Sovereign AI · UAE
The model runs in the UAE. The prompt stays there.
For the team whose pilot stopped because the prompt would leave the country. We deploy the model and the workflow in a UAE facility you control, or with a UAE operator, and leave a data-flow map, an access model, and an audit log. Your counsel decides which instrument that satisfies.
Three instruments. You are probably under one.
NESA, DESC, and the PDPL are not a stack you collect. Each binds a different entity. Read the row that names you.
NESA
Buyers still say NESA. The instrument is the UAE Information Assurance Regulation, version 1.1, March 2020. The TRA designates the critical entities that must implement it. The model, the corpus, the prompts, and the logs are assets a review can name. It is not a personal-data law.
DESC
Dubai only. Law No. 15 of 2024. It binds Dubai government entities, and non-government entities DESC classifies as critical. In-scope data stays on infrastructure those rules allow. A private company DESC has not classified is not this card.
PDPL
Federal Decree-Law No. 45 of 2021, in force 2 January 2022. Personal data, including automated processing. Government entities, health data, banking and credit data, and free zones with their own data law are outside it. A prompt sent to a model abroad is a cross-border transfer.
A DIFC or ADGM firm with no onshore personal data is outside the PDPL card. A bank's credit data and a hospital's health data are outside it when their own statute applies. A ministry's data is government data. Dubai Law No. 15 of 2024 tells a government entity which electronic-security companies it may engage. This page is the AI system inside a boundary you already operate. We do not file with the UAE Data Office or with DESC. A buyer who wants a legal opinion, or a badge with no system in production, is outside the engagement. The work needs access to the workflow and the data boundary.
The boundary is the UAE
Same shape as Sovereign AI. The border is the UAE instead of the EU.
Where it runs.
An open-weights model on hardware you control in the UAE, or a UAE operator. A region label is not the boundary. The test is where the prompt, the document, the output, and the log are processed, and who operates that system.
What stays.
Prompts, documents, outputs, and logs of the in-scope data stay inside that boundary at inference. Air-gap is available when the site cannot connect. It is not the headline.
What we leave.
A data-flow map, an access model, an audit log, and a runbook your people can operate. Fixed milestone. The founder is in the engagement. You own it after.
What the review can read
| What | What it is for |
|---|---|
| UAE-boundary inference | The prompt is not a cross-border transfer at inference time |
| Retrieval over your document store | The corpus stays in the same boundary as the model |
| Access control and an audit log | A review can see who called the model, and with what |
| Keys and weights on your side | Operational control sits with you |
| Outbound call | In-scope data does not ride along. If a call must leave, the personal data is removed first and the reason is written down. This is a control on your system. It is not a separate product. |
Common questions
No. NESA on this page means the UAE Information Assurance Regulation v1.1, March 2020, for entities the TRA designates. DESC means Dubai Law No. 15 of 2024, for Dubai government entities and critical entities DESC classifies. The PDPL means Federal Decree-Law No. 45 of 2021, for personal data that is actually in its scope. We deploy the system and leave the evidence. Your auditor, DESC, or the UAE Data Office decides. We do not issue a certificate.
Often one. The national IA controls apply to entities the TRA designates. DESC applies in Dubai, to government entities and to non-government entities DESC has classified. The PDPL applies to personal data processed by electronic means, and it excludes government entities, health data with its own law, banking and credit data with its own law, and free zones that have their own personal-data law. Bring the entity type to the scoping call.
A region operated outside your control is not the boundary this engagement sells. The test is who can read the prompt, who holds the keys, and where the log is written.
No. Those free zones have their own personal-data laws, and the federal PDPL excludes establishments there that have such a law. Say that on the call if it is your only footprint.
You receive the running system, the data-flow map, the access model, the audit log, and the runbook. You still own the policy, the sign-off, and any filing. We do not file with the UAE Data Office or with DESC. The engagement is a fixed milestone, and the founder is in it. Without access to the workflow and the boundary, there is no engagement.
Tell us what must not leave the UAE.
Entity type, the data in the prompt, and whether a security review has already stopped a pilot. Thirty minutes. If the boundary is not the blocker, we will say so.