The short answer
Before a UAE business runs AI on confidential data, it should be able to answer 24 questions in six areas: data, location and law, architecture, access and security, people and process, and upkeep. Most of them are answered on paper, before any server is bought. Use the list with your IT team, your legal adviser and any provider you are comparing.
Download the checklist
The same 24 questions as a two-page PDF you can print, share with your IT team or attach to a tender: UAE private AI checklist (PDF). You are welcome to share it or quote it; a link back to this page is appreciated.
Data
- 01
Which data will the AI read?
List every system and folder it will connect to: client files, contracts, email, ERP records. Anything not on the list stays disconnected.
- 02
Which of it is personal, confidential or regulated?
Personal data, client-privileged files, health records and financial data each carry different rules. Mark each source.
- 03
Who owns each data source?
Every source needs a named owner inside the company who approves what the AI may read.
- 04
What must never be used?
Write the exclusions down, for example HR disciplinary files or board papers, and make sure they are never indexed.
Location and law
- 01
Which data law applies to us?
UAE mainland: Federal Decree-Law No. 45 of 2021. DIFC: DIFC Law No. 5 of 2020. ADGM: ADGM Data Protection Regulations. Health data: Federal Law No. 2 of 2019. Your legal adviser confirms which.
- 02
Where will prompts, files, answers and logs be stored?
Get it in writing: your own servers, a UAE data centre, or a named cloud region.
- 03
Does anything leave the UAE?
Check model calls, backups, monitoring tools and the provider's support access, not only the main database.
- 04
What do our client contracts allow?
Many client agreements restrict where client data may go. Read them before choosing where the AI runs.
Architecture
- 01
Is there a written solution architecture?
Where each service sits, how data flows in every situation, and which firewalls protect it. This comes before any server is bought.
- 02
Have the stakeholders seen it?
IT, legal and the business owner should agree the architecture before deployment starts, not after.
- 03
Which model, and why that one?
An open model hosted privately, or a commercial model in a private deployment. The reason should be the task and the data rules.
- 04
How big does the hardware really need to be?
A GPU is usually needed, but not the biggest one. Size it to the number of users and the workload, and test before buying more.
Access and security
- 01
Do answers follow existing permissions?
A person should only get answers from documents they could already open themselves.
- 02
Is every question and answer logged?
Who asked what, when, and which documents the answer came from.
- 03
How is the system protected?
Network isolation, firewalls, encryption in storage and in transit, and a separate account for the AI.
- 04
What happens when the AI is wrong?
Answers show their sources, and anything high-stakes is checked by a person before it is acted on.
People and process
- 01
Which job will it do first?
One process, measured before and after. Not "AI for everything" on day one.
- 02
Who reviews its output?
Name the person in the loop for each type of answer that matters.
- 03
Who is trained, and when?
The people who will use it, before launch, on their own work.
- 04
What does success look like after eight weeks?
Agree a measure in advance: hours saved, documents processed, questions answered.
Upkeep
- 01
Will it be tested on a small data set first?
A trial run on a limited set of real data before the full launch.
- 02
Who updates the model and the software?
A named owner and a schedule, including what happens when a newer model is released.
- 03
How are documents added and removed?
New files indexed on a schedule; deleted files removed from the AI as well.
- 04
Can we leave?
Code, configuration and data handed over, so another team could run it. No lock-in.
The order of work we follow
The questions above map onto eight stages. This is the order used on the private AI deployment for a UAE real estate business: up to 750 users, data for 5,000 clients, 8 to 10 weeks from start to launch.
| Stage | What happens | Checklist questions answered |
|---|---|---|
| 1. Draft the solution | The job, the users and the data are written down | Data 1 to 4; People 1 |
| 2. Solution architecture | Services, data flows and protection designed | Architecture 1, 3, 4 |
| 3. Stakeholder review | IT, legal and the business owner agree the design | Architecture 2; Location and law 1 to 4 |
| 4. Services | Each service deployed where the architecture says | Access 1, 2 |
| 5. Servers | Hardware sized to the real workload | Architecture 4 |
| 6. Security | Firewalls, encryption, accounts and logging | Access 2, 3 |
| 7. Test on a small data set | A limited trial on real data | Upkeep 1; Access 4 |
| 8. Launch | Training, measures agreed, owners named | People 2 to 4; Upkeep 2 to 4 |
What we would tell a UAE business
Do not start by buying a server. Start with the architecture: where each service sits, how the data flows and what protects it. Most of the questions on this list are answered on paper before any hardware is ordered, and that is what keeps a private AI project on time.
Where EnterpriseAI.ae fits
EnterpriseAI.ae plans and deploys private and on-premise AI for SMEs and mid-sized companies in the UAE, design first and hardware second, with the data kept on your servers or in a UAE data centre. Work is delivered from Dubai by a licensed company.
Private and on-premise AI · Private AI or public AI tools? · AI companies in the UAE compared · AI document processing companies