently from a purely contractual returns policy: it sets the grounds for return in law, and then it sets the exceptions in law. Your returns policy is not the source of the right, it is the page where the statutory right is explained and where your own more generous terms sit next to it.

The grounds in Article 7(1) are illegality, goods received defective, incomplete, damaged or contrary to the description given by the merchant, delay that makes the goods unusable, breach of the announced terms, and any further case the Minister decides. The forfeiture cases in Article 7(2) are use beyond verifying the absence of a defect, exceeding the period specified in the relevant legislation, food and consumer goods with a shelf life not exceeding three weeks, and books, films or programs that can only be used, viewed or listened to once.

Two of those are product attributes, not page copy. A shop that sells both fresh food and dry goods needs a per-product flag, because the exception applies to the item and not to the shop. If that flag does not exist in the catalogue, the returns rule is being applied from memory by whoever answers the phone that day.

One element that comes from a different law and lands on the same page

Article 40 of Cabinet Decision No. 66 of 2023 is headed "E-Commerce" and lists what a supplier working in that field has to indicate clearly for each commodity: name, trade name, address and trademark of producer and importer; name, type, nature, ingredients and quantity; a detailed statement of ingredients and specifications in the original language in addition to Arabic; the country of origin preceded by the phrase "Made in", and the country of export if any; production date and shelf life; the risks from misuse; the terms and conditions of return and replacement; and the terms of handling, storage and use. Article 40(2) adds the conformity documents and the conformity mark on the website page, and Article 40(3) makes the supplier responsible for failures in goods that a third party sells through its platform.

That is a product-template field list, not a policy page, and it is worth reading next to Decree-Law 14/2023 because a template with no field for country of origin will never carry one.

Check your own shop

Work down this list with your own store open on a phone. Each line names the article it comes from.

• Do you sell to buyers outside the geographic scope of your free zone, or does your zone have no e-commerce rules of its own? (Art. 2(1)(c))
• Is there a page listing delivery fees and any payment-related fees that a visitor can reach without adding anything to a basket? (Art. 5(5))
• Does the total in the basket use the same numbers as that page, and can your checkout produce any charge that page cannot explain? (Art. 5(5), Art. 14(3), Art. 15(3))
• Do your terms carry a version and a date, and does each order store which version was live when it was placed? (Art. 5(5))
• Does every order produce an invoice file that the buyer can download again next month? (Art. 5(8))
• Does that invoice carry the fields of Article 6(1) of Cabinet Decision 66/2023, including the price in local currency?
• Is there a complaints route with its own URL, a role address rather than a personal one, and a reference number sent back on receipt? (Art. 6(7))
• Send a test complaint from an outside address right now. Did it arrive, and is there a record of it? (Art. 6(7))
• Are your licence number, issuing authority, physical address, phone numbers and website in text in the footer of every page, including the Arabic pages? (Art. 6(9))
• Does your returns page state the statutory grounds and the statutory exclusions, not only your own policy? (Art. 7(1), Art. 7(2))
• Do your short-life and single-use products carry a flag in the catalogue that the returns logic reads? (Art. 7(2)(c), (d))
• Do your product templates have fields for country of origin, producer or importer, and return and replacement terms? (Cabinet Decision 66/2023, Art. 40)
• If a notice arrived tomorrow with a 15-day rectification window, which of the items above could you actually fix inside 15 days? (Art. 19, and the schedule issued under it)

Anything you cannot answer is a build task with a known address in the code.

What this article deliberately does not cover

Tax. VAT registration thresholds, the fields that turn an invoice into a tax invoice, place-of-supply questions and corporate tax are a separate subject with a separate law and a different authority. They are in VAT on your UAE online store. Nothing above should be read as a tax statement.

E-invoicing. The UAE e-invoicing programme, accredited service providers and the exchange format are outside this article, and outside what we deliver. We build the invoice document your shop produces for its customer. We do not implement e-invoicing and we are not an accredited service provider.

The penalty for your specific breach. The section above gives the shape of the sanctions regime and the range reported for it. What it cannot give you is the line item that matches a particular missing element, because that mapping sits in the Arabic schedule of Cabinet Decision 200/2025, and the copy the Ministry publishes has no text layer. We do not repeat numbers we have not read in the source. Separately, the fine table of the Consumer Protection Law is quoted in the Arabic-language article, where it applies to a different set of obligations. Do not carry those numbers over to this decree-law.

Legal texts. We build the structure: the pages, the fields, the stored records, the footer block, the intake with its log. We do not write your terms, your returns policy or your privacy text, and we do not approve them. That line is on our company website package page as a stated exclusion, in these words: “You get the technical structure; the content and the approval are yours or your lawyer’s.”

And once more, because it is the sentence people want and it is not available: none of this makes a site compliant. Compliance is a judgement about your business, your goods and your contracts. What an engineer can promise is that the element exists, that it is reachable, that it is in text rather than in a scan, and that it produces a record you can point at later.

Sources

• Federal Decree-Law No. 14 of 2023 on Trading by Modern Technological Means, English text on the Ministry of Economy and Tourism document server: moet.gov.ae, Federal Decree-Law No. 14 of 2023 (PDF). All article numbers above, and the issue date of 4 September 2023 and the entry-into-force rule in Article 21, were read in this file. Retrieved 28 August 2026.
• Ministry of Economy and Tourism, initiative page carrying both the decree-law and the penalties decision: moet.gov.ae, Trading by Modern Technological Means. Retrieved 28 August 2026.
• Cabinet Decision No. 200 of 2025 on the list of violations and administrative penalties under the decree-law, Arabic PDF published by the Ministry on the page above. Retrieved 28 August 2026, no text layer, so not quoted directly here.
• BDO Legal (UAE), analysis of the decree-law and of Cabinet Decision 200/2025, source for the 28 November 2025 date, the escalation and the reported range of AED 500 to AED 100,000: bdolegal.ae, E-Commerce in the UAE. Retrieved 28 August 2026.
• Cabinet Decision No. 66 of 2023 concerning the Executive Regulation of Federal Law No. 15/2020 on Consumer Protection, English translation hosted on the Ministry's document server in a Lexis Middle East reproduction: moet.gov.ae, CabinetDecision_66_2023_pdf.pdf. Articles 5, 6 and 40 were read in this file. Retrieved 28 August 2026.

Reviewed 28 August 2026. The part of this article most likely to age is the penalties schedule, issued two years after the decree-law itself and not yet published by the Ministry in a machine-readable English version.