Blog
OpenRouter and Multi-Model AI Gateways: Structuring an AI Routing Platform in the UAE
The short answer
A multi-model AI gateway like OpenRouter, one API in front of many models with routing and fallbacks, can be run from a UAE company as software. Selling usage on prepaid credit is different: the Central Bank of the UAE (CBUAE) Stored Value Facilities Regulation requires a prior licence to issue a stored value facility unless an exemption applies. Prompts can also carry personal data, so Federal Decree-Law No. 45 of 2021 applies to the gateway either way.
Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, applies to personal data processed wholly or partly by electronic systems, inside or outside the UAE. It came into force on 2 January 2022. A customer's prompt can contain names, email addresses or account details, so the law reaches your gateway as soon as it routes that traffic.
The fact that decides the structure is who holds the customer's money. If customers top up a balance with you and draw it down against model usage, you may be issuing a stored value facility. The Central Bank of the UAE (CBUAE) regulation requires that float to sit in segregated accounts with licensed banks, apart from the issuer's own funds, and CBUAE and your bank will look at that before they look at your software.
What a routing gateway actually does, and where the legal exposure sits
OpenRouter's documentation describes the product plainly. A single endpoint, `/api/v1/chat/completions`, gives access to hundreds of models. It can be used from the OpenAI SDK as a drop-in replacement. Requests are routed to the most cost-effective option, and fallbacks happen automatically. Business and Enterprise customers can use a separate EU-region endpoint with EU-eligible models.
For a UAE founder, three of those features translate into obligations. Routing means you choose which provider sees a customer's prompt, so you decide where personal data goes. Fallbacks mean a prompt sent to one provider may be re-sent to another when the first fails, so your data-flow description must cover the fallback path and not just the first choice. The regional endpoint shows what large customers will ask you for: a way to keep traffic inside a stated geography.
A gateway that tells customers "your prompts never leave region X" must be able to prove it for the fallback path too. That means a data map listing every provider and region a prompt can reach, kept in step with the contract signed with each one.
Prepaid credits and the Central Bank stored value rules
Software that charges a monthly fee is simple. A gateway that sells model usage in advance is not, because the customer pays you first and you pay the providers later. In the gap you hold their money.
The test is the Central Bank's definition. A stored value facility is one where a customer pays money to an issuer in exchange for the storage of that value and an undertaking that the issuer will supply goods or services, or make payments, when the value is used. Issuing or operating one in the UAE needs a prior CBUAE licence, except for a single-purpose facility where the issuer itself supplies the goods or services. The Central Bank may also exempt facilities usable only with the issuer or with suppliers under agreement with it. One exemption route applies only while the float stays at or below AED 500,000 and customers number 100 or fewer, and it requires a trial in the CBUAE FinTech Office sandbox. Whether credit that buys a third party's model usage counts as the issuer's own service is a question for CBUAE, not something to assume. A licensed issuer needs paid-up capital of at least AED 15,000,000. It must hold the float, meaning the customers' prepaid funds, in segregated accounts with licensed banks, apart from its own funds. Design the credit product so the answer is deliberate, and take it to CBUAE and your bank before launch.
A card acquirer will want to know whether the balance is refundable, whether it can be spent only on your service and whether CBUAE has been consulted. The payment gateway and merchant acquirer guide explains how a processor looks at a business that takes recurring card payments for a digital balance.
What your suppliers allow you to promise
A gateway can only pass on what its upstream providers permit. Provider terms vary on four points that matter to a reseller:
- Whether usage can be resold at all, and under what branding.
- Whether prompts or outputs may be cached or stored.
- Whether the provider retains or trains on customer data, and whether an opt-out exists.
- Whether the provider may change prices, rate limits or model availability without notice.
OpenRouter's documentation does not describe a data retention policy on its main page and points to separate pages for data processing. That is typical: the answer sits in the provider's terms, not in the product description. Read each upstream contract and write down what you can honestly offer. If one provider retains prompts and another does not, a single customer-facing sentence promising "no retention" is false.
