Which data protection law applies to our product?

It depends on your entity and, for DIFC, on where your users are. Federal Decree-Law No. 45 of 2021 has applied across the country since 2 January 2022. DIFC operates under its own law, amended in July 2025 so that it reaches controllers processing the data of DIFC residents regardless of where those controllers are incorporated. ADGM runs a separate regime again. This is a question for counsel, and the answer shapes the build.

Is our product ready for UAE e-invoicing?

The test is whether your data model can populate a structured schema, not whether you can produce a document. Invoices move to XML on the PINT AE schema, sent through a Ministry-approved Accredited Service Provider. A voluntary pilot opens on 1 July 2026, large businesses follow on 1 January 2027 and smaller ones on 1 July 2027. Most systems fail on missing or inferred fields rather than on the format itself.

Are there UAE rules for AI features?

There is no binding federal AI statute. There is a national strategy and a charter issued in June 2024, both setting expectations without creating enforceable duties, and from January 2026 an AI system sits as an advisory member of Cabinet. Inside DIFC the picture differs: Regulation 10 has applied since September 2023 to systems processing personal data autonomously, placing duties on those deploying and operating them.

What does the Open Finance framework mean for a fintech build?

The Central Bank has established a framework with its own licence category for providers sharing data or initiating services on a customer's behalf. What makes it unusual internationally is that it is centralised — a single API hub and a common trust framework, rather than each institution exposing its own interface. That removes some integration work and concentrates the rest into meeting one specification and holding the right permission.

Have you actually delivered anything in the UAE?

Yes, and precisely one thing. We rebuilt the website of Infinity Bay Trading, a Dubai wholesale supplier, moving it off WordPress onto Astro and restructuring it for search. Their founder is quoted on this site by name and their own site carries our credit. That engagement was web and search work — not AI, not SaaS, not a custom platform. Our work in those categories was delivered for clients in other markets and is on the portfolio.

Do you have a UAE office or trade licence?

No. Futurise Solutions is registered in Wellington, New Zealand, with a distributed engineering team, and we hold no entity or licence in the Emirates. That belongs near the top of an answer rather than in a footer, because it rules us out of some work entirely: anything requiring a UAE supplier entity, personnel based here, or a regulated licence. Where that is your constraint, a local firm is the correct answer and we will say so.

Can you work in Arabic?

No. We build the localisation layer, the directional styling and the tests that keep a mirrored interface from breaking, but the Arabic itself needs a native standard suited to this market and we would have you source it separately. We say so because the alternative — implying coverage and quietly machine-translating customer-facing text — is something readers notice immediately.

United Arab Emirates

Software development for UAE businesses

Q: Does our app need to be in Arabic?

If you sell to customers here, plan for it. Consumer rules require sufficient information in Arabic — contract terms, pricing, descriptions and advertising — with other languages allowed alongside. A dedicated Arabic language law has been drafted with a rollout described for 2026 and 2027, but it remains a draft. The larger cost is rarely the words: it is that the interface has to mirror, which is a design system decision rather than a content one.

Q: Do we need a licence to build a token or wallet product?

If you are operating from Dubai, answer that before design rather than after. Virtual asset activity is regulated under an authority established by Dubai Law No. 4 of 2022, with twelve rulebooks and seven categories of regulated activity, and the category you pursue determines the feature set, onboarding and disclosures. We are not licensing advisers, so we ask which category you are seeking before proposing an architecture.

Custom software, AI and SaaS for companies building here. We have delivered one project in Dubai and say exactly what it was before anything else. The rest of this page covers the decisions — jurisdiction, Arabic, licensing, invoicing — that are cheap early and expensive later.

Send us your scope

Delivered work

What we've shipped in the UAE — and what we haven't

Most suppliers open with capability. This opens with the record, including its limits.

One delivered engagement, in Dubai

Infinity Bay Trading is a Dubai wholesale supplier working across food, hospitality and industrial goods. Their site ran on WordPress, loaded slowly and was largely invisible in search. We moved it onto Astro so pages ship as static HTML, reorganised the catalogue around the way buyers look for stock, and put indexing on a proper footing. We can name them because they agreed to be named, and their site carries our credit in its own footer.

What that engagement was not

It was web and search work. It was not an AI build, a SaaS platform or a custom internal system. We say so on the page where blurring it would help us most, because the alternative is letting one website rebuild stand in for capabilities it does not evidence. Our AI, SaaS and blockchain work was delivered for clients in other markets and sits on the portfolio under their names.

How to check any of this

Every project we reference is on the portfolio with the client named, the problem stated and screenshots attached, and the one testimonial on this site belongs to a person you can look up. Some suppliers here name large clients; others publish project counts with nothing checkable attached. Whoever you shortlist, ask for one reference you can verify without their help.

See the project on our portfolio

Legal geography

Which UAE are you building in?

The question nobody asks a development agency and everybody should. Where the company is registered decides which data law reaches your product.

