Blog
ChatGPT, Claude, Gemini and GLM: Setting Up a UAE AI Application Company
The short answer
A UAE company that builds on ChatGPT, Claude, Gemini or GLM rents its core capability but keeps the data duties for what customers send through it. Federal Decree Law No. 45 of 2021, overseen by the UAE Data Office, applies to controllers and processors in the UAE and to foreign ones handling data of people in the UAE. It does not apply to free-zone companies that have their own personal data law, such as those in the DIFC. The question that most often decides the route is whether the product only assists a user or takes over a decision in a regulated sector such as banking, health or law.
A writing assistant for marketing teams and a tool that screens loan applications can share a code base and still need completely different perimeters, because the second one makes decisions that people can contest.
The company should be set up around what it will contract, hold and control. Who signs with customers, who holds the provider account, where prompts and outputs sit, and who answers when a model gets something wrong are the facts a bank, an investor and a licensing authority will ask about. How Velarozone works is built around fixing those facts before any filing.
What the provider terms decide before the company does
Read the provider terms as if they were part of your own product specification, because for your customers they are.
Google's Gemini API terms draw a hard line between paid and unpaid use. For unpaid services, Google may use submitted content and responses to improve its products, and human reviewers may read and annotate input and output after it is disconnected from the account, API key and Cloud project. The terms advise against submitting sensitive, confidential or personal information to those services. For paid services, Google states that it does not use prompts or responses to improve its products and logs them for a limited time to detect misuse and meet legal disclosure requirements. A startup prototyping on a free tier with real customer documents has already made a data decision, whether or not anyone wrote it down.
The same terms require API users to be 18 or older and bar API clients directed toward, or likely to be accessed by, people under 18. They also prohibit using the service to develop competing models and reverse engineering or extracting model components. That matters if your roadmap includes distilling outputs into your own model, which some founders treat as the point of the business.
GLM comes from Zhipu AI's BigModel platform and ChatGPT from OpenAI. Each has its own commercial terms, and each should be read for the same four things: data use, minimum age, limits on competing use, and what happens to your service if a policy changes. A multi-provider design hedges that risk. It also multiplies the terms your customer contracts must stay consistent with.
Model retirement is a contract problem
Anthropic's model documentation shows how short the life of a model dependency can be. It lists Claude Sonnet 5.5 and Haiku 5.5 with retirement "not sooner than" 28 September 2027 and 7 October 2027, while earlier models such as Sonnet 5 and Sonnet 4.6 already sit in a legacy list. It also says Amazon Bedrock and Google Cloud set their own lifecycle dates for the models they host, and it lists the same models across the Claude API, Amazon Bedrock, Google Cloud, Microsoft Foundry and Claude Platform on AWS.
Two things follow for a UAE company. A customer contract that promises a named model for a fixed term is a promise the provider can undercut, so service descriptions should state outcomes and reserve the right to substitute. And the cloud route you choose changes who sets the retirement date and where processing happens, which feeds straight into the data question below.
Which personal data law applies to the application
The UAE government's data protection page identifies Federal Decree Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022. It prohibits processing personal data without the owner's consent except in listed cases, requires companies holding personal data to secure it, gives owners rights to correct data and to restrict or stop processing, and sets requirements for cross-border transfer and sharing. The page describes the UAE Data Office, established under Federal Decree Law No. 44 of 2021, as the federal regulator responsible for policy, standards, complaints systems and implementation guidance. It also lists the DIFC Data Protection Law (DIFC Law No. 5 of 2020) alongside the federal law.
For an AI application, the practical work is a map. Which customer fields reach the model provider, in which region are they processed, which subprocessors touch them, and what consent covers each step. A company with customers inside the DIFC may face the free-zone law as well as the federal one, so the licensing choice is not neutral here. The federal page does not explain how the two interact, so that point needs a specialist read on the actual facts.
Where the product crosses into a regulated sector
A tool that drafts text for a human to approve sits in a different position from one that issues recommendations or executes transactions. The test is function. The federal personal data law steps back where separate legislation protects personal health data or personal banking and credit data (Article 2(2)(e) and (f)), and it does not apply to government entities (Article 2(2)(b)), so those customers bring their own rules. If the application informs credit decisions, handles patient information, gives legal conclusions or is used by a government entity, the customer's sector rules reach back into your contract through audit rights, data localisation demands and liability clauses, even where you hold no licence yourself.
Write down the human review step and who performs it. Article 18 of the federal law lets a person object to an automated decision that has a legal or adverse effect on them, unless it rests on a contract, a legal requirement or their prior consent, and it requires the controller to include a human in reviewing such decisions on request. Banks and enterprise buyers ask for the same step in due diligence, and it is the clearest evidence that the product assists rather than decides.
Choosing the entity route
Both a directly licensed mainland company and a free-zone company can hold software and technology activities, and a financial-centre entity may suit a founder whose customers sit inside that centre. The choice usually turns on where the customers are, whether staff need residence visas sponsored by the entity, and whether any customer insists on a particular jurisdiction's courts and data rules.
The more useful structural question is where intellectual property sits. If prompts, evaluation sets and fine-tuned configurations were built by contractors or an overseas parent, assignments should be in place before the UAE company is presented to a bank or investor as their owner.
In short
What to take from this
- Personal data law follows the customer, not the server: Decree Law 45 of 2021 reaches data of people in the UAE even when the controller or the model provider sits abroad, unless a free-zone law such as the DIFC's applies instead.
- Provider terms differ on whether customer prompts can be used to improve the provider's models, and the difference often depends on whether you pay.
- Models are retired on published schedules, so customer contracts should not name one model as a permanent feature.
- Selling into finance, healthcare, legal or government usually brings in a sector regulator that the software vendor does not escape.
- Prompts, workflows and fine-tuned configurations need an ownership paper trail, especially where contractors built them.
- Both mainland and free-zone companies can run this business, so the entity route matters less than the contracts it signs.
- Does using a foreign model provider mean the company owns nothing?
- No, but ownership is narrower than founders assume. The company can own its code, prompts, workflows, evaluation data and customer relationships. It does not own the model, and it takes the provider's usage terms, including limits on building competing models, as given.
- Do customer prompts have to stay in the UAE?
- Not as a blanket rule. The federal law allows transfer abroad to jurisdictions the UAE Data Office has approved as having adequate protection (Article 22). Otherwise it allows transfer on listed grounds, such as a contract binding the recipient to the law's standards, the person's explicit consent, or necessity to perform a contract with the person (Article 23). Government and finance customers may impose localisation by contract, so the answer is often set by the customer, not the statute.
- Is a free tier acceptable for early customer pilots?
- Under Google's terms, unpaid use can feed product improvement and human review, and the terms advise against submitting sensitive or personal information. Pilots with real customer data should run on paid terms with the data position agreed in writing.
- What should the customer contract say about model changes?
- Describe the service by outcome, reserve the right to change or replace underlying models, and state who bears downtime when a provider retires or restricts a model. Retirement schedules are published, so a contract that ignores them has no excuse.
Sources
Where this comes from
General information drawn from the CBUAE Rulebook, including the Retail Payment Services and Card Schemes Regulation (C 15/2021), and Cabinet Resolution No. (134) of 2025 as published, not legal or tax advice. Rules and guidance change, so confirm the current text and each institution's own requirements before you submit.