The same logic applies to uptime. You can offer fallbacks. You cannot guarantee that every model remains available, because you do not control the models. Phrase service levels around your own platform and name the dependency on suppliers.
Personal data and the UAE Data Office
Federal Decree-Law No. 45 of 2021 took effect on 2 January 2022. According to the UAE Government's summary, it covers personal data processed wholly or partly by electronic systems, whether inside or outside the UAE, generally requires the data owner's consent for processing, gives individuals rights to correct data and to restrict or stop processing, and sets requirements for transferring and sharing personal data across borders. The UAE Data Office, affiliated with the Cabinet, is the federal data regulator.
For a gateway, the practical consequences are:
- You are likely to act as a processor for your customers, so your contract with each customer needs to say so and describe what you do with the data.
- Routing a prompt to an overseas provider is a cross-border transfer that should be covered in your records and your customer terms.
- Free-zone and financial-centre entities may sit under their own data laws (the DIFC has a separate data protection law), so check which regime your chosen zone brings with it.
Enterprise customers in regulated sectors may add their own localisation demands on top. Ask for these in the sales process, not after the contract is signed.
Picking the entity: mainland, free zone or a technology zone
A software-only gateway with a small team and customers around the world often fits a free-zone company with a technology or commercial licence. A gateway whose main customers are UAE businesses, or which wants to contract directly with government-linked buyers, may prefer a mainland licence. Neither choice removes the credit question: the Stored Value Facilities Regulation defines the State as the UAE excluding the Financial Free Zones, so an ordinary free-zone or mainland company selling prepaid credit sits inside the area it covers. The guide to choosing between free-zone and mainland sets out the trade-offs on customer location, premises and visas.
If you also host open models on your own infrastructure, the operating questions move towards a cloud business, covered in the cloud managed service provider guide. If you train or fine-tune models yourself, the foundation model company guide is closer to your position. Before choosing, a founder can see how Velarozone works when it assesses credit design, data flows and entity together.
In short
What to take from this
- A gateway company's core promise is one endpoint, many models. OpenRouter's own documentation describes a single chat completions endpoint, routing to the most cost-effective option and automatic fallbacks.
- Selling usage on prepaid credit can make you the issuer of a stored value facility, which needs a prior CBUAE licence unless exempt. A monthly software subscription does not store customer value in advance.
- Prompts routed through your platform can contain personal data, which brings in Federal Decree-Law No. 45 of 2021 and the UAE Data Office.
- Model providers set the terms on resale, caching and data retention; your customer contract can only promise what your suppliers allow.
- Enterprise buyers will ask where data is processed and which sub-processors see it before they ask about price.
- Do we need a licence to resell model access?
- A software licence activity alone may not cover reselling usage on prepaid credit. If customers pay in advance for stored value, the CBUAE Stored Value Facilities Regulation requires a prior licence unless the facility is single-purpose or the Central Bank exempts it. Settle the credit design first, then take the question to CBUAE and your bank.
- Does Federal Decree-Law No. 45 of 2021 apply if our servers are outside the UAE?
- The UAE Government's summary says the law applies to electronic processing of personal data whether inside or outside the UAE. If you have UAE customers or a UAE entity handling their prompts, treat it as applicable and take advice on the details.
- Can we promise customers that their data is not used for training?
- Only if every upstream provider you route to gives you that commitment in writing. If some do and some do not, offer routing controls that let the customer exclude the others, and describe the position per provider.
- Can we guarantee model uptime?
- No. You can describe the uptime of your own platform and your fallback behaviour. Availability of third-party models depends on the providers.
Sources
Where this comes from
General information drawn from the CBUAE Rulebook, including the Retail Payment Services and Card Schemes Regulation (C 15/2021), and Cabinet Resolution No. (134) of 2025 as published, not legal or tax advice. Rules and guidance change, so confirm the current text and each institution's own requirements before you submit.