Private and On-Premise Enterprise AI in the UAE

In short

Most organisations that stall on AI do not stall on capability. They stall the first time legal asks where the prompt goes, and nobody can answer. Public AI services are a data-transfer decision before they are a technology decision, and for a government entity or a regulated business that decision is often already made.

A private deployment moves the model to the data instead of the data to the model. The hardware sits in your data centre or in a sovereign facility you have contracted; the model weights are yours to run; the audit trail is yours to inspect. What you give up is the frontier model's last increment of capability. What you get back is a system your compliance function can actually approve.

Why the pilot never reached production

The pattern repeats. A team proves value in a fortnight using a public API. The demo is convincing, budget appears, and the project moves toward production — where it meets information security for the first time. The questions are reasonable: which jurisdiction holds the data, who can subpoena it, is it used for training, what happens to a prompt containing a citizen's file. There are no good answers that satisfy a data-sovereignty requirement.

By then the pilot has shaped expectations around a model that cannot be deployed. The rebuild is not technical rework; it is starting the architecture conversation eighteen months late, after the organisation has already decided AI works.

The prompt is the leak

Reviews focus on stored documents, but the sensitive disclosure is usually the question itself — a prompt naming a case, a tender, or a person is a disclosure whether or not the answer is retained.

Retention promises are contractual, not architectural

A vendor commitment not to train on your data is a contract term. A private deployment is a network boundary. Compliance functions treat those differently, and they are right to.

Residency is not the same as sovereignty

A regional cloud region satisfies residency. It does not necessarily satisfy sovereignty, where the requirement is that no foreign entity can compel access. Establish which one you are actually being held to before choosing.

How a private deployment works

The architecture is unremarkable, which is the point. An open-weight model runs on GPU hardware inside your boundary. A retrieval layer indexes your documents so the model answers from your material rather than from memory. An application layer handles authentication, logging and the interfaces people actually use.

Nothing in that path makes an outbound call. The model does not learn from your traffic between deployments, which means answer quality is a function of the retrieval layer and the prompt design — not of a vendor's next release.

What sits where

A deployment has four layers, and the cost, the risk and the failure modes each sit in a different one. Treating it as a single product is how budgets go wrong.

Compute

GPU servers sized to the model and the number of concurrent users. This is the largest capital line and the one most often over-specified early.

Model

Open-weight models run under their own licences. Arabic capability varies sharply between them and should be evaluated on your material, not on a public benchmark.

Retrieval

Your documents, chunked, embedded and indexed, with permissions carried through so a user cannot retrieve what they could not open directly.

Application

Authentication, role-based access, conversation logging, and the integrations that put the assistant where people already work.

What it connects to

An assistant nobody can reach does not get used. Integration is usually the difference between a system that survives its first quarter and one that quietly stops being opened.

Document stores

SharePoint, network shares and document management systems, indexed on a schedule with permissions preserved.

Enterprise applications

ERP, case management and ticketing through their own APIs, so the assistant answers from live records rather than a stale copy.

Identity

Existing SSO and directory groups. Roles come from the directory; the AI system does not become a second place to manage access.

Where people already work

Intranet, Teams or a service desk. A new destination to visit is a new habit to build, and most organisations do not build it.

Security, hosting and governance

The governance questions are answerable in a private deployment in a way they are not in a public one — but only if they are designed in rather than added afterwards.

Hosting is a choice, not a given: in your own data centre, in a sovereign facility under contract, or in a dedicated tenancy. Each has a different answer to who can compel access, and that is the question to lead with.

Network boundary

No outbound inference calls. The boundary is architectural, which is what makes it auditable.

Access carried through

Retrieval respects source permissions. A user cannot reach a document through the assistant that they could not open directly.

Logging and retention

Prompts and answers retained for a period you set, queryable by an authorised role and recorded when queried.

Model change control

Upgrades are scheduled and tested against your evaluation set, so behaviour does not shift under a live service.

Key components

GPU compute

Sized from concurrent users and context length rather than headcount. Under-sizing shows up as queueing, not as failure, which makes it easy to miss in testing.

Model weights

Held and version-controlled by you. A model upgrade becomes a change you schedule rather than one that arrives unannounced.

Vector index

The retrieval store. Its refresh cadence decides how current the answers are, and that is a business decision, not a technical default.

Permission mirror

Document permissions reproduced in the index, so retrieval cannot become a way around access control.

Audit log

Every prompt, retrieval and answer recorded for the retention period you set — usually the difference between an approved system and a rejected one.

Arabic language layer

Tokenisation, retrieval and evaluation tested on Arabic material, not assumed from English performance.

Where this is used in the UAE and the GCC

Government case handling

Officers ask questions across policy, precedent and case files without any of it leaving the entity's network. The audit log shows who asked what, which is usually a statutory requirement rather than a nice-to-have.

Engineering document search

Specifications, drawings and correspondence across years of projects become answerable. The value is in the retrieval, not the eloquence.

Bilingual internal service desk

Staff ask in Arabic or English and get answers from the same corpus. This is where public models most often disappoint on Arabic, and where testing on your own material matters most.

Regulated review workflows

Contracts, submissions and compliance documents summarised and cross-checked inside the boundary, with the source passage cited so a human can verify the claim.

