Phases, PINT AE, the 5-corner model and mandatory fields, with official sources.
AI automation and development for Dubai and UAE businesses
Scenox is an AI automation and development company for businesses in Dubai and across the UAE. We design, build and run AI agents and workflows for finance, operations, customer service and sales, in Arabic and English, on WhatsApp and the phone, around local rules: the federal PDPL, DIFC and ADGM regimes, telemarketing rules and 2027 e-invoicing.
Which data law applies depends on where you are licensed, and the marketing rules depend on the channel. We work that out first, then design the system around it.
UAE rules that shape an AI buildChecked 15 October 2026
- Mainland data protection
- Federal Decree-Law No. 45 of 2021 (PDPL), in force since 2 Jan 2022
- Free zones with their own law
- DIFC Data Protection Law No. 5 of 2020; ADGM Data Protection Regulations 2021
- AI systems in DIFC
- Regulation 10: notice at first use, human-defined purposes
- Automated decisions (PDPL)
- Right to object, and human review on request
- Marketing calls
- Approved companies only, 9:00 to 18:00, never to DNCR numbers
- E-invoicing
- Phased from 1 Jan 2027 through an Accredited Service Provider
UAE data protection: which law applies to your AI system
The federal PDPL excludes free zones that have their own data protection law, so a DIFC or ADGM company follows its own regime.
| Topic | Federal PDPL | DIFC | ADGM |
|---|---|---|---|
| Law | Federal Decree-Law No. 45 of 2021, in force 2 January 2022 | Data Protection Law No. 5 of 2020 and the Data Protection Regulations (Regulation 10 from 1 September 2023) | Data Protection Regulations 2021 |
| Who it covers | Processing in the UAE, and processing abroad of data about people in the UAE | Companies established in the DIFC | Processing in the context of an ADGM establishment, wherever it happens |
| Regulator | UAE Data Office | DIFC Commissioner of Data Protection | ADGM Office of Data Protection |
| Carved out | Government data, health and banking data under their own laws, and free zones with their own law | Not applicable | Not applicable |
| What it means for an AI build | People can object to automated decisions with legal or serious effects and ask for human review. A DPIA is needed for automated evaluation with those effects. | AI systems need clear notice at first use and may only process for human-defined or human-approved purposes. The deployer is treated as controller and the operator as processor. | Its own controller, processor and transfer rules. We map them with your data protection officer. |
Scroll sideways to see every column.
PDPL cross-border transfers are allowed to countries with adequate protection or under the exceptions in Article 23, such as a contract with equivalent safeguards or the data subject's express consent. The law left detailed conditions to executive regulations, which we could not find published on official UAE sources at the time of writing, so check their status with your adviser.
Arabic and English voice and chat
Arabic is the UAE's official language, and many customer conversations move between Arabic and English. A UAE voice or chat agent has to handle both in one conversation.
Language switching mid-conversation
Customers start in English and move to Arabic, or mix the two in one sentence. The agent follows them and keeps one record of the conversation.
Dialect, tested on your samples
Gulf Arabic, Levantine and Egyptian speakers sound very different to a speech model. We measure accuracy on your own recordings before launch, and say so if a dialect is not good enough yet.
Names that match your CRM
The same customer can be Mohammed, Muhammad or محمد. Matching handles transliteration so a caller is linked to the right record.
Right-to-left interfaces
Chat widgets, forms and agent consoles render Arabic right to left, with numbers and English product names kept readable.
Arabic in finance documents
Supplier invoices and trade licenses arrive in Arabic, English or both. Document intelligence reads both before the data is posted.
Hand-off with context
When a person takes over, they get a summary in the language they work in, plus the original transcript.
Sources: [6]
WhatsApp-first customer service, inside the marketing rules
Many UAE customers would rather message than call, so WhatsApp carries a lot of service traffic. The rules differ for service messages and for marketing.
Service conversations we automate
- Order and delivery status, answered from your systems of record
- Appointment booking, rescheduling and reminders
- Payment reminders and receipts for existing customers
- Voice notes transcribed and answered in the language they were sent in
- Escalation to a named person with the full thread attached
Rules for marketing messages and calls
- Cabinet Resolution No. 56 of 2024 regulates telemarketing, with penalties in Resolution No. 57 of 2024
- Per the official WAM report, it covers calls, marketing text messages and marketing messages through social media apps
- Marketing calls need prior approval from the licensing authority and run only between 9:00 and 18:00
- Calls use local numbers registered to the company's trade license, and never go to numbers on the Do Not Call Register
- Marketing SMS needs prior consent under TDRA rules and is sent only between 7:00 and 21:00
How we handle outbound calls in the UAE
We build outbound voice agents only for clients whose marketing activity is approved, and we put the rules in code: the calling window, the Do Not Call Register check, retry limits after a refusal, and a disclosure at the start that says who is calling, why, and that the call is recorded.
Most UAE voice work we scope is inbound or service calls: answering, booking, reminders and follow-ups a customer asked for. Those carry less risk and usually pay back sooner.
Finance automation for the 2027 e-invoicing deadline
UAE e-invoicing starts on 1 January 2027 for businesses with revenue of AED 50 million or more, and by 1 July 2027 for the rest. Most of the work is in data and exceptions, which is where we help.
Data before the deadline
Customer and supplier master data cleaned for TRNs, trade license numbers and emirates before onboarding with your Accredited Service Provider.
Checks before invoices leave
Each outgoing invoice checked against the Ministry's mandatory fields, so rejections are fixed in the ERP.
Two intake routes for AP
Structured eInvoices from live suppliers and PDFs from the rest go into one matching and approval queue.
