AI Regulations in RAK ICC: Complete Guide
Where the training data came from is the question acquirers now ask first.
RAK ICC is a corporate registry, and the guide starts with what separating it from a licensed UAE operation decides: which entity signs the customer contract, employs the developers, owns the model and training data, and is exposed when something goes wrong. It then covers the assignment chain a holding company needs before it can claim to own its code and weights, why registering offshore does not move the data protection analysis, the registers and resolutions investors ask to see, and the tax, contract and arbitration points to settle rather than assume.
Reviewed by Mohamed Noureldin, Founder, Managing Partner & Senior Legal Consultant
What a RAK ICC company can and cannot do with AI
RAK International Corporate Centre is a corporate registry. Founders of AI businesses use it for holding structures, for owning intellectual property across a group, and for contracting with customers outside the UAE. If the plan is to sell an AI product to UAE customers from a UAE office, that operation needs to be licensed by the relevant licensing authority in the emirate concerned, and the RAK ICC entity sits above it rather than in place of it.
Get that split clear at the outset, because everything else follows from it: which entity signs the customer contract, which entity employs the developers, which entity owns the model and the training data, and which entity is exposed if something goes wrong.
Owning the intellectual property properly
An AI company's value is in its code, its weights, its data and its documentation, and holding structures only work if the ownership chain is written down. The failure is almost always the same. Contractors write core components under a loose engagement letter with no assignment. A founder builds a prototype before incorporation and never transfers it. A developer in an operating subsidiary writes improvements that stay with the subsidiary while the group assumes they belong to the holding company.
Fix the chain with documents rather than assumptions:
- Written assignments from every founder, employee and contractor who has touched the codebase, executed and dated.
- An intra-group licence or assignment recording what the holding company owns and on what terms the operating entity uses it, priced on terms you could explain to a tax authority.
- A record of open-source components and the licences attached to them, because obligations that travel with distributed code are found in due diligence and stop transactions.
- A record of where training data came from and on what permission, which is the question acquirers now ask first.
Data protection follows the data, not the registry
Registering a company offshore does not move the analysis. DIFC and ADGM apply their own data regimes, which matters to groups that also hold a free zone entity.
For an AI business the practical work is knowing what sits in each dataset. Training corpora assembled quickly from customer material, support transcripts and scraped sources are exactly where personal data appears without anyone deciding it should. Audit the datasets, record what is in them and on what basis, and decide before launch how you would answer a request from a person asking what you hold about them.
Corporate records the registry expects
The registry expects accurate information about ownership and control. Keep the following current rather than assembling it under pressure when a bank or an investor asks:
- Registers of shareholders and directors that match what the registry holds.
- Beneficial ownership information, updated when it changes.
- Signed resolutions for share issues and transfers, director changes, and any security granted over shares or intellectual property.
- Accounting records supporting the group's financial statements.
- The intra-group agreements that explain why value sits where it sits.
Thin records fail at the worst moment. Investor due diligence on an AI company concentrates on ownership of the technology and on the data behind it, and a holding company that cannot evidence either is discounted or dropped.
Tax questions to settle rather than assume
Corporate tax under Federal Decree-Law No. 47 of 2022 applies for financial years starting on or after 1 June 2023, at 0% on the portion of taxable income not exceeding the amount specified in a decision issued by the Cabinet, and 9% above that. VAT is 5% under Federal Decree-Law No. 8 of 2017, as amended by Federal Decree-Law No. 18 of 2022 and Federal Decree-Law No. 16 of 2024. A juridical person that is incorporated or otherwise established or recognised under the applicable legislation of the State is a Resident Person. What a particular registered entity's obligations are is an assessment to obtain for that entity. Statements that an offshore registration puts a company outside the regime are not a substitute for that assessment.
Customer contracts signed by the offshore entity
If the RAK ICC company is the contracting party for international customers, its contracts carry the risk of the AI product. Whichever law you choose, deal with the points AI arguments actually turn on: what the system is warranted to do and what it is not, who owns outputs, whether customer data may be used to improve the model, what happens when the underlying model is changed by a third-party supplier, and what limits on liability apply. Caps are worth having, and a cure period before termination keeps a fixable problem fixable.
Choosing where arguments are heard
Federal Law No. 6 of 2018, amended in 2023, governs arbitration seated in the UAE, unless the parties agree on the application of another arbitration law. The arbitrateAD Arbitration Rules came into force on 1 February 2024 and apply, subject to exceptions, where parties have agreed to arbitration under the ADCCAC Rules. Consistency across the stack matters as much as the choice itself: when the holding company, the operating company and the customer contracts point to different forums, the first phase of any technology dispute resolution is spent arguing about where to argue.
A short sequence
- Decide which entity does what, and license the entity that operates in the UAE.
- Complete the intellectual property chain in writing, from founders and contractors upward.
- Audit training data for personal data and record its source and permission.
- Keep registry information and resolutions current through the registered agent.
- Obtain a tax assessment for each entity rather than relying on a general claim.
- Align warranties, data use and dispute clauses across group and customer contracts.
For advice on structuring an AI business through RAK ICC, or on cleaning up an ownership chain before a funding round, contact the Nour Attorneys team.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.
Nour Attorneys Team
Related Resources
Explore more of our insights on related topics:
- AI Regulations Compliance Requirements in the UAE
- Blockchain Legal Defense Strategies for Dubai Businesses
- Cryptocurrency Compliance Guidelines for UAE Operators
- Data Privacy Laws for Multinational Entities