Four places to be registered, three data laws

A company here can sit on the mainland, inside a commercial free zone such as Dubai Internet City or DMCC, or inside DIFC or ADGM. The last two matter most for software, because they are common-law jurisdictions running their own data protection statutes rather than the federal one. Two teams building an identical product a few kilometres apart can therefore owe different duties to the same user. That is a question to settle before the schema, not after launch.

The federal law, stated carefully

Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022 and governs personal data processing outside those free-zone regimes. We are deliberately not telling you what its implementing regulations require, because published sources disagree about whether they have been issued at all — a reputable practice guide says they have not, while several vendors cite a 2024 cabinet decision. Take that detail from counsel rather than from a development agency, including this one.

DIFC reaches AI systems directly

Inside DIFC, Regulation 10 has applied since September 2023 to systems processing personal data autonomously or semi-autonomously. It places duties on the parties deploying and operating those systems rather than on the technology, so the obligation follows whoever runs the thing in production. Shipping an AI feature inside DIFC is a different compliance question from shipping the same feature on the mainland, and the answer turns on an incorporation decision usually taken by somebody else.

Incorporation reaches past compliance

Where the entity sits also decides whether it can contract directly with mainland customers and how its income is treated, since a qualifying free zone company pays nothing on qualifying income and is taxed normally on everything else. None of that is ours to advise on. It matters here because it is generally settled before a supplier is appointed, and it constrains architecture in ways that are cheap to accommodate early and expensive to unpick later.

Coming into force

The invoice format is changing, and it is code

Rare among compliance obligations, this one has published dates and no ambiguity about who it reaches. It lands in the data model.

The dates are already published

Invoicing here is moving to a structured electronic format on a fixed schedule. A voluntary pilot opens on 1 July 2026, large businesses come into scope on 1 January 2027, and smaller businesses follow on 1 July 2027. Unlike most compliance work there is no interpretive grey area about whether it applies to you. If your product issues invoices, the only real question is which of those three dates is yours.

A format and a network, not a PDF

Invoices have to be issued as structured XML against the PINT AE schema and passed through an Accredited Service Provider — a Peppol-certified operator approved by the Ministry of Finance. That is materially different from rendering a document and emailing it. The data has to be complete and correctly typed at the moment of issue, because a schema either validates or it does not, and fields that were optional or free text in your system stop being either.

Retrofitting is the expensive path

Most billing systems can eventually produce a compliant document. The costly discovery is that the underlying records cannot populate one — an identifier never captured, a tax treatment inferred at render time rather than stored, or line items that exist only inside a template. Working out what the schema needs while the data model is still open is a short conversation. Doing it against a live ledger is a migration with an external deadline attached.

Localisation

Arabic is a layout problem before it is a language problem

Teams budget for words and are surprised by geometry. The requirement is narrower than expected; the consequence is wider.

The legal test is sufficiency

Consumer rules require that customers here receive sufficient information in Arabic — contract terms, pricing, product descriptions and advertising — with other languages permitted alongside it. That is a lighter test than some markets apply, and worth knowing precisely, because over-scoping Arabic costs as much as under-scoping it. A dedicated Arabic language law has been drafted with a rollout described for 2026 and 2027, but it is a draft and should be planned for rather than complied with.

Right-to-left is an interface rewrite

The engineering cost is not the words. The layout mirrors: navigation, icons, progress indicators, table columns, chart axes and anything carrying a directional meaning. Then bidirectional text arrives, where an Arabic sentence containing a Latin product code or a figure runs in two directions at once and defeats naive truncation, cursor handling and selection. Components not built for this rarely mirror cleanly, and the repair usually belongs in the design system rather than the pages.

What we do here, and what we do not

We build the mechanism — the localisation layer, directional styling, formatting for dates, numerals and currency, and tests that catch a layout breaking under mirroring. We do not write Arabic copy and we do not translate. That needs a native standard suited to this market and belongs with people who do it properly. A supplier implying they cover both is usually planning to machine-translate your customer-facing text, which is the version readers notice immediately.

Regulated products

Where a licence comes before the build

For one category of product here, the permission decides the specification — reversing the order most teams work in.

Virtual assets are licensed in Dubai

Dubai regulates virtual asset activity through an authority established under Dubai Law No. 4 of 2022, running a full market regime since February 2023 with twelve rulebooks and seven categories of regulated activity. If a product issues, custodies, exchanges or brokers virtual assets from Dubai, the licence is not a later formality — it governs what the product may do, for whom, and with what disclosures. Practitioners describe 2026 as the year those rulebooks are enforced.

The build follows the permission

This inverts the usual order of work. Normally a team builds and compliance is arranged around it; here the category applied for determines the feature set, the onboarding flow, the record-keeping and the disclosures before anything is designed. We are not licensing advisers and will not act as though we were. What we will do is ask which category you are pursuing before proposing an architecture, because a wallet, an exchange and an issuance are different products.

Where we have and have not done this

We have built production blockchain systems, including a perpetuals trading terminal, and that work is on the portfolio under the client's name. None of it was delivered under a Dubai virtual asset licence. If your build needs a supplier who has been through that process, that is a fair requirement and we are not the answer to it. If it needs engineers who have shipped a demanding trading interface, that is a different question.

