Quick answer: An AI automation agency in Dubai should move your project through seven stages: first call, discovery, a proof of concept on your own data, scope and contract, build, a controlled pilot, and launch with a handover. Each stage ends with a written result and a decision that’s yours. Dubai Municipality planned its AI permit agent over 26 weeks in three phases.
You have a workflow that eats hours every week: leads arriving on WhatsApp at midnight, invoices typed into the ERP by hand, the same twenty questions answered again and again. You have decided an agency should automate it. What happens next? This guide walks through a typical AI automation project in Dubai from the first call to launch: what each stage is for, what you should receive at the end of it, which decisions are yours, and the contract and data terms to settle before any build starts.
Key takeaways
- Every stage should end with a written deliverable and a go or no-go decision.
- A fixed build price given before anyone has seen your workflow and data is a guess.
- Prove the idea on your own data first, with pass marks agreed in advance for English, Arabic and Arabizi.
- Put the WhatsApp number, AI accounts, workflows and prompts in your company’s name, in writing.
- Launch is a controlled pilot plus a handover, with a person always within reach.
Sources: Microsoft AI Economy Institute, Global AI Diffusion Report Q2 2026, via Middle East AI News (25 September 2026) · PwC 29th Global CEO Survey, UAE findings, via Khaleej Times (12 February 2026) · Gartner prediction, 25 June 2025, via W.Media · Salesforce State of Service, UAE findings, via Khaleej Times (1 January 2026)
The seven stages at a glance
Agencies that sell AI automation name their stages differently, but a sound process has the same shape: learn the workflow, prove the idea cheaply, then build and launch in steps. Each stage ends with something you can read and a decision you make, so the money at risk grows only as the evidence does.
| Stage | What happens | What you receive | Your decision |
|---|---|---|---|
| First call | Goals, one workflow, the systems involved | A note on fit and next step | Is discovery worth doing? |
| Discovery and audit | Process mapping, volumes, data and access checks | Process map and a ranked first use case | Which workflow goes first? |
| Proof of concept | A narrow working version on your real data | Results against agreed pass marks | Build, change course or stop |
| Scope and contract | Fixed scope, acceptance tests, data and ownership terms | Statement of work and contract | Sign or renegotiate |
| Build and integrate | CRM, ERP and WhatsApp connections, guardrails | A working system in a test environment | Ready for real users? |
| Test and pilot | Limited live traffic, daily review | A pilot report against targets | Widen, fix or roll back |
| Launch and hypercare | Full rollout, monitoring, training, handover | Runbook, dashboard, documented ownership | Keep, extend or retire |
For scale, Dubai Municipality has announced an AI agent for building permit approvals in three phases across 26 weeks: development and testing, a live pilot with selected engineering consultancies, then full rollout. An SME workflow is far smaller, but the shape is the same.
Source: Zawya, Dubai to develop AI system to automate building permit approvals
Stage 1: the first call, and what to bring
The first call is about fit, not a pitch. A good agency asks more than it answers: what the workflow is, how often it runs, who does it today, which systems hold the data and what a good result looks like in six months. It should also say when a rule, a form or a cleaner process would beat AI. If the vocabulary is new, our plain-English guide to AI automation explains the terms.
Tick what you can answer today.
0 of 8
- We can name the one workflow we most want to automate
- We know roughly how many times a week it runs
- We know who does it today and how long it takes
- We know which systems hold the data: CRM, ERP, inbox or spreadsheets
- We have sample messages or documents with personal details removed
- We know which languages customers use, including Arabic and Arabizi
- One named person on our side will own the project
- We know what result would make the project worth paying for
Six or more: you’re ready for discovery. Three to five: discovery will collect the rest. Two or fewer: write the workflow and its volumes down first.
Stage 2: discovery and the workflow audit
Discovery should be a short, fixed piece of work with its own deliverables. It’s the stage buyers most want to skip, and the one where doomed projects get caught. Gartner predicted in February 2025 that 60 per cent of AI projects lacking AI-ready data will be abandoned by 2026; its July 2024 survey found 63 per cent of organisations lack confidence in their data management practices for AI.
