Where the model is allowed to see the data.
NESA, DESC, and PDPL are three different instruments. A one-page PDF maps twelve checks onto them. We deploy the system inside the boundary. We do not certify you.
Get the one-page PDF
NESA
Buyers still say NESA. The instrument is the UAE Information Assurance Regulation, version 1.1, March 2020. The TRA designates the critical entities that must implement it. The checks are assets, third parties, access, and logs. It is not a personal-data law.
DESC
Dubai only. Law No. 15 of 2024. It binds Dubai government entities, and non-government entities DESC classifies as critical. In-scope data stays on infrastructure those rules allow. A private company DESC has not classified is not this column.
PDPL
Federal Decree-Law No. 45 of 2021, in force 2 January 2022. Personal data, including automated processing. Government entities, health data, banking and credit data, and free zones with their own data law are outside it. A prompt sent to a model abroad is a cross-border transfer.
What is in the PDF
Twelve checks. One page. Four for the national IA controls, four for DESC, four for the PDPL. Three are below. The other nine are in the PDF. Counsel decides whether you are in scope. The check is what has to be true of the system.
NESA
A risk treatment exists for the AI path: what may leave, what stays, and who accepted the residual risk.
DESC
Prompts, documents, and outputs for an in-scope entity stay on infrastructure DESC's rules allow: their own facility, a certified data centre, or a certified cloud.
PDPL
Personal data does not leave the UAE unless a transfer case in the decree is named in writing. A US region is a transfer.
The founder's prior operating work, 2011–2024, is $20M+ in documented cost reductions across ESW Capital, Exness, Deutsche Bank, and Pepperstone. That is not an AIPIVT client result. There is no AIPIVT client listed against these three instruments.
Email me the checklist
One page, PDF, free. The link is on the next screen and in your inbox. One email. We do not start a sequence from this form.
The checklist is ready.
Download the PDF. The same link is on its way to your inbox. A 30-minute scoping call is optional — reply to that email if you want one.
We already have a US region in the UAE.
A region label is not the boundary. The question is where the prompt, the document, the output, and the log are processed, and who operates that system.
We need a certificate before we build.
This PDF is not a certificate. DESC certification, a filing with the UAE Data Office, and a legal opinion are not deliverables. The deliverable is a system inside a boundary your review can inspect.
Our counsel has not said which law applies.
Then the pillar is "not yet named." The call is used to separate national IA controls, a Dubai critical-entity rule, and personal data. We do not guess the statute for you.
Common questions
Yes. One page, PDF. The form puts the link on the next screen and sends it to your inbox. One email. We do not start a sequence from this form.
No. We deploy the model and the workflow inside a boundary you control, with access control and logs your review can read. Your counsel decides scope. We do not issue a certificate and we do not file with a regulator.
Often no, on the PDPL column. The decree excludes government entities, health data with its own law, banking and credit data with its own law, and free zones that have their own personal-data law. DESC can still apply to a Dubai government entity or a critical entity DESC has named. The national IA controls apply to entities the TRA designates. Bring the exception to the call.
Access to the process, the system of record, or the repo — whichever holds the data the model would see. Without that, there is no boundary and no engagement. The work is a fixed milestone. The founder is in it.