The DIFC’s AI licence is one of the cheaper ways for an AI founder to put a company in Dubai, inside a common law jurisdiction with its own courts and its own data protection law. It answers where the company sits. It does not answer how the product is built, where its data lives, or what you will have to prove to the first serious customer. Those decisions arrive in the first ninety days whether anyone makes them or not.
This is not a guide to forming the company; the DIFC and a corporate services provider cover that. It is the list of technical decisions the licence leaves open, in roughly the order they start to cost money.
What the licence gives you
The DIFC’s own page describes it as a subsidised commercial licence, at USD 1,500 a year, with access to coworking space, discounted visas, a subscription to the Ignyte platform and membership of the Dubai AI Campus. BSA’s guide for founders adds the practical detail: the licence is not issued until a DIFC lease is in place, the activities are unregulated ones such as software house, technology research and development and AI research and consultancy, several can be selected, and the firm estimates five to six weeks from initial approval to the licence.
The same guide notes two things founders tend to miss. The lease, not the licence fee, is the largest recurring cost in year one. And the DIFC’s data protection regime applies from the start, with an initial filing and an annual confirmation after that. Campus membership can bring cloud credits and hardware options, which is useful and also the first technical decision in disguise.
What it leaves to you
None of the benefits make a technology decision for you. The licence does not choose a cloud region, a model provider or an architecture. It does not tell you whether your product is processing personal data in a way the DIFC’s rules treat as high risk. It does not make your product acceptable to a hospital, a bank or a government buyer. Those are the decisions a fractional CTO is actually paid for, and they are cheapest before the first customer, not after. Nor does the licence give you anyone to ask. The campus has programmes and partners, and they help, but nobody in them is accountable for your architecture.
Decision one: whose data, under which rules
Your company’s own processing of personal data is governed by the DIFC Data Protection Law, DIFC Law No. 5 of 2020, not the federal law that applies on the mainland. The filing BSA mentions is a notification to the Commissioner describing your processing, its purposes and where data will go, and it has to be kept up to date as the product changes. Treat it as a description you will be held to. If it says client data stays in one region and the logs quietly go to another, the inconsistency is the finding.
If the product uses AI on personal data, Regulation 10 applies as well. The Commissioner’s guidance on Regulation 10 expects a notice at first use, purposes defined by humans that the system cannot change, and evidence on request. Build those into the first version. Adding a register and a notice to a product that already has paying users means a release nobody budgeted for.
Decision two: where the product actually runs
A DIFC address is not a data centre. Cloud credits from the campus programme come with a provider and a set of regions, and the convenient default may not be the one your customers need. Data leaving the DIFC needs an adequate destination or appropriate safeguards, and your customers bring their own rules. A Dubai hospital has to keep health data in the UAE; a regulated financial firm will ask where every copy of its data sits.
So map the path before you accept the credits: the region of the application, the database, the backups, the logs, and the model provider. If any one of them is outside the country, know why and be able to say so. The legal reason and the speed reason for hosting in the UAE are separate questions, and the licence answers neither. Credits also expire. A product designed around one provider’s free allowance can meet a bill and a migration in the same quarter, so price the second year before accepting the first.
A worked example. A three-person team building a contract-review assistant for Dubai law firms accepts credits and deploys in the provider’s default region abroad, with logs flowing to a monitoring tool in another country. Six months later the first firm’s security review asks where client documents are processed. The honest answer is three regions, none of them chosen on purpose. Moving the application takes a week; moving the logs, the search index and the backups, re-testing, and rewriting the data protection notification takes most of a quarter. Choosing a UAE region on day one would have cost an afternoon.
Decision three: what you are licensed to sell
The activities on the licence matter later than founders expect. A buyer’s procurement system classifies suppliers by licensed activity, and the pilot that worked and then went quiet is often a company whose licence does not match the category the buyer purchases under. Choose activities for what you will sell in year two, not only what you are building this month; since several can be selected, there is little reason to choose narrowly. If you are unsure which category a large buyer purchases under, ask a prospective customer’s procurement team; they will usually say.
The licence is also explicitly for unregulated activity. If the product starts to look like payments, advice or brokerage, it needs authorisation from the Dubai Financial Services Authority, a separate process. That changes the architecture as well as the paperwork, because regulated firms carry audit, record keeping and outsourcing obligations that shape how the system is built.
Decision four: accounts in the company’s name
The weeks between in-principle approval and the licence are when founders open the cloud account, the model provider account and the code repository, usually on a personal card and a personal email. Move them into the entity as soon as it exists. An investor’s due diligence, a customer’s security review and the DIFC data protection filing all assume the company controls its own systems. That covers the domain, the DNS, the app store accounts and the model provider keys too, each with at least two people from the company able to sign in. A practical check before the licence is issued: list every account the product depends on, the email it was opened with, the card that pays for it, and who can sign in. Any line that names a person rather than the company is a task for the first week.
Decision five: build, buy, and the first hire
The cheapest DIFC structure invites the cheapest technical structure: one freelance developer, a model provider’s default settings, no written architecture. That is fine for a demonstration and expensive the day a customer sends a questionnaire. Decide early what you build, what you buy, and what the first technical hire owns. Write down why each choice was made, so the person after you does not undo it, and so a buyer’s technical due diligence finds answers instead of guesses. A simple test: if the developer left tomorrow, could someone else deploy the product from what is written down? If not, that is the first thing to fix.
Frequently asked questions
Does the AI licence let us process personal data freely?
No. It is a commercial licence. Personal data processing is governed by the DIFC Data Protection Law and its regulations, including Regulation 10 where AI is involved, and starts with a notification to the Commissioner.
Do we have to host our product in the DIFC or the UAE?
The licence does not say so. Your data protection obligations and your customers’ sector rules decide it. Health data from UAE services, for example, has to stay in the country unless an exemption applies.
Is USD 1,500 the whole cost of the first year?
No. That is the subsidised licence fee DIFC states. The lease, registration charges, visas and the data protection filing come on top, and the lease is usually the largest of them.
Can we build a fintech product on this licence?
You can build software, but regulated financial activity needs separate authorisation from the Dubai Financial Services Authority. Find out which side of that line the product sits on before the architecture is fixed.
When should a founder bring in technical help?
Before accepting cloud credits and before the first customer contract, because both fix decisions that are expensive to reverse. A few days of review at that point costs far less than a rebuild.
The first ninety days, in order
Choose licence activities for what you will sell, not only what you build. File the data protection notification with an honest description of the product. Map where every part of it runs before accepting any credits. Put every account in the company’s name. Design the Regulation 10 notice and log into the first version if AI touches personal data. Write the architecture down in two pages. Then go through the list again before the first enterprise contract, because that is when every answer is tested.
Making those calls for a founder without a technical co-founder is the work of a fractional CTO, and Tothiq AI Services and Solutions builds the production version once those decisions are made. If you are setting up in the DIFC, get in touch here.