Civil Law And UAE Critical Infrastructure Resilience Liability

1. Introduction

Critical infrastructure resilience liability concerns the civil responsibility of persons, companies, contractors, operators, owners, technology providers, consultants, and other participants when the failure, disruption, defective maintenance, cyber incident, or inadequate protection of critical infrastructure causes legally compensable harm.

In the UAE context, critical infrastructure can include:

electricity-generation and distribution systems;

water and desalination facilities;

telecommunications networks;

airports and transport systems;

ports and logistics facilities;

hospitals and essential healthcare systems;

financial and payment infrastructure;

oil and gas installations;

government information systems;

data centres and cloud infrastructure;

industrial control systems; and

other facilities whose disruption can produce significant economic or public consequences.

The legal framework is multi-layered. It combines the UAE Civil Transactions Law, contractual liability, construction and engineering liability, sector-specific regulation, cybersecurity legislation, employment rules, insurance, public-law obligations and, where relevant, criminal law.

A major legislative development is especially important for a 2026 analysis: Federal Decree-Law No. 25 of 2025 promulgating the new Civil Transactions Law entered into force on 1 June 2026 and replaced Federal Law No. 5 of 1985. (UAE Legislation)

Accordingly, older UAE judgments applying the 1985 Civil Code remain useful for understanding judicial principles, but their article numbering must not automatically be treated as the numbering of the current 2025 Civil Transactions Law.

2. Meaning of Critical Infrastructure Resilience

Infrastructure resilience means the ability of an infrastructure system to:

resist foreseeable threats;

withstand disruption;

continue essential operations;

detect failures;

respond quickly;

restore services;

minimise consequential damage; and

learn from previous incidents.

Liability arises when a legally responsible party fails to meet an applicable duty and that failure causes damage.

For example:

A power operator fails to maintain critical equipment despite contractual and regulatory maintenance obligations. A foreseeable equipment failure causes a prolonged outage, damaging industrial machinery and interrupting a customer's production.

Potential questions include:

Was there a duty to maintain the equipment?

Was the maintenance standard breached?

Was the failure foreseeable?

Did the failure cause the outage?

Did the outage cause the claimant's loss?

Was the loss too remote?

Did force majeure apply?

Did the claimant contribute to the damage?

Was there a contractual limitation of liability?

Was insurance available?

3. Current UAE Civil-Law Framework

The new UAE Civil Transactions Law is now the principal federal private-law framework.

The new legislation expressly modernises UAE civil liability and compensation rules. The government describes the 2025 Civil Transactions Law as a comprehensive framework for rights and obligations, while noting reforms concerning compensation and full reparation. (UAE Legislation)

For infrastructure disputes, the most important concepts remain:

harmful acts;

contractual breach;

causation;

actual damage;

lost profits where legally recoverable;

moral damage where applicable;

force majeure;

contributory conduct;

third-party acts;

professional negligence;

defective works;

guarantees; and

compensation.

4. Infrastructure Liability Is Not a Single Cause of Action

A critical infrastructure failure may generate several independent legal relationships.

Example

A desalination plant stops operating.

The incident may involve:

Owner ↔ Operator

under an operation and maintenance contract.

Owner ↔ EPC Contractor

under the construction contract.

Operator ↔ Equipment Supplier

under supply and warranty agreements.

Operator ↔ Cybersecurity Provider

under a technology/security contract.

Affected customer ↔ Operator

under service arrangements.

Affected third party ↔ Operator

under tort principles.

Therefore, one infrastructure incident can generate multiple overlapping liability claims.

5. Elements of Civil Liability

The traditional UAE civil-liability structure requires analysis of:

1. Wrongful act or breach

There must be an act, omission, defective performance, contractual breach or other legally relevant conduct.

2. Damage

The claimant must establish actual legally compensable damage.

3. Causation

There must be an adequate causal relationship between the breach or harmful act and the damage.