Source: Gartner, Lack of AI-ready data puts AI projects at risk, 26 February 2025, via Freevacy
It’s the stage buyers most want to skip, and the one where doomed projects get caught.
A useful discovery covers four things:
- The process as it really runs, exceptions included, learned by watching the work.
- Volumes and time: cases a week, minutes per case and where they queue.
- Data and access: where records live, how clean they’re and whether each system has an API.
- Risk: steps that touch personal data, payments or legal decisions, and what stays with a person.
The output is a short report: a process map, the data findings and use cases ranked on value and ease rather than on what demos well, plus what shouldn’t be automated, and why.
Personal data shapes the scope from here on. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data has been in force since 2 January 2022. It prohibits processing personal data without the owner’s consent, with some exceptions, and sets requirements for cross-border transfers. DIFC companies fall under DIFC Law No. 5 of 2020 instead. This is general guidance, not legal advice.
Source: u.ae, The UAE Government portal: data protection laws
Stage 3: a proof of concept on your own data
A proof of concept is a narrow, working version of the automation, run on your real messages or documents rather than demo data. It answers one question: does this work well enough on our data to justify a build? Gartner predicted in July 2024 that at least 30 per cent of generative AI projects would be abandoned after proof of concept by the end of 2025, citing data quality, risk controls, cost and unclear business value.
Source: Gartner prediction, via Intelligent CIO Middle East (5 August 2024)
That isn’t a reason to skip the stage. A proof of concept that ends in a clear no is money well spent, because it’s the cheapest point in the whole project to stop.
Agree the pass marks before anyone builds:
- A test set of real past cases, names removed, in the languages and scripts your customers use.
- A target per case: the right answer, the right action or the right handover to a person.
- Separate scores for English, Arabic and Arabizi, so weak Arabic can’t hide in an average.
- Limits on cost per case and response time, and a list of things the system must never do.
If a vendor’s platform is part of the choice, our questions to ask an AI vendor before you sign double as a test script.
Stage 4: scope, contract and data terms
Only now does a fixed price make sense: both sides know the workflow, the data and what good looks like. The statement of work lists each integration, channel and language, the acceptance tests and what is out of scope.
| Contract term | What to ask for | Why it matters |
|---|---|---|
| Accounts in your name | WhatsApp number, Meta business portfolio, cloud and AI accounts | You can change agency without rebuilding |
| Workflows and prompts | Documented and stored where you control them | They are the system; without them you rent it |
| Data processing | Where data is stored and processed, retention, who reads chats | Personal data rules apply to every conversation |
| AI provider terms | Training on your data, and the processing region | Settles residency before go-live |
| Acceptance tests | The proof-of-concept pass marks | Defines “done” in numbers |
| Support after launch | Response times, who fixes what, how changes are priced | Models, APIs and prices keep changing |
Read the AI provider’s terms at contract time. OpenAI’s API documentation, for example, says API data isn’t used to train its models unless you opt in, keeps abuse-monitoring logs for up to 30 days by default, and lists the United Arab Emirates as a residency region with in-region processing, subject to additional approval.
Source: OpenAI API documentation, Your data (training, retention and data residency regions)
The UAE Charter for the Development and Use of Artificial Intelligence lists human oversight and transparency among its principles. In a contract that means two lines: the decisions that always go to a person, and a log of every action the system takes.
Source: u.ae, The UAE Charter for the Development and Use of Artificial Intelligence
How OXEDGE does this
We run AI automation projects in stages, with a document and a decision at the end of each one.
- A workflow audit from your real conversations, documents and systems, with a ranked first use case.
- A proof of concept on your own data, scored against pass marks in English, Arabic and Arabizi.
- Builds that connect your CRM, ERP and WhatsApp with least-privilege access and logged actions.
- A pilot, a runbook and a handover with every account and prompt in your company’s name.
Stages 5 and 6: build, integrate, test and pilot
The build is mostly integration. The model is one component; the rest connects it to your CRM, ERP, inbox, calendar or WhatsApp number, with the permissions it needs and no more. If those systems are messy, fix them first: a CRM or ERP system with clean records does more for an automation than any prompt.
