AI development in Abu Dhabi, built to be reviewed.

Institutional buyers here are rarely asking whether a model is capable. They are asking which components see personal or commercial data, whether that data leaves a boundary they are accountable for, how long anything is retained, and what the audit trail looks like when someone asks a year later. Those answers change the architecture, which is why they belong at the start rather than in a security review that arrives after the build.

In practice that means designing to the minimum data the task needs, keeping identifiers out of prompts wherever the job does not require them, using provider configurations with retention and training switched off, and — where the requirement genuinely calls for it — running the model on infrastructure inside the organisation's own control. Every one of those has a cost and a trade-off, and they are stated plainly rather than assumed.

Enterprise and government-adjacent programmes outlast the team that started them. The relevant question is not how the system performs in month one but whether it can be operated, extended and audited in year three by staff who were not in the room. That makes documentation, source-code ownership and a model layer that can be replaced part of the specification rather than a nicety at handover.

It also makes Arabic non-negotiable in a way it is not everywhere. Correspondence, official documentation and a meaningful share of internal communication run in Arabic, so a system that answers well in English and approximately in Arabic has failed the requirement, not merely underperformed. Both languages are tested against genuine institutional phrasing before anything is accepted.