A recent UAE case report again illustrates the importance of proving actual harm rather than merely alleging that a wrongful act occurred. (Gulf News)

This is particularly important for infrastructure because outages can produce enormous claimed losses, but the size of the claimed loss does not itself prove causation or recoverability.

6. Why Resilience Creates a Distinct Liability Problem

Traditional negligence asks:

Did the defendant cause the accident?

Resilience disputes may require a broader inquiry:

Did the defendant adequately prepare for, detect, withstand, respond to and recover from a reasonably foreseeable disruption?

This creates several possible liability stages:

Prevention

↓

Detection

↓

Containment

↓

Continuity

↓

Recovery

↓

Post-incident remediation

A failure at any stage may become legally significant depending on the applicable duty.

7. Duty to Maintain Critical Infrastructure

An infrastructure operator may owe contractual, statutory or tortious duties concerning:

maintenance;

inspection;

testing;

monitoring;

replacement;

emergency preparedness;

cybersecurity;

physical security;

business continuity;

employee training;

disaster recovery.

The precise standard depends upon the governing legislation and contract.

A court should not automatically impose the highest imaginable standard. The relevant question is the legally applicable standard of care and contractual obligation.

8. Contractor Liability

Construction and infrastructure contractors can face liability for defective work.

UAE construction jurisprudence has long recognised contractor responsibility for damage resulting from defective execution and, in appropriate circumstances, special statutory construction guarantees.

For example, Dubai Court of Cassation, Civil Appeal No. 156 of 2007, addressed contractor responsibility for materials and damage generated by the contractor's work under the former Civil Transactions Law. (Wasel & Wasel)

Relevance to critical infrastructure

If a contractor constructs:

a power substation;

water-treatment facility;

bridge;

airport system;

hospital;

telecommunications facility;

and defective construction causes infrastructure failure, the contractor's liability may become central.

9. Case Law 1 — Dubai Court of Cassation, Civil Appeal No. 156 of 2007

This case concerned contractor responsibility under Articles 875 and 878 of the former Civil Transactions Law.

The reported principle was that where the employer requires the contractor to supply materials, the contractor is responsible for their quality according to the contract or applicable custom, and the contractor guarantees damage or loss generated by its work, subject to the statutory treatment of unavoidable accidents. (Wasel & Wasel)

Importance

For infrastructure resilience, the case supports examination of:

quality of materials;

workmanship;

contractor responsibility;

causal connection between construction and damage; and

unavoidable events.

Modern relevance

Although the case applied the former Civil Code, its reasoning is useful historically when analysing construction-related infrastructure failures under the new legislation.

10. Case Law 2 — Dubai Court of Cassation, Civil Appeal No. 175 of 1997

This decision concerned defective workmanship and remedies.

The reported principle was that where work does not conform to contractual specifications, the employer may seek appropriate remedies; where repair is possible, repair may be sought, while more serious circumstances can justify termination or other relief. (Wasel & Wasel)

Infrastructure significance

A resilience failure may not always justify immediate damages for total replacement.

The court may need to distinguish:

repairable defect;

serious structural defect;

operational defect;

safety-critical defect;

total system failure.

This distinction can materially affect the remedy.

11. Case Law 3 — Abu Dhabi Court of Cassation, Case No. 721, Judicial Year 3

This authority is particularly relevant to damages caused by defective construction.

The reported jurisprudence states that compensation may cover actual damage and lost earnings when they are a natural consequence of the harmful conduct. It also recognised loss of opportunity to exploit a building as an element of damage in appropriate circumstances. (IRBNet)

Critical-infrastructure application

Suppose a defective infrastructure facility cannot operate for six months.

Potential losses might include:

repair costs;

replacement costs;

shutdown losses;

loss of operational use;

demonstrable lost revenue.

But the claimant still needs to establish that the losses resulted from the defendant's legally attributable breach.