Free zone or mainland, the build differs

Legal geography decided before architecture, not discovered during it.

Where it applies

Who ends up inside these rules

Grouped by the obligation that reaches them rather than by industry, and described by the shape of the engineering problem.

B2B trading, wholesale and distribution

The sector we have actually delivered in here. Catalogues that are large, shallow and constantly changing, where the commercial problem is that buyers search for a product rather than a company, and the technical problem is that most catalogue sites render slowly enough to lose them first. What decides these builds is how the catalogue is structured and how fast a page reaches a buyer on a phone, rather than the length of the feature list.

Real estate and proptech

Listing platforms, portfolio dashboards and the reporting underneath them. The recurring difficulty is that property data arrives from several sources that disagree, and the system has to show one number without quietly choosing a winner. We have built in this category for clients in other markets rather than in the Emirates, which is worth stating rather than leaving to inference. Listings are also the part of a product most likely to be read in Arabic.

Virtual assets and tokenisation

Products touching virtual assets from Dubai, where the regulatory category is settled before the roadmap is. The engineering problems are the familiar hard ones — correctness under partial failure, custody boundaries, and interfaces dense enough for expert users without becoming unusable — sitting on top of a permission that governs what may be offered at all. The compliance surface is unusually wide relative to the size of the first release.

Free zone companies selling into the mainland

Businesses that incorporated in a free zone for speed and ownership, then found their customers on the mainland. Systems built for the first situation frequently do not fit the second: invoicing, contracting entity, tax treatment and now electronic invoicing all change. The work is usually less about new features than about a data model that assumed one entity and one set of rules when it now has to represent two.

Fit

When to hire in the UAE, and when not to

Every reason below turns on something only true here. Where a local supplier is the better answer, we say so.

When a UAE supplier is the better answer

Work needing someone who can sit with a free zone authority, a regulator or a bank in person, repeatedly.
Products where Arabic has to be owned end to end, including the copy and the judgement about how it reads here.
Contracts requiring a UAE licensed entity as the supplier, which several larger and government-adjacent processes do outright.
Builds shaped by a Dubai virtual asset licence, where having been through that process before is genuinely worth paying for.

When a distributed team is the better answer

Engineering depth needed intensely for a period and then not at all, which is expensive to carry on a local payroll.
Delivery against a scope already written down, where the constraint is capacity rather than time in anyone's calendar.
Work that is ordinary product engineering, where no licence, entity or language requirement decides the outcome.
Budgets that need to reach the build rather than the layer of account management sitting above it.

How these engagements go wrong here

Arabic scoped as a translation line item, when mirroring was a design system decision taken months earlier.
Electronic invoicing treated as a finance project, then found to be a data model problem with a published deadline.
The incorporation question never asked, so the architecture assumes a jurisdiction the client is not actually in.
A licence category chosen after the product was designed, forcing onboarding and disclosure to be rebuilt.

Jurisdiction moves the number before features do

Two identical briefs can price differently because of where the company is registered. A DIFC entity shipping an AI feature carries obligations a mainland entity does not, and a virtual asset product carries a category decision ahead of a roadmap. We establish this during scoping rather than at a security review, because by then the work is the same size and the timeline is not.

Electronic invoicing is scope, not a later task

If your product raises invoices, the schema requirement lands inside the data model rather than beside it, and it arrives on a published date. Treating it as a phase after launch is what turns a modest piece of work into a migration. We would rather it sat in the estimate at the start, where it is small.

See what drives an estimate

Services & cost guides

Services and the guides that price them

Every service below is available to clients here, and every guide is already published.

Services

Web Development

Sites & web apps

App Development

iOS & Android

UI/UX Design

Product design

Blockchain Development

Web3 & dApps

AI & ML Solutions

Agents & automation

Digital Marketing

SEO & growth

Cost guides

Custom Software Development Cost Guide 2026

What a build costs stage by stage, and which decisions move the figure furthest.

How Much Does a Custom AI Agent Cost in 2026?

Priced by capability, from a scoped pilot through to something running in production.

AI Agent Development Cost 2026 — Global Price Comparison

The same agent build priced market by market — the comparison worth having before shortlisting.

SaaS Development Cost Guide 2026

Where the budget goes on a multi-tenant platform, and what the second enterprise customer costs.

AI Agent vs Traditional Chatbot

Which of the two a business actually needs, and the honest cost difference between them.

Read our case studies Who you would be working with

UAE FAQ

Questions from Emirates buyers.

What enquirers here ask before the first call, including three whose honest answer costs us the work.

Yes, more than most teams expect. DIFC and ADGM run their own data protection statutes rather than the federal one, so an identical product can owe different duties depending on where the company is registered, and DIFC additionally reaches systems that process personal data autonomously. Because the incorporation decision is usually taken before a developer is appointed, tell us which one you are in at the start. It changes architecture, not just paperwork.

Start in the UAE

Building for customers in Dubai or Abu Dhabi?

Book a scoping call, or send the scope and we'll come back with a written understanding of what you are building and which obligations reach it.

business@futurisesolutions.com