Guide
How to Structure a Foundation-Model or Generative-AI Company in the UAE
The short answer
For most foundation-model and generative-AI companies, the commercial licence itself comes from Dubai Department of Economy and Tourism (DET) or a free-zone authority, and that part of the process is routine. What takes longer is settling who owns the training data and the model weights, because that question sits under UAE federal data-protection law rather than company law. The single factor that most often decides the operating route is whether personal data was used to train or fine-tune the model, and under whose licence that processing happened.
The regulatory perimeter and who decides
There is no dedicated AI regulator that licenses a UAE foundation-model or generative-AI company. Commercial registration runs through the same route as any other technology business: setting up a mainland company through the relevant mainland licensing authority, or a free-zone structure. What changes the picture is what the model actually touches. Personal data used in training, fine-tuning or inference brings UAE federal data-protection law into scope. Infrastructure that qualifies as critical brings the Cyber Security Council's standards into scope. And if the model's outputs feed a regulated vertical (health guidance, financial recommendations, media content), that sector's own regulator joins the perimeter test on top of the commercial licence. The licensing authority decides the company may trade; it does not decide the company may process the data it wants to train on, or that its infrastructure meets cybersecurity expectations.
What the data and cybersecurity rules actually require
UAE federal data-protection law governs how personal data is collected, used and transferred once it enters a training or fine-tuning pipeline, and the obligations attach to the processing itself, not to the AI label on the product. A model trained even partly on personal data needs a documented lawful basis for that processing, and a position on any transfer of that data outside the UAE, before the dataset is put to use, whether the product is called a foundation model, a fine-tune or an API wrapper. Separately, the Cyber Security Council sets the national cybersecurity strategy and standards that apply once compute or hosting infrastructure is treated as part of UAE critical systems. A generative-AI company running its own training or inference infrastructure at meaningful scale should expect to be measured against those standards, not against a generic internal IT policy, and should not assume a cloud provider's own certifications close that question on its behalf.
How compute, IP and money move through the structure
Banks and payment acquirers underwriting an AI company look past the licence to the contracts behind it: who the compute is billed to, how API or subscription revenue is actually collected, and whether the entity signing customer contracts is the same one that holds the model and the data rights. A holding company that owns the weights, sitting alongside an operating company that bills customers, is common once a model moves from prototype to revenue, but each needs its own contracts, bank mandate and transfer-pricing position, not a shared account standing in for both. Account opening moves faster when the model card, dataset-rights register and compute contracts are ready before the bank conversation starts, which is the groundwork behind corporate bank account readiness. Cost here is built in layers rather than one figure, since compute contracts and engineering headcount typically dwarf any government fee; Velarozone's own fee is itemised in the engagement letter; see how Velarozone works for how that layering is set out.
Ownership, roles and the people a regulator or bank expects to see
Every contributor to a model (founders, employees, contractors, and any open-source maintainers whose code or weights were merged in) needs a documented IP assignment or licence before the model can be treated as a company asset rather than a disputed one. Where training used personal data, someone inside the company has to be accountable for the data-protection position, even in a small team where that person also holds another role. Group structures that separate an IP-holding entity from an operating company, or that bring in investors across more than one jurisdiction, fall under regulated and complex ownership setups, and the ownership chain needs documenting the same way the model itself is, through business plans and documentation a bank or enterprise customer can read and rely on.
What goes wrong in AI company structuring
- A company owns the brand and the customer contracts but not the model weights, because the weights were trained by contractors who never assigned the IP.
- Training data included personal data carried over from a founder's previous employer, or scraped without a documented lawful basis for that processing.
- Customer contracts repeat an upstream model licence's claims about accuracy or safety that the company cannot actually stand behind itself.
- A generative-AI tool is deployed into a regulated vertical, such as health or finance, without checking whether that regulator treats the output as a controlled service.
From licence to live model: visas, premises and renewals
Once the entity is formed, the licence connects to operating steps that the AI label does not change. Visa capacity is tied to the establishment card and needs to cover the engineering, safety and compliance staff who actually run the model, not just a notional headcount. A registered address is required regardless of whether the compute sits on UAE soil or with an overseas cloud provider. Corporate tax registration with the Federal Tax Authority (FTA) follows the same federal rules as any other UAE company; there is no separate AI category. Renewal is also the point to recheck the data-protection and IP position, because a model retrained, fine-tuned further, or opened to new customers since the last renewal may have moved outside the perimeter recorded at formation.