12. Case Law 4 — Federal Supreme Court, Civil and Commercial Appeal No. 312 of Judicial Year 19

This case concerned construction contracts and the contractual allocation of obligations.

The reported decision emphasised the contractual nature of the parties' obligations and examined whether a delay penalty could be imposed where the contract did not provide for the relevant obligation. (Wasel & Wasel)

Infrastructure relevance

Critical infrastructure projects often involve:

EPC contracts;

operation and maintenance agreements;

availability guarantees;

performance guarantees;

liquidated damages;

service-level obligations.

Therefore, the contract itself may determine a significant portion of the resilience liability allocation.

13. Case Law 5 — Abu Dhabi Court of Cassation, Cassation No. 922/2020

This dispute arose from major construction works involving a main contractor and subcontractors.

The case demonstrates the importance of identifying the correct contractual dispute-resolution mechanism and the relationship between subcontractual claims and arbitration clauses. The Abu Dhabi Court of Cassation decision was dated 27 October 2020. (Kluwer Arbitration Blog)

Infrastructure significance

Large critical-infrastructure projects commonly contain multiple contracts.

For example:

Government authority → main contractor → specialist contractor → equipment supplier.

When infrastructure fails, the injured party may attempt to proceed against several participants.

The court must determine:

who owes the relevant duty;

which contract governs;

whether an arbitration clause applies;

whether a non-signatory can be sued;

and how contractual liability is allocated.

14. Case Law 6 — Abu Dhabi Court of Cassation, Appeal No. 207/2026

A particularly relevant recent authority concerns underground utility infrastructure.

The dispute involved a construction project that was halted after underground utility cables were discovered and a municipal stoppage order followed.

The Abu Dhabi Court of Cassation treated the obstruction as an external circumstance beyond the contractor's control and accepted a force-majeure analysis in the circumstances reported. Expert evidence and the chronology of communications with authorities were important. (BDO Legal)

Importance for infrastructure resilience

This case demonstrates that infrastructure projects must account for existing infrastructure and external utility risks.

It also shows that resilience liability depends heavily upon:

foreseeability;

control;

causation;

communications;

mitigation;

expert evidence.

15. Case Law 7 — Dubai Court of Cassation, Cassation No. 213/2003

This decision is cited in UAE construction jurisprudence concerning force majeure under the former Civil Code. (Mondaq)

The significance of the authority is that force majeure is not established merely because performance has become:

more expensive;

inconvenient;

delayed; or

commercially difficult.

The relevant question is whether the event satisfies the applicable legal requirements for relief.

Critical infrastructure application

An operator cannot necessarily escape liability merely by saying:

"The infrastructure system failed because the event was unexpected."

The operator may need to establish:

externality;

unforeseeability;

irresistibility or unavoidable nature;

direct causal connection; and

absence of responsibility for the event.

Contemporary UAE construction analysis continues to identify these factors as important in force-majeure disputes. (Pinsent Masons)

16. Case Law 8 — Dubai Court of Cassation, Civil Cassation No. 352/2015

This authority has been cited for the proposition that contractual liability requires proof of:

breach or fault;

damage; and

causal connection.

A recent UAE construction dispute analysis relied on this authority when explaining why an additional damages claim could fail where the claimant did not specifically establish and quantify the additional financial loss. (Wasel & Wasel)

Infrastructure significance

This is extremely important in resilience litigation.

An infrastructure operator might cause an outage, but the claimant cannot automatically recover every economic consequence allegedly flowing from it.

The claimant must establish:

breach → outage → specific damage → legally recoverable loss.

17. Cybersecurity and Critical Infrastructure

Critical infrastructure is increasingly dependent upon digital systems.

A cyberattack may affect:

power grids;

water systems;

airports;

hospitals;

banking infrastructure;

telecommunications;

industrial control systems.

The UAE's Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes provides the federal cybercrime framework and protects government information systems and data against specified forms of unlawful interference. (U.AE)

However, the existence of a cybercrime does not automatically answer the civil-liability question.