Sources: [12]
AI governance UAE buyers ask about
Government and regulated buyers increasingly ask how a system lines up with national AI policy.
The UAE Charter for the Development and Use of AI
Twelve principles covering safety, algorithmic bias, privacy, transparency, human oversight, governance and accountability, and compliance with law. We map each system's controls (approval gates, logs, evaluation results) to them in the handover pack.
The Dubai AI Seal
Issued by the Dubai Centre for Artificial Intelligence to Dubai-licensed organizations that provide AI services, and recognized by Dubai government entities. It does not replace a business license.
Related pages
The solutions, blueprints and ERP guides this work connects to.
Arabic and English phone agents for answering, booking and service calls.
WhatsApp, chat and email answered from your own knowledge and systems.
Custom agents that read, decide within limits and act in your systems.
Models hosted in a region you choose when data cannot leave it.
AP and AR automation with approvals and an audit trail.
Billing documents, vendors and tax codes in SAP.
Sales and purchase documents in Business Central.
If you also invoice in Saudi Arabia, the FATOORA waves and rules.
Questions from UAE teams
Does the UAE PDPL apply to companies in the DIFC or ADGM?
Generally no. Federal Decree-Law No. 45 of 2021 excludes companies in free zones that have their own data protection laws. DIFC companies follow the DIFC Data Protection Law No. 5 of 2020, and ADGM companies follow the ADGM Data Protection Regulations 2021. A group with mainland and free-zone entities can be under more than one regime.
Can an AI system make automated decisions under the UAE PDPL?
Yes, with limits. Article 18 gives people the right to object to decisions from automated processing, including profiling, that have legal consequences or seriously affect them, unless an exception such as a contract or prior consent applies. Even then, safeguards apply and the controller must provide human review of the decision when asked.
What does DIFC Regulation 10 require for AI chatbots and agents?
Regulation 10 covers personal data processed by autonomous and semi-autonomous systems. Users must get clear notice at first use, describing the purposes, outputs and safeguards. The system may only process for human-defined or human-approved purposes. High-risk processing needs Commissioner certification requirements and an Autonomous Systems Officer.
Can an AI voice agent make marketing calls in the UAE?
Only within the telemarketing rules in Cabinet Resolution No. 56 of 2024. Marketing calls need prior approval from the licensing authority, must be made between 9:00 and 18:00 from local numbers registered to the company's trade license, and must never go to numbers on the Do Not Call Register. We build those rules into the call logic.
Do you build AI agents in Arabic?
Yes, for voice and chat, in Arabic, English or both in the same conversation. Quality varies by dialect and model, so we test on your own call and chat samples before launch and report accuracy per dialect. If a dialect is not good enough, we route those conversations to a person.
How much does AI development cost in Dubai?
It depends on the workflow, the systems involved and the languages. We start with a fixed-fee workflow audit of one to two weeks, which ends with a fixed price for the build. Running costs such as model usage and telephony are estimated in the same report, so you see the total before you commit.
Official sources
Checked on 15 October 2026. Rules and dates change, so confirm the current text with the publisher or your adviser before you act on it.
- [1]Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
UAE Legislation (uaelegislation.gov.ae)
Scope and exclusions (Article 2), automated processing (Article 18), DPIAs (Article 21), transfers (Articles 22 and 23), executive regulations (Article 28) and the 2 January 2022 start.
- [2]Data protection laws
The UAE Government portal (u.ae), updated 4 December 2025
The PDPL, the UAE Data Office as federal data regulator, and DIFC Law No. 5 of 2020.
- [3]DIFC Data Protection Regulations (consolidated), including Regulation 10
Dubai International Financial Centre (difc.com), in force 1 September 2023
Notice at first use, human-defined purposes, high-risk processing, the Autonomous Systems Officer, and deployer and operator roles.
- [4]Regulation 10: processing personal data through autonomous and semi-autonomous systems
DIFC Commissioner of Data Protection
Regulation 10 in force from 1 September 2023, and its certification framework.
- [5]ADGM Data Protection Regulations 2021
Abu Dhabi Global Market, Office of Data Protection
The ADGM regime, its territorial scope and the Office of Data Protection.
- [6]
- [7]Consumer protection
The UAE Government portal (u.ae)
Cabinet Resolution No. 56 of 2024 on telemarketing and No. 57 of 2024 on penalties.
- [8]Ministry of Economy and TDRA announce new resolutions regulating telemarketing
Emirates News Agency (WAM), 9 June 2024
Scope including social media marketing messages, prior approval, the 9:00 to 18:00 window, local registered numbers and the Do Not Call Register.
- [9]FAQs (marketing SMS)
Telecommunications and Digital Government Regulatory Authority (tdra.gov.ae)
Prior consent for marketing SMS and the 7:00 to 21:00 sending window.
- [10]The UAE Charter for the Development and Use of Artificial Intelligence
The UAE Government portal (u.ae), updated 3 July 2026
The charter's twelve principles.
- [11]Dubai AI Seal application
Dubai Centre for Artificial Intelligence (dub.ai)
What the seal is, who can apply, and its recognition by Dubai government entities.
- [12]eInvoicing in the UAE
UAE Ministry of Finance (mof.gov.ae)
The e-invoicing program and its decisions, summarized in our UAE e-invoicing guide.
Tell us which UAE workflow you want to hand over.
A 30-minute call with an engineer. Tell us where you are licensed and which channels your customers use; we will tell you which rules apply and what a system could do.
What happens next
- 1
Strategy call
We learn how the workflow runs today and what a good outcome would be.
- 2
Workflow audit
We map the process and measure where a system would save the most time.
- 3
Proposal
A written scope, timeline and fixed price for your first system. No obligation to build.