Blog
Doubao Work: How Chinese Enterprise-AI Companies Can Establish UAE Operations
The short answer
Doubao Work is a Chinese product built around an agent that takes a task from a user and carries it out, rather than a chatbot that only answers. A company selling that kind of product to UAE customers is governed first by the federal personal data protection law, Federal Decree-Law No. 45 of 2021, which the UAE Data Office oversees as federal data regulator. The fact that most often decides the route is whether the agent will read, store or act on the personal data of people in the UAE, and where that processing physically happens.
Data law does not stop a company being incorporated. It decides what the company must be able to prove to its first enterprise customer: who controls the files and logs, where they sit, and who answers when the agent makes a mistake.
For a foreign AI vendor, that proof shapes the entity choice more than the licence fee does. A company that only resells a hosted service from abroad has a different footprint from one that installs the agent inside a customer's network and keeps engineers on site.
What an AI Agent Changes Under the UAE PDPL
A chat assistant sees what a user types. An agent sees much more. To book a meeting, reconcile an invoice or draft a report, it needs access to mailboxes, shared drives, accounting tools and sometimes credentials. Each of those is a place where personal data lives.
The federal PDPL treats the processing of personal data, in whole or in part through electronic systems, as within its scope. The law came into force on 2 January 2022. It generally ties processing to the consent of the data owner, with listed exceptions, and gives individuals the right to ask for corrections and to restrict or stop processing. It also sets rules for transferring personal data across borders for processing, which is the provision a vendor running models outside the UAE needs to read closely.
The practical consequence is that a UAE enterprise customer will ask the vendor to say, in writing, what the agent can read, what it keeps, whether prompts and outputs are used to improve the model, and which subprocessors touch the data. A founder who cannot answer those questions will lose the deal before the licence question arises.
The Data Office was set up under Federal Decree-Law No. 44 of 2021 and sits with the UAE Cabinet. Its remit includes drafting data protection policy and issuing guidance, so the position on implementation detail can move. Check the current guidance before signing a hosting contract.
Hosted, private-cloud or on-premises: the choice that drives the entity
Hosted delivery is the lightest. The vendor runs the agent from its own infrastructure and the customer logs in. The UAE company may be little more than a sales and support entity, but the data-transfer question is at its sharpest because customer data leaves the country by design.
Private-cloud delivery places a dedicated instance in a cloud region the customer approves. The vendor still operates it, so the vendor still processes the customer's data, and the contract has to say so.
On-premises delivery puts the software inside the customer's walls. Cross-border transfer concerns fall away for the stored data, but remote support sessions can bring them straight back. A support engineer in another country who connects to a customer's server is accessing UAE data from abroad.
Many Chinese enterprise-software vendors offer all three. They should write each as a separate schedule in the master agreement, with its own data-handling terms, rather than one document that tries to cover every case.
Healthcare, finance and government customers
The sectors that spend most on workflow automation are also the ones with their own rules. A health customer brings Federal Law No. 2 of 2019 on the use of information and communication technology in health fields, which the UAE government describes as applying in free zones as well. Banks and insurers answer to their own supervisors and will push their outsourcing conditions down to the vendor. Government entities buy through their own procedures.
None of this means the vendor needs a licence of its own. It means the customer's compliance team will put conditions in the contract, and the vendor needs a local entity that can sign them, hold the insurance and be served with a claim. A thin branch that defers every question to a parent abroad tends to stall in procurement.
A vendor selling only to private non-regulated companies, such as retailers or logistics firms, has a lighter path. Say that in the sales material and keep sector customers for a second phase.
Responsibility for what the agent does
An agent that sends an email, moves a file or submits a form acts in the customer's name. If it acts wrongly, the customer will look to the contract. The UAE Cybercrimes law, Federal Decree-Law No. 34 of 2021, covers offences committed through information technology and networks, and a vendor whose agent is given standing credentials should design as if its logs could one day be read by an investigator.
Three design choices carry legal weight and are worth settling before incorporation:
- Which actions the agent may take without a human approving them, and which need approval first.
- How long credentials are held, and whether the customer can revoke them at once.
- Who owns the logs, and whether the vendor may use them to train or tune models.
A clear approval threshold is easier for a customer's risk team to accept than a claim of full autonomy.
Choosing a UAE route for an AI vendor
A mainland company allows direct contracting with UAE businesses and government buyers, which is why enterprise software sellers often start there. Free-zone setups suit teams whose main activity is development or remote support, though each zone sets its own terms and the authority should confirm what a company may do from its premises. A DIFC entity brings the DIFC Data Protection Law into play, which matters if the customer base sits there.
The comparison turns on where customers are, where engineers sit, and whether the company will hold hardware. A founder weighing which jurisdiction fits the business model should bring answers to those three points. The team's own residence status matters too, since visas for the founding team depend on the licence chosen. Read how Velarozone works if you want to see what the adviser process looks like before you commit.
Banks will ask the same questions as customers: who owns the company, who funds it, where the money will come from and why a UAE entity is needed. A vendor with a signed pilot customer and a clear data-flow diagram answers these faster than one with a formation certificate and a website.
In short
What to take from this
- Doubao Work is described on its own page as a way of working where the user tells Doubao what to do and the agent handles the task, so the product acts on a customer's systems.
- The federal PDPL applies to electronic processing of personal data inside or outside the UAE, so a vendor hosting abroad is not outside its reach.
- The UAE Data Office is the federal data regulator. The DIFC has its own Data Protection Law (DIFC Law No. 5 of 2020).
- Healthcare customers bring in a separate federal law on ICT in health fields, Federal Law No. 2 of 2019.
- Hosted, private-cloud and on-premises delivery each need a different contract and a different mix of local staff.
- Does the PDPL apply if our models run in China and never touch UAE servers?
- The law's scope extends to processing inside or outside the UAE, as the UAE government's data-protection page puts it. If you process the personal data of people in the UAE, plan on it applying. The transfer rules are the part to study, and the conditions should be read from the law and current Data Office guidance rather than assumed.
- Do we need a licence to sell an AI agent in the UAE?
- Selling software is not in itself a licensed financial or health activity. What the agent does for the customer can be. An agent that makes payments, handles patient records or gives professional advice may place the customer, and sometimes the vendor, under a sector supervisor. Write down what the product will and will not do, then check each function against the relevant authority.
- Can the same company serve customers inside the DIFC?
- The DIFC has its own Data Protection Law (DIFC Law No. 5 of 2020), separate from the federal PDPL. A vendor serving both onshore and DIFC clients may need contract terms that reflect two regimes. Take legal advice on how they apply to your specific data flows.
- What should we show a UAE bank?
- Ownership and funding, a named customer or pipeline, and a short explanation of why the UAE company exists. Include the product's data-flow summary, since compliance teams at banks understand a data map better than a pitch deck. This improves the file; it does not guarantee an account.
Sources
Where this comes from
General information drawn from the CBUAE Rulebook, including the Retail Payment Services and Card Schemes Regulation (C 15/2021), and Cabinet Resolution No. (134) of 2025 as published, not legal or tax advice. Rules and guidance change, so confirm the current text and each institution's own requirements before you submit.