A separate civil analysis may ask whether:

an operator failed to implement contractual cybersecurity measures;

a vendor breached a security obligation;

a service provider failed to protect data;

negligent system design caused damage;

inadequate incident response increased the loss.

18. Cyberattack by a Third Party

Suppose a hospital suffers a ransomware attack.

The hospital may argue:

"The attacker caused the damage."

The cybersecurity provider may respond:

"The attack was an independent criminal act."

The court may then have to examine whether the service provider itself:

failed to patch known vulnerabilities;

failed to implement agreed controls;

failed to monitor systems;

ignored warnings;

failed to maintain backups;

failed to respond appropriately.

The third-party cyberattack does not necessarily eliminate contractual or tortious responsibility.

19. Critical Infrastructure and Causation

Causation becomes particularly difficult where several failures interact.

Example:

Cyberattack

outdated software

inadequate backup

poor incident response

=

extended electricity outage

Who caused the damage?

The answer may require technical expert evidence.

The court may need to separate:

initiating cause;

contributing cause;

aggravating cause;

independent cause;

intervening cause.

20. Concurrent Causes

A resilience failure can have multiple responsible actors.

For example:

Operator

Failed to maintain equipment.

Contractor

Installed defective components.

Software provider

Failed to patch a known vulnerability.

Security provider

Failed to detect the intrusion.

Third-party attacker

Initiated the cyberattack.

The court may need to allocate responsibility according to the applicable civil-liability rules.

21. Contributory Fault

The claimant may itself contribute to the damage.

For example, a company may suffer losses after a power outage but have:

ignored backup requirements;

failed to maintain emergency generators;

exceeded system capacity;

failed to follow operational instructions.

Under the traditional UAE civil-liability framework, claimant participation in causing or aggravating damage can affect compensation. The former Civil Code expressly recognised reduction of compensation where the injured party contributed to the harm. (LEXAI)

The new Civil Transactions Law should be applied to current disputes from its effective date.

22. Force Majeure

Infrastructure operators frequently invoke force majeure.

Potential events include:

extreme natural events;

war;

governmental closure;

unexpected infrastructure obstruction;

extraordinary external events;

certain cyber incidents.

But not every disruption constitutes force majeure.

The legal inquiry should focus on whether the event satisfies the statutory and contractual requirements and whether the party could reasonably have prevented or mitigated its consequences.

The 2026 Abu Dhabi utility-obstruction case demonstrates the importance of factual chronology and expert evidence. (BDO Legal)

23. Resilience and Force Majeure Are Connected

This creates an important modern principle:

The more foreseeable a risk is, the harder it may be to rely on the risk itself as an excuse for inadequate preparation.

For example, if an operator knows that:

flooding is historically common;

cyberattacks have repeatedly occurred;

a component has a known failure rate;

a backup system is mandatory;

then failure to prepare may undermine a later argument that the resulting disruption was entirely beyond its control.

The precise legal result remains fact-specific.

24. Infrastructure Maintenance Liability

Maintenance contracts should identify:

inspection frequency;

testing standards;

replacement intervals;

emergency response;

spare parts;

cybersecurity updates;

reporting;

downtime limits;

business-continuity obligations.

Failure to comply with these obligations may constitute contractual breach.

Where a public-facing service is affected, third-party tort claims may additionally arise if the legal requirements for such liability are satisfied.

25. Engineering Consultant Liability

Engineers and consultants can become defendants where their professional conduct contributes to infrastructure failure.

Possible allegations include:

defective design;

inadequate inspection;

failure to identify defects;

incorrect certification;

inadequate supervision;

failure to warn;

inaccurate technical advice.

Expert evidence will frequently be important.

26. Decennial Liability

Major construction projects may trigger the special UAE legal regime concerning serious structural defects.

Historically, UAE jurisprudence distinguished between:

ordinary defects; and

defects affecting the soundness or stability of a structure.

