The short answer is that police and other public authorities retain public-order and law-enforcement responsibilities, while private security companies provide regulated services within the approvals and scope that apply to them. In the UAE, those roles can work alongside one another, but a private security engagement is not a substitute for calling the appropriate public authority in an emergency or for a matter that requires police powers.
For an organisation planning an event, executive visit or workplace arrangement, the practical task is to define who owns which decisions before the activity begins. That means identifying the client, venue, organiser, private provider and relevant public authority without confusing coordination with a transfer of responsibility.
The short answer: complementary roles, not interchangeable ones
Private security is a regulated commercial service. Federal Law No. 37 of 2006 concerns private security companies and establishes an approval and licensing framework involving the competent authority. Separately, the UAE Government’s overview of security and safety bodies describes local police authorities as responsible for law and order in their respective emirates.
Taken together, these official sources support a useful distinction: an authorised private provider may deliver the services covered by its applicable permissions and agreement, while public authorities retain their own statutory responsibilities. The distinction is about role and authority—not a ranking of importance. Both may be relevant in a well-managed setting, but neither role should be assumed to erase the other.
Read the relevant primary sources: Federal Law No. 37 of 2006 concerning private security companies and the UAE Government’s page on entities responsible for security and safety.
What private security can—and cannot—be assumed to do
A client should begin with the written scope, not a broad label such as “security.” The contract or service description should identify the activity, place, period, decision-makers, interfaces and exclusions in terms the client can understand. A provider’s commercial presence, website description or general licence entry alone should not be treated as proof that every security activity is authorised in every context.
Do not infer police powers from a uniform, a venue role or the fact that a private provider is present. Nor should private personnel be positioned as a replacement for police, emergency medical services, fire and rescue, or the venue’s own safety responsibilities. When a situation may involve a crime, immediate danger, serious injury or an issue requiring official intervention, use the appropriate public emergency or authority channel. The provider’s contract and approved procedures may set additional notification steps, but they do not change who holds public authority.
That is a planning interpretation of the official division between regulated private-security activity and public law-and-order responsibilities. It is not a legal opinion about any particular assignment.
UAE context: verify the emirate and the specific activity
The federal framework is relevant across the UAE, but an organisation should not assume that one generic checklist answers every local question. The law refers to a competent authority, and the government’s security information identifies local police responsibilities by emirate. Before appointing a provider, establish the legal entity, the proposed service category, where the work will occur and which authority’s current requirements govern that activity.
A business-licence lookup can help verify a company’s recorded identity and commercial details, but it is only one part of due diligence. It does not, by itself, answer every question about a regulated security activity, individual authorisations, venue conditions or a particular assignment. Ask the provider to explain the relevant approval path and obtain confirmation from the competent authority or qualified adviser where the situation calls for it.
The UAE Government explains how to inquire about licences, names and activities. Use that as an identity check, not as a substitute for confirming sector-specific requirements.
This article is general information, not legal advice. Rules, approvals and procedures can change; clients should confirm the current position for the exact emirate, activity and site.
Draw the responsibility boundary before work starts
Many assignments involve several capable parties: an employer, event organiser, venue, facilities team, transport or guest-services partners, a private security provider and public authorities. Friction often appears when more than one party assumes another has made a decision. A simple responsibility map can prevent that without publishing operational detail.
For each key decision, name one accountable owner and the people who must be consulted or informed. Distinguish decisions the client controls—such as programme changes or guest communications—from matters governed by venue rules or public authorities. If the provider is expected to coordinate with another party, describe what coordination means and what it does not mean. Sharing an update is not the same as granting authority to approve a change.
Keep sensitive arrangements in the appropriate restricted channel. A responsibility map should describe roles and communication principles, not routes, schedules, staffing patterns, protective formations, equipment or vulnerabilities. The purpose is organisational clarity, not an operational plan.
A practical responsibility map
Client or host: sets the objective, appoints authorised contacts and approves changes within its control.
Venue or site owner: explains site rules, access conditions, facilities responsibilities and any required venue coordination.
Event organiser: owns the programme and its applicable event approvals; appointment of a provider does not automatically transfer the organiser’s obligations.
Private security provider: delivers only the agreed, authorised service and uses the agreed communication and escalation arrangements.
Public authority: retains its independent public responsibilities; contact the competent service when official intervention or emergency response is needed.
The exact allocation depends on the setting, contract and applicable rules. The value of the map is that it makes assumptions visible before people rely on them.
Questions to settle in advance
A short planning conversation can reveal whether the parties share the same understanding. Ask questions that clarify ownership and interfaces, rather than requesting details that should remain restricted.
Which legal entity is contracting, and what activity is within the confirmed service scope?
Which emirate, venue and dates are covered, and who can verify the applicable requirements?
Who is the client’s authorised decision-maker, and who may approve a change?
Which venue, organiser or employer responsibilities remain with those parties?
What circumstances require contacting public emergency services or the relevant authority?
How will concerns be communicated, recorded and reviewed while protecting personal information?
Which details belong in a restricted plan rather than in general emails, invitations or public documents?
Common planning mistakes
The first is treating a private provider as a stand-in for police. A private engagement can contribute to an agreed plan, but it does not give the provider public authority. The second is assuming a provider appointment transfers every host, venue or organiser duty. Contracts can allocate work, but they should not be treated as a blanket transfer of all legal or operational responsibility.
Another mistake is using “UAE-wide” as a substitute for checking the service and location. Ask for the applicable entity and scope in plain language. Finally, avoid circulating detailed personal or operational information to everyone involved. Share what each party needs to perform its defined role, and keep restricted material controlled.
Clear boundaries do not make a plan bureaucratic. They help the right person make the right decision, reduce contradictory instructions and preserve a direct path to public authorities when needed.
A concise pre-assignment checklist
Write the purpose and high-level service scope in plain language.
Identify the emirate, venue and competent authority relevant to the proposed activity.
Record who owns host, venue, organiser, provider and public-authority interfaces.
Set approval rights for changes and name authorised points of contact.
Agree what issues require immediate public-authority or emergency-service contact.
Keep sensitive operational and personal details out of broad distribution.
Review the arrangement with qualified legal or compliance advisers when required.
EquiSecure describes a specialist focus on close protection, event-security planning and operational resilience, with engagement scope confirmed case by case and subject to applicable UAE licensing and regulatory requirements. Organisations considering support can review the company’s approach and begin a high-level conversation through the