How to choose an AI automation agency in Dubai: 7 checks

To choose an AI automation agency in Dubai, run seven checks before you sign: who owns the code, prompts and data; whether they have production references you can call; whether they can draw your PDPL data flow; whether the price is itemised; what support looks like after launch; who writes the code; and how they will measure success

We are an AI automation agency in Dubai ourselves, so read this with that in mind. PHII Labs holds itself to the same seven checks, and the last section explains how to run them on us

What should you ask before signing?

Ask questions that force a specific answer: a name, a number, a document, a contract clause. A capable agency answers them in the first call or sends the evidence within a day. An agency that answers with adjectives ("robust", "scalable", "end-to-end") has given you the answer you needed

The questions below come from our side of the table. We have watched Dubai companies arrive after a first vendor delivered a demo that never reached production, or a system nobody could maintain once the freelancer left. Most of those failures were visible before the contract, if someone had asked

The 7-check checklist

Print this table and take it into the call. Each row is one check: the question to ask, what a good answer sounds like, and what should make you walk away

#	Check	Ask this	Good answer sounds like	Red flag sounds like
1	Ownership	"Who owns the code, prompts, workflows and data after launch?"	"You do. The contract assigns all of it; the repository lives in your GitHub from day one."	"It runs on our platform, you get a licence."
2	Production references	"Which system like this is live today, and can I speak to the client?"	A named live system, the metric it moved, and a reference contact.	A Loom video, a Figma prototype or a logo wall.
3	PDPL data flow	"Draw where our customer data goes, hop by hop."	A diagram with storage region, every subprocessor, retention and deletion path.	"We are fully compliant" with no diagram.
4	Pricing honesty	"Break the quote into build, run and support."	Separate lines for build, model/API usage, hosting, messaging fees and the retainer.	One number with "AI costs included".
5	Post-launch support	"What happens when the model changes or a template is rejected at 2am?"	A named retainer: monitoring, prompt and template maintenance, a response SLA.	"We hand over the code and documentation."
6	Who builds	"Who will write the code, and are they on this call?"	Named engineers you can meet, with their past work.	"Our team" with no names, or a delivery partner they will not name.
7	Measurement	"Which number will tell us this worked, and what is it today?"	A baseline measured before the build and the same metric tracked after.	"You will see efficiency gains."

The sections below explain why each check matters and how to verify the answer instead of trusting it

Check 1: Do you own the code, prompts and data?

You should own all three, in writing. With a custom build, the contract assigns source code, prompts, workflow definitions and data pipelines to you, and the repository sits in an account you control. SaaS tools never transfer ownership, which is fine for a commodity inbox but expensive when your whole lead process lives inside someone else's platform

Prompts deserve their own line in the contract. In an LLM system the prompts and evaluation sets are as much of the product as the code, and some agencies treat them as reusable internal IP. If the agency wants to keep a reusable library, ask for a perpetual licence to everything your system depends on. Then check the infrastructure: cloud accounts, the WhatsApp Business Account, API keys and domain should all be registered to your company, so leaving the agency means a handover rather than a rebuild

Check 2: Can they show production references, not demos?

A production reference is a system real users touch every day, with a number that changed because of it. A demo shows the happy path on clean data. Production shows what happens with a blurry Emirates ID scan, a Khaleeji voice note, or a Property Finder lead that arrives at 3am with a wrong phone number

Ask for the metric, the timeline and a contact. For comparison, these are the production numbers we point to. Our property management build for a property-management platform launched its MVP in 10 days, reached about 120 monthly users, and its AI handles around 60% of tenant chats. Our inventory CRM for ~8,000 off-plan units took status accuracy from about 60% to about 98% and cut the time to find free units from roughly two hours a day to about ten seconds. You should expect the same level of detail from anyone you shortlist, and the same willingness to be checked

On the a property-management platform build, roughly 60% of tenant chats resolve without a person stepping in.

The CRM question belongs here too. An agency that claims HubSpot, Salesforce, Zoho or Odoo integration should name the integrations it has shipped and the fields it wrote back. A logo strip on a website proves nothing about the write-back logic

Check 3: Can they map your PDPL data flow?

They should be able to draw it before they quote. The UAE's personal data law, Federal Decree-Law No. 45 of 2021, regulates how personal data is collected, processed, stored and transferred, including transfers outside the country. An AI system sends customer messages, documents and Emirates ID images through several services, and each of them is a hop the law cares about.

A competent answer covers four things for every hop:

1. Where the data is stored, and in which region
2. Which subprocessor sees it: the model provider, the WhatsApp BSP, the OCR service, the hosting company
3. How long it is kept and how it gets deleted when a customer asks
4. Which steps a human approves before anything goes out to a customer or into a filing

If the agency answers "we are PDPL compliant" without this map, they have not done the work. Compliance is a property of how data moves through your system, so it cannot be a badge on the vendor. Our PDPL-compliant AI CRM guide walks through a full data-flow map for a CRM and WhatsApp stack

Check 4: Is the pricing broken down honestly?