The Abu Dhabi Court of Cassation authorities concerning Cases 293 and 721 of Judicial Year 3 are cited in UAE construction literature concerning the scope of decennial liability and structural defects. (Law Gratis)

For critical infrastructure, this can be especially important for:

bridges;

tunnels;

dams;

major buildings;

industrial structures;

structural portions of airports and hospitals.

27. Infrastructure Failure and Lost Profits

Critical infrastructure failures can generate enormous consequential losses.

Examples:

factory shutdown;

cancelled flights;

delayed shipments;

loss of telecommunications revenue;

business interruption;

spoiled inventory;

emergency replacement costs.

However, lost profit generally requires proof that the loss is sufficiently connected to the breach and legally recoverable.

The UAE jurisprudence reported in Abu Dhabi Court of Cassation Case No. 721/Judicial Year 3 is particularly useful because it recognised loss of use and lost earnings as potentially compensable where they naturally resulted from the relevant breach. (IRBNet)

28. Data-Centre Resilience Liability

Data centres illustrate the modern infrastructure problem.

A data-centre operator may be contractually required to provide:

uninterrupted power;

cooling redundancy;

backup generators;

fire protection;

physical security;

network redundancy;

disaster recovery.

A failure can cause losses to hundreds of customers.

The legal question becomes whether the operator's:

contractual SLA;

maintenance obligation;

redundancy obligation;

security obligation;

was breached.

29. Electricity Infrastructure

Electricity infrastructure creates special causation challenges.

Suppose:

A transmission failure causes a three-hour outage.

One customer claims AED 50 million.

The court must examine:

actual duration;

cause of outage;

maintenance records;

equipment condition;

contractual terms;

emergency procedures;

customer's own backup arrangements;

evidence of actual production loss.

A claim cannot simply be calculated from the company's revenue during the outage.

30. Water and Desalination Infrastructure

Water infrastructure failure can cause:

business interruption;

property damage;

health consequences;

environmental harm;

emergency procurement costs.

Potential defendants may include:

facility operator;

maintenance contractor;

equipment supplier;

engineering consultant;

technology provider.

Liability depends on the precise duty and causal relationship.

31. Airport and Transport Infrastructure

Airport infrastructure involves:

runways;

navigation systems;

baggage systems;

security systems;

IT infrastructure;

fuel systems;

passenger-processing systems.

A failure can produce extensive consequential losses.

The central civil-law question remains whether the relevant claimant can establish:

duty + breach + causation + recoverable damage.

32. Telecommunications Infrastructure

Telecommunications failures may affect:

businesses;

banks;

hospitals;

government systems;

emergency services.

Claims may involve:

service-level agreements;

equipment failures;

cyber incidents;

fibre damage;

negligent maintenance;

third-party contractor conduct.

Contractual limitation clauses may become especially important.

33. Limitation of Liability

Infrastructure contracts frequently contain:

liability caps;

exclusions of consequential loss;

indemnities;

insurance requirements;

liquidated damages;

service credits.

Whether a particular limitation is enforceable depends upon the current UAE legal framework, the contract wording, mandatory law, and the nature of the harm.

The new Civil Transactions Law expressly addresses harmful-act liability and compensation, including provisions governing compensation and contractual attempts to alter liability. (UAE Legislation)

Accordingly, infrastructure contracts should not assume that a blanket exclusion will automatically eliminate all civil responsibility.

34. Insurance and Resilience Liability

Insurance can transfer some economic consequences but does not necessarily eliminate the underlying legal liability.

Policies may cover:

property damage;

business interruption;

cyber incidents;

machinery breakdown;

professional liability;

construction risks.

Disputes may then arise between:

insured;

insurer;

infrastructure operator;

contractor;

subcontractor.

35. Government and Public Infrastructure

Where infrastructure is owned or operated by a governmental entity, additional issues may arise concerning:

governmental authority;

public contracts;

statutory duties;

jurisdiction;

sovereign/public-law principles;

procurement rules;

administrative liability.

