Building an AI Data Centre in the UAE: What Foreign Investors Must Settle First

A shell company can be formed quickly. A megawatt cannot. The sequence that works in practice starts with a site and a secured grid or on-site supply, then a design for cooling, then the corporate structure and trade licence that will hold the lease and the connection agreements.

Founders who incorporate first often discover that the entity they chose cannot hold the land or sign the utility agreement. A free-zone company may be able to lease inside its zone only. A company that wants a plot outside a zone is looking at a different set of rules, which is where a mainland company comes in. The comparison between free zone and mainland matters here for a plain reason: where the site sits narrows which licences can be used.

The Ministry of Energy and Infrastructure links the UAE Energy Strategy 2050 from its site, which is the place to read the national policy direction on supply. It does not replace a site-specific answer from the utility that will actually connect the plot, and no one should assume a connection date from a policy document.

Phasing is the practical tool. A 10 megawatt first phase with options on more is easier to finance and to explain to a bank than a headline figure with no secured supply behind it. Say what is contracted and what is hoped for, in separate columns.

Most serious projects separate three roles, even when one group owns all of them.

The development or project company holds permits, the land interest and the construction contracts. The asset company owns the building and equipment and carries the debt. The operating company employs the engineers, which brings in residence visas, signs service agreements and holds the customer relationship. Each can sit in a different jurisdiction if the commercial logic supports it. For a cloud service provider, the UAE Cybersecurity Council's National Cloud Security Policy also asks for alignment with national priorities, including Emiratisation and national workforce development, so the hiring plan belongs in the operating company's design.

The reason is financing, not tidiness. A lender wants security over an asset that cannot be dragged into an operating dispute. A customer wants a counterparty with staff and insurance. A buyer later may want the asset without the operating history.

The cost of splitting is real: intercompany leases, separate accounts, separate audits and separate bank relationships. If the project is one small facility for one customer, a single company with a clear contract may be the more honest structure. Velarozone weighs the cost of splitting against what a lender or customer will actually require, which is the approach described under how Velarozone works.

The federal personal data protection law came into force on 2 January 2022. It applies to personal data processed electronically in whole or in part, inside or outside the country, and it generally rests on the consent of the person the data belongs to, with stated exceptions. It also sets conditions for cross-border transfer and for sharing data with processors.

For an operator, the point is who is the controller and who is the processor. A colocation provider that only supplies space and power usually handles little personal data directly. A managed cloud or AI hosting provider handles customer workloads and has a much closer relationship with them. The contract should say which one the company is, and the answer should match what the engineers can actually see.

Customers in the financial centre may add the DIFC Data Protection Law (DIFC Law No. 5 of 2020) to their requirements. Dubai also has its own data law dating from 2015. None of this settles where a given customer's data may be stored: the federal page describes transfer requirements without setting out a general localisation rule, so any sector-specific storage condition has to come from the customer's own regulator and contract.

Anchor demand tends to come in three forms. Global cloud providers lease large blocks and want power certainty and a short list of approved contractors. Government and government-linked buyers want local control and often a local partner. Enterprises and AI start-ups want smaller, faster capacity, often with GPUs.

Each asks a different question of the UAE company. The hyperscaler checks the supply chain and the construction schedule. The government buyer checks ownership and who can access the hall. The start-up checks whether hardware will actually arrive.

Hardware is the quiet risk. High-end accelerators and networking equipment depend on supplier allocations and on export conditions set outside the UAE. A business plan that counts racks before it has purchase orders is counting something it does not yet have. Foreign investors should ask for written supplier commitments and note any end-use conditions, because those can restrict which customers the capacity may be sold to.

Banks lend against contracts and cash flow, not against ambition. A project bank will look for a site right, a power agreement, a construction contract with a fixed completion date, and a signed customer commitment with minimum payments.

Equity investors read the same documents differently. They want to see that the sponsor has built something before, or has hired someone who has. A team of two founders and a financial model will struggle to raise money for a facility measured in tens of megawatts.

Account opening for the UAE entity is a separate matter. Banks ask for the ownership chain, the source of funds and the expected transaction flows. Where capital arrives from several countries, prepare a one-page diagram of who owns what and where the money starts. Preparation reduces questions. It does not guarantee an account.