If those systems are messy, fix them first: a CRM or ERP system with clean records does more for an automation than any prompt.
Security belongs in the build. OWASP’s 2025 Top 10 for large language model applications puts prompt injection first, both direct (a user’s input changes how the model behaves) and indirect (instructions hidden in websites or files the model reads). Its fixes include a constrained role, output checks and least-privilege access. In Salesforce research, 62 per cent of UAE service leaders said security concerns had delayed or limited their AI initiatives.
Sources: OWASP Top 10 for LLM Applications 2025, LLM01 Prompt Injection · Salesforce State of Service, UAE findings, via Khaleej Times
Before customers see it, the system re-runs the proof-of-concept test set plus cases for each integration and guardrail. Then comes the pilot: one branch, one channel or a share of traffic, with someone reviewing conversations daily. Widen only when results hold through a full business cycle, busy days included.
On WhatsApp, the platform paces you anyway. Meta caps how many unique users a business can message outside a customer service window in a rolling 24 hours: 250 for a new business portfolio, rising through 2,000, 10,000 and 100,000 to unlimited as quality and volume allow. Business verification is one step to a higher limit, so start it early.
Source: Meta for Developers, WhatsApp Business Platform messaging limits
Stage 7: launch, hypercare and handover
Launch widens the pilot, then comes hypercare: closer watching while real volume brings up cases the test set missed. Agree how long it lasts, who watches and how fast fixes ship.
Keep a person within reach. WhatsApp’s Business Messaging Policy, last updated on 23 September 2026, allows automation within the 24-hour window but requires prompt, clear and direct escalation paths, such as in-chat transfer to a human agent, a phone number or email. Running costs start now too: since 1 October 2026 Meta charges per message for WhatsApp service messages, at each market’s utility rate. Our guide to what AI automation costs in the UAE covers the other running lines.
Sources: WhatsApp Business Messaging Policy (last updated 23 September 2026) · Meta for Developers, non-template message pricing (charging from 1 October 2026)
The handover pack should include:
- A runbook: how to pause the automation, roll back a change and reach a named person at the agency.
- A dashboard of the pilot metrics, split by channel and language.
- Documentation of every workflow, prompt, integration and permission.
- Admin rights held by your team, not only by the agency, and a monthly review slot.
Ownership is the real test of a launch. A system nobody on your side can pause, change or explain isn’t finished, however well it performs in its first week.
Red flags to spot in an AI automation agency in Dubai
The process tells you more than the demo. Gartner said in June 2025 that only about 130 of the thousands of agentic AI vendors are real, calling the rest “agent washing”: existing products rebranded. Slow down if you see these:
Source: Gartner prediction, 25 June 2025, via W.Media (27 June 2025)
- A fixed build price before anyone has looked at your workflow or data.
- No proof of concept, or one run only on demo data.
- No written pass marks, so “done” means whatever the vendor says.
- Your WhatsApp number, AI accounts or workflows in the agency’s name.
- No Arabic in the test set, and no human handover.
- Guaranteed savings before discovery has started.
Look at an agency’s published work, then ask who would run your project and what their last handover pack contained.
Questions UAE buyers ask
How long does a project take from first call to launch?
It depends on the workflows, channels and systems involved: an agent acting across a CRM, an ERP and WhatsApp takes longer than one workflow on one channel. Ask for a timeline after discovery, not before.
Can we start on a platform and go custom later?
Yes, if workflows, prompts and data can be exported and the accounts are yours. Check export options before you choose a platform.
Who owns the automation after launch?
Whoever the contract says. Ask for every account, workflow and prompt in your company’s name, documented, with admin rights on your side.
Can our data stay in the UAE?
Often, depending on the provider; OpenAI, for example, offers a UAE region subject to approval. Check every tool in the chain, including the automation platform and CRM.
Work with OXEDGE
Book a 30-minute fit call for the CRM, ERP or software behind your automation.
We look at the workflow you want to automate and the systems it runs on, and tell you whether they’re ready for AI or need work first. You leave knowing the likely first use case.