A claimant should therefore determine whether the dispute is genuinely a private civil claim or whether a special public-law regime applies.

36. Expert Evidence

Critical-infrastructure cases are highly technical.

Experts may be required to determine:

Engineering

How did the physical failure occur?

Cybersecurity

How did the intrusion occur?

Electrical engineering

Why did the grid fail?

Finance

What economic loss actually occurred?

Construction

Was the facility designed and constructed according to specifications?

Operations

Was the operator's response reasonable?

The court ultimately decides the legal questions, but expert evidence can be crucial in establishing factual causation.

37. Evidence Required by Infrastructure Claimants

A claimant should preserve:

contracts;

technical specifications;

maintenance logs;

inspection reports;

incident-response reports;

cybersecurity logs;

system alerts;

photographs;

CCTV;

expert reports;

communications;

downtime records;

financial records;

invoices;

repair costs;

business interruption calculations.

Infrastructure litigation can fail because the claimant proves that an outage happened but cannot prove why it happened or what legally recoverable loss resulted.

38. Resilience Failure Versus Infrastructure Accident

A critical distinction is:

Accident

An unexpected event occurs despite reasonable precautions.

Resilience failure

The infrastructure operator failed to implement reasonable contractual, technical or legally required safeguards.

The second situation potentially creates a stronger civil claim.

But the court must determine the applicable legal standard rather than assuming that every infrastructure accident is negligence.

39. Multi-Party Infrastructure Liability

Large UAE infrastructure projects can involve:

government authority;

project company;

EPC contractor;

subcontractor;

consultant;

equipment manufacturer;

technology provider;

cybersecurity provider;

operator;

insurer.

A single failure can therefore produce complex contribution and indemnity disputes.

The Abu Dhabi Cassation jurisprudence concerning contractor/subcontractor relationships demonstrates the importance of analysing the contractual architecture rather than treating the entire project as one legal relationship. (Kluwer Arbitration Blog)

40. Contribution Between Responsible Parties

Suppose:

contractor is 40% responsible;

consultant is 20%;

operator is 30%;

equipment supplier is 10%.

The ultimate allocation depends upon applicable UAE law, contractual arrangements and the court's findings.

The claimant may first establish its right against the legally responsible party or parties, after which contribution and recourse issues may arise.

41. Cybersecurity as a Resilience Obligation

The UAE Cybercrime Law is primarily a criminal statute, but its existence reinforces the importance of protecting information systems.

The federal framework expressly addresses attacks, tampering and unlawful access involving information systems and government information. (U.AE)

For civil liability, however, the court still needs to identify an applicable:

contract;

statutory duty;

professional obligation;

tortious duty; or

other legal basis.

A criminal cyberattack does not automatically establish civil liability against every organisation affected by it.

42. Critical Infrastructure and Third-Party Cyberattack

A sophisticated cyberattack can be an intervening cause.

But the legal analysis should ask:

Was the attack so extraordinary and unforeseeable that it broke the causal chain?

or:

Was the attack a foreseeable risk against which the infrastructure operator had an existing obligation to protect?

The answer will depend upon:

industry;

contract;

applicable regulation;

threat environment;

security standards;

prior warnings;

actual safeguards.

43. Resilience and the Duty to Mitigate

Even after an initial failure, an affected party may have to take reasonable steps to reduce its losses.

For example:

activate backup power;

switch to a secondary data centre;

use alternative logistics;

notify customers;

isolate infected systems;

preserve evidence;

obtain emergency replacement equipment.

Failure to mitigate may affect the recoverable amount.

44. Emergency Response Liability

Infrastructure operators should maintain:

emergency response plans;

escalation procedures;

communication protocols;

backup systems;

incident command structures;

disaster recovery arrangements.

If a minor initial failure becomes a major disaster because an operator ignored an established emergency protocol, the later losses may raise additional causation questions.

