GPU Hosting and AI Inference in the UAE: Power, Data, Licensing and Customer Contracts

Four operating models cover most GPU hosting companies, and each puts a different mix of asset risk and data risk on the company.

Owning GPUs and selling reserved or on-demand compute puts a large asset on the balance sheet. Lenders and lessors will ask what contracts back the utilisation. Leasing hardware and reselling dedicated capacity moves the asset risk to the lessor but leaves the company committed to lease payments whether or not customers show up. Hosting customer-owned hardware in a managed facility is closest to a colocation service: the customer owns the cards, you supply space, power, cooling and remote hands. Selling managed inference means the company keeps the hardware and sells an outcome, such as tokens served or models hosted.

A group often starts with the first model and later adds the fourth. That is a change in what the company does with customer data, and it deserves its own look at contracts, security commitments and insurance rather than a quiet addition to an existing service sheet.

Where the hardware sits matters as much as who owns it. A company renting rack space in a third-party data centre depends on that facility's power allocation, and a GPU cloud and AI compute provider plan should name the facility, the contracted power and the term. Companies planning their own halls should read the guide to an AI data centre company first, because building is a different project from hosting.

Federal Decree Law No. 45 of 2021 came into force on 2 January 2022. It covers processing of personal data through electronic systems, in whole or in part, inside or outside the UAE. It prohibits processing without the data owner's consent subject to exceptions, gives people rights to correction and to restrict or stop processing, and sets requirements for cross-border transfer and sharing. A UAE Data Office, established under Federal Decree Law No. 44 of 2021, is the federal data regulator.

For a raw-capacity business, customer data usually stays inside the customer's own environment, and the host's duties are mostly about security and access. For an inference service, the picture changes. Customers send prompts that may contain staff, patient or client information, and the service stores or logs some of it. The host then usually acts as a processor. Under Article 8 of the law, a processor works on the controller's instructions, erases data when the processing period ends or on handover, and keeps a record of what it processes, which it must give the regulator on request. Under Article 9, it tells the controller about a breach as soon as it becomes aware of it. The contract needs to say who decides the purpose of processing, how long logs are kept, whether prompts are used for anything else, and where the servers are. A customer in a regulated sector will push the same questions down to you.

Free zones can change which law applies. The federal law does not cover companies and establishments in free zones that have their own legislation on personal data protection. The government's data protection page lists the Dubai International Financial Centre's Data Protection Law, DIFC Law No. 5 of 2020, among related laws. If your customers sit in a financial centre, expect them to ask how your service fits it.

TDRA's published remit includes licensing trust service providers and qualified trust service providers, issuing wireless permits, and registering and approving telecommunications equipment, including registering manufacturers and suppliers of telecom equipment and issuing customs release permits for telecom devices. On its public pages, TDRA presents its own cloud as a service for federal entities. For private cloud providers, its Cloud Service Provider page offers a voluntary information form, filed through UAE Pass login, not a licence.

That leaves a question a founder should settle in writing rather than assume. Does any part of the product touch what TDRA licenses, for example network equipment you import or a service that carries traffic for others? TDRA's equipment registration service is limited to companies registered as telecom equipment suppliers, and it sorts devices into three risk levels. A pure compute service sold over existing carriers does not obviously fall under any of this, but the answer depends on the actual architecture. Ask TDRA or your adviser to confirm for your design, and keep the reply on file for your bank and your insurers.

Servers carrying advanced accelerators arrive through suppliers who may attach conditions about end use and about who may rent the capacity. Some of these conditions come from the manufacturer or the distributor, and some from the laws of the country the hardware left. A UAE host that rents capacity to others can find itself bound to pass those conditions on.

The practical task is to read the supply contract before signing the customer contracts. If the supplier restricts end users or locations, build a customer screening step and a termination right into your own terms. Selling capacity you may not be allowed to provide to a given customer is a worse outcome than turning the customer away at the start.

The same screening logic helps with abuse. A host that cannot say what its customers run is poorly placed if a workload turns out to be unlawful.

Reserved capacity, on-demand and spot-style pricing each shift risk differently. Reserved contracts give you revenue certainty and put an obligation on you to deliver the cards you promised. On-demand pricing leaves the cards idle when nobody buys. If you sell a committed number of GPUs before the shipment has cleared, you are exposed to the delay, and the contract should say what you owe if the equipment is late.

Service levels need to match reality. A promised uptime figure is only as good as the power and cooling behind it. Credits for downtime should be capped and linked to the facility contract so that you are not paying more than you can recover.

Customer concentration is the commercial risk most often missed. One large buyer taking most of the capacity makes the company dependent on a single renewal. Lenders and investors will ask about it, and your forecast should show what happens if that customer leaves.

Banks will want a clear picture of the flows: where hardware payments go, who the customers are, which countries they sit in and how money returns. A hosting company with large equipment purchases from overseas and receipts from many foreign customers will face detailed questions. Prepare the supply agreements, the facility contract, the pricing model and the customer acceptance policy as one pack. How Velarozone works is to build that pack around the operating model before the entity is picked, so the story to the bank, the investor and the landlord is the same one.

On the entity choice, free-zone and mainland routes can both host this activity. The choice can change the data law that applies, because the federal law excludes free-zone companies whose zone has its own personal data legislation. The free zone versus mainland guide covers the comparison, and the right answer follows your facility and your customers.