A complete quote separates the one-off build from the costs that recur every month. The build is the visible number. The recurring lines are model and API usage, hosting, WhatsApp per-message fees from Meta plus any BSP markup, and a maintenance retainer. In our experience the retainer alone tends to run 10 to 20% of the build cost per year, before usage

Ask for the quote in AED, line by line, and ask which lines scale with volume. A WhatsApp lead bot handling Bayut and Dubizzle enquiries costs more in its busiest month than in its quietest, and you should know the formula before launch. We published the ranges we see in what AI automation actually costs in Dubai, including the line items vendors tend to leave out

Also ask for the critical path. Small builds usually take 3 to 6 weeks, document pipelines 6 to 10, full operational systems 10 to 16. Third-party approvals such as WhatsApp templates, CRM API access or a developer's data feed often set the real date, and a single delivery date with no dependencies listed usually means nobody has looked at them yet

Check 5: What happens after launch?

You need a named support arrangement with a scope and a response time. AI systems drift in ways ordinary software does not. Model providers deprecate versions, Meta rejects a template, a portal changes its lead email format, and accuracy on a document type slips after a developer redesigns its SPA layout

Good support terms list what is monitored, who gets alerted, how fast they respond, and what is included: prompt updates, template resubmissions, model migrations, small workflow changes. "We hand over the code and the docs" is fine for a static website and a red flag for anything that talks to your customers. Ask the agency to show you a monitoring dashboard or an incident log from a live client, with names redacted

Check 6: Who actually builds it?

The engineers who will write your system should have names, and you should meet at least one of them before signing. Many agencies sell with a senior team and deliver through subcontractors. Disclosed subcontracting can work; when it is hidden, the person who understands your Ejari edge cases leaves the day the subcontract ends and nobody told you they existed

Ask three things: who writes the code, who reviews it, and who answers the phone in month four. If the answers are the same people, you have continuity. If the agency will not name a delivery partner, assume your data is going to someone you have not vetted, which brings you back to check 3

Check 7: How will they measure success?

They should name one metric, measure its baseline before the build, and report the same metric afterwards. "Time from Property Finder enquiry to first agent reply", "hours per week spent re-keying SPA data" or "percentage of chats resolved without a human" are all measurable. "Better customer experience" is not

The baseline is the part most projects skip. Without it, nobody can prove the system paid for itself, and the renewal conversation turns into opinions. Ask the agency to write the metric and the measurement method into the statement of work. Our inventory CRM figures above exist because somebody counted stale statuses and search time before the first line of code

What does a red flag look like in practice?

One red flag is a question to dig into. Two or more on the checklist usually predict the outcome. The patterns we see most often in Dubai:

• The proposal arrives within hours of the first call, with a fixed price and no questions about your data, your CRM or your volumes
• The "case studies" describe what the system does and never what it changed
• The agency recommends a general-purpose chatbot for WhatsApp. Meta's WhatsApp Business policy restricts general-purpose AI assistants on the Business Platform, so a vendor who suggests one has not read the rules your number depends on.
• Everything is "AI-powered", including steps a simple rule would handle more cheaply and more reliably
• Nobody asks who on your side will approve the bot's replies or the documents it extracts

Agency vs freelancer vs in-house: which fits a UAE SME?

For a single, well-defined workflow, a strong freelancer is usually the cheapest option that works. For systems that touch customer data, revenue and several tools at once, an agency with named engineers and references carries less risk. In-house makes sense once AI systems are core to your product and you can keep two or more engineers busy full time

Option	Fits when	Main risk	What to check
Freelancer	One workflow, clear scope, low data sensitivity	Single point of failure; support ends when they move on	Checks 1, 5 and 6 especially
Agency	Multi-tool systems, customer data, revenue-critical flows	Paying for overhead, or a sales team that never meets delivery	All seven checks
In-house hire	AI is core to the product, steady roadmap	Hiring time and cost in Dubai; one hire rarely covers ML, backend and integrations	Whether you have a year of work for them

Many SMEs end up with a hybrid: an agency builds and documents the first system, then an in-house engineer takes over maintenance with the agency on a smaller retainer. Ownership from check 1 is what makes that handover possible. You can see the services we offer around that model on our AI automation in Dubai page

The takeaway

The seven checks come down to one rule: ask for evidence, and treat adjectives as missing evidence. Ownership is a contract clause, references are live systems with numbers, PDPL competence is a diagram, and pricing is a list of AED lines

Run the checklist on us too. Our free automation audit gives you a process map, the automation candidates ranked by payback, a data-flow and PDPL review, and a fixed build quote, so you can compare our answers against everyone else's. Book the free audit