45. Contract Drafting for Critical Infrastructure Resilience

UAE infrastructure contracts should clearly address:

A. Performance standards

Define measurable operational requirements.

B. Availability

Specify permitted downtime.

C. Maintenance

Specify inspection and replacement schedules.

D. Cybersecurity

Identify minimum controls and reporting obligations.

E. Incident response

Define notification and response periods.

F. Business continuity

Require tested recovery plans.

G. Liability

Define caps and exclusions carefully.

H. Insurance

Specify minimum coverage.

I. Expert determination

Provide mechanisms for technical disputes.

J. Dispute resolution

Specify court or arbitration jurisdiction.

46. Six Important Legal Principles From the Case Law

The UAE authorities discussed above support six particularly important propositions.

Principle 1 — Infrastructure contractors can bear responsibility for defective work

Dubai Cassation No. 156/2007. (Wasel & Wasel)

Principle 2 — Defective work can generate repair, termination and damages remedies

Dubai Cassation No. 175/1997. (Wasel & Wasel)

Principle 3 — Loss of use and lost earnings can form part of compensable damage where causally established

Abu Dhabi Cassation No. 721, Judicial Year 3. (IRBNet)

Principle 4 — Contract wording is fundamental in allocating infrastructure obligations

Federal Supreme Court Appeal No. 312, Judicial Year 19. (Wasel & Wasel)

Principle 5 — Multi-contract infrastructure disputes require careful analysis of arbitration and contractual relationships

Abu Dhabi Cassation No. 922/2020. (Kluwer Arbitration Blog)

Principle 6 — External infrastructure obstruction can constitute force majeure where the statutory requirements are established

Abu Dhabi Cassation Appeal No. 207/2026. (BDO Legal)

An additional important damages authority is Dubai Cassation No. 352/2015, which is cited for the requirement to establish breach, damage and causation. (Wasel & Wasel)

47. Future Challenges

Critical infrastructure liability will increasingly involve:

AI-controlled infrastructure;

autonomous systems;

smart grids;

connected hospitals;

cloud dependence;

digital twins;

industrial IoT;

autonomous transport;

quantum-resistant cybersecurity;

satellite infrastructure;

cross-border cloud services.

This creates difficult questions concerning:

Who is legally responsible when infrastructure fails because several interconnected automated systems interact?

For example:

AI software developer

→

cloud provider

→

cybersecurity provider

→

infrastructure operator

→

physical infrastructure

A future court may have to determine which failure constituted the legally relevant cause.

48. Conclusion

UAE critical infrastructure resilience liability is best understood as a layered civil-liability problem rather than as a single statutory cause of action.

The legal analysis generally requires identification of:

the infrastructure asset;

the responsible operator or contractor;

the contractual and statutory duties;

the applicable standard of care;

the actual failure;

foreseeability;

causation;

mitigation;

actual economic or physical damage;

force majeure or third-party intervention;

contractual limitations; and

applicable insurance and indemnity arrangements.

The transition to the 2025 Civil Transactions Law, effective 1 June 2026, is particularly important for current UAE analysis. (UAE Legislation) Older Court of Cassation authorities remain valuable for understanding established judicial approaches, but their former statutory article numbers should be checked against the new Code before being used in a current pleading.

The central proposition can therefore be stated as:

Critical infrastructure resilience liability arises when a legally responsible party fails to satisfy an applicable duty concerning the design, construction, maintenance, protection, operation, continuity or recovery of infrastructure, and that failure is sufficiently connected to legally compensable damage.

For modern UAE disputes, the strongest cases will generally be those supported by technical evidence, maintenance records, cybersecurity logs, contractual specifications, expert causation analysis and precise proof of financial loss. The reported UAE construction and force-majeure authorities demonstrate why courts examine the precise contractual obligations, technical evidence, causation and factual chronology rather than treating every infrastructure disruption as automatically compensable. (BDO Legal)