How a project runs

Establish the requirement
Residency or sovereignty — they are different obligations with different architectures. This determines the hosting decision and therefore most of the cost.
Pick one corpus and one audience
A narrow first scope makes the result unambiguous. A department that already knows its documents are hard to search is the right first user.
Build the evaluation set first
Fifty to a hundred real questions with known good answers, in both languages where relevant. Without this, model selection is a matter of opinion.
Size the hardware from the evaluation
Concurrency and context length drive the GPU requirement. Sizing before you know the workload is how organisations buy twice.
Run it against real work
An agreed period with the real audience and the real corpus, measured against the evaluation set rather than against enthusiasm.
Extend by corpus, not by feature
Coverage grows one document set at a time against the model proven in the pilot.

Public API, private cloud tenancy, or on-premise

	Public API	Dedicated tenancy	On-premise
Where inference happens	Vendor infrastructure	Vendor infrastructure, isolated	Your hardware
Who can compel access	Vendor's jurisdiction	Vendor's jurisdiction	Yours
Capital cost	None	None	Significant and up front
Running cost	Per token, scales with use	Committed capacity	Power, cooling, maintenance
Time to first value	Days	Weeks	Months
Model capability	Frontier	Frontier	Open-weight, close behind
Suits	Non-sensitive work	Residency requirements	Sovereignty requirements

Risks and common mistakes

Buying GPUs before the evaluation set exists

Hardware bought on a vendor's sizing guide rather than your measured workload is the most expensive mistake available in this category, and it is close to irreversible.

Treating Arabic as solved

Open-weight models vary widely on Arabic. A model that performs well in English may retrieve poorly against Arabic documents, and the gap only appears when tested on your own material.

Skipping the permission mirror

If retrieval ignores source permissions, the assistant becomes a way to read documents a user could not otherwise open. This is usually found in a security review, late.

Optimising the model instead of the retrieval

Most disappointing answers are retrieval failures, not model failures. Teams routinely spend on a larger model to fix a chunking problem.

No evaluation set, so no way to tell if it improved

Without a fixed set of questions with known answers, every change is judged on impressions and nobody can say whether last month's work helped.

What to check before you commit

Which obligation applies — data residency, or data sovereignty? They lead to different architectures.
Which corpus goes first, who owns it, and what state are its permissions in?
Does an evaluation set exist, in both languages, with agreed correct answers?
How is Arabic performance measured, and on whose documents?
Where does the hardware physically sit, and who can compel access to it?
How are document permissions carried into retrieval, and who verifies that?
How long are prompts and answers retained, and who may query them?
How are model upgrades scheduled, tested and rolled back?
What is the power, cooling and maintenance commitment over three years?
Who operates it after handover, and what happens when they leave?

Questions buyers ask

What does on-premise AI actually mean?

That inference runs on hardware your organisation controls, inside your network boundary. Prompts, retrieved documents and generated answers do not leave that boundary, and no outbound call is made to a model provider.

Is a private model worse than a public one?

On general reasoning, open-weight models trail the frontier — but by less than most buyers expect, and the gap narrows with each release. For document-grounded work, answer quality is usually decided by the retrieval layer rather than the model, which is why a well-built private system often outperforms a poorly-grounded public one on your own material.

How much GPU hardware is needed?

It follows from concurrent users and context length, not from headcount. This is why the evaluation set comes before the purchase order: sizing without a measured workload is guesswork, and over-specification is the most common and least recoverable error in these projects.

Does it handle Arabic properly?

Some models do and some do not, and the difference is large. Arabic capability has to be measured on your own documents with your own questions, because performance on published benchmarks does not transfer reliably to a specific corpus or dialect register.

Can it connect to SAP, Oracle or our document management system?

Yes, through their APIs. The integration work is usually in reproducing permissions correctly rather than in reading the data, and that is the part worth scoping carefully.

What happens to answer quality over time?

It does not drift on its own, because the model is not learning from your traffic. Quality changes when you change the retrieval layer, the corpus or the model version — all of which are changes you schedule and test.

Is this compliant with UAE regulations?

Compliance depends on your obligations, your sector and your own assessment — we do not claim it on your behalf. What a private deployment gives you is an architecture where the questions have answers: where data sits, who can reach it, and what is logged.

How long before it is useful?

A first corpus and audience typically takes a few months from requirement to live use, most of which is data preparation and permissions rather than model work. Anyone promising weeks is describing a public API deployment.

Private / On-Premise Enterprise AI

This page covers the decision. The document covers the build: reference architectures at three scales, the GPU sizing method with worked examples, the Arabic evaluation protocol, and the full deployment checklist in a form you can take into a procurement review.

Download the PDF Read it online النسخة العربية

Why Swedish Technology

Swedish Technology builds and supports private AI infrastructure from Abu Dhabi and Dubai, for organisations that have concluded a public API is not available to them. The work is engineering rather than resale: sizing, deployment, retrieval design, Arabic evaluation, integration and handover to your own team.

We are explicit about what we do not claim. We do not certify your compliance position, we do not publish customer names without permission, and we do not quote performance figures we have not measured on your material.

Start with one corpus and a set of real questions

Tell us which document set your people struggle to search and which obligation you are held to — residency or sovereignty. We will scope a first deployment against that, and tell you plainly if a private model is the wrong answer for it.

Book an AI infrastructure consultation Browse the Resource Centre