The vendor's demo went well. The proposal quotes an impressive uptime figure. Now the contract is in your inbox.
Before you sign that AI service level agreement, understand this: uptime alone does not protect a UAE business running an agent on WhatsApp for Arabic-speaking customers. Accuracy commitments, per-channel response times, and PDPL clauses do the real work. What follows is a procurement checklist for how UAE customers communicate and how UAE law applies.
Key Takeaways
- Uptime alone doesn't prove the agent works — A WhatsApp agent can hit a 99.5% uptime floor and still answer every question wrong; the contract needs separate accuracy and per-channel response-time thresholds, each with its own breach definition and remedy.
- Set accuracy thresholds per language, not blended — Arabic, English, and mixed-language or Arabizi inputs each need their own number, plus Gulf dialect and transliteration coverage, a named tester, sample size, and cadence. Reject any clause that carves Arabic out as an unsupported language.
- PDPL and telemarketing law both apply — Name the data controller, processor, and applicable regime, PDPL under Federal Decree-Law 45 of 2021 plus DIFC or ADGM where relevant, and assign telemarketing liability under Cabinet Resolutions 56 and 57 of 2024, which carry fines of AED 50,000, AED 75,000, and AED 150,000 for a first, second, and third Do Not Call Registry breach.
- Retainers prevent breaches, SLAs only pay after — An SLA triggers service credits after the fact. A maintenance retainer adds proactive monitoring, scheduled retraining, and escalation paths that catch model drift before it reaches customers.
- Lock down model-change notice and retraining costs — Require advance written notice before any model-version change, since a silent upgrade can shift your accuracy baseline, and assign who pays for retraining when drift pushes accuracy below the SLA floor.
Why Uptime Alone Cannot Protect You With an AI Agent
An AI agent can be available every minute of the day and still be wrong every time it answers. Uptime tells you the system responded. It says nothing about whether the response was correct, safe, or on-brand.
Traditional IT contracts measure whether a system is up. A modern AI service level agreement measures two obligations at once: is the agent responding, and is it responding correctly. Confuse those and you have signed a contract that pays out for the wrong problem.
Now add the UAE reality. Your customer messages on WhatsApp and expects a reply in minutes, not a dashboard reading high availability. A response-time commitment per channel matters more than a headline availability figure.
The OECD AI Policy Observatory tracks how different countries are regulating AI, which matters as soon as you operate in more than one market.
The Three Metrics Every AI SLA Must Define
Photo: AlphaTradeZone on Pexels
Uptime, response time, and accuracy each need their own threshold, breach definition, and remedy inside the contract. Conflating them lets a vendor offset a critical accuracy failure against a strong uptime record.
Uptime is the easiest to benchmark. Published cloud AI SLAs commonly cite a Monthly Uptime Percentage of at least 99.5 percent, with strict definitions of downtime versus degraded service. Treat that as a floor.
Accuracy needs task-specific numbers. Industry examples put a facial recognition system at at least 98 percent accuracy under standard conditions, and natural language systems at correctly interpreting at least 95 percent of customer queries with explicit provisions for dialects. Pick a number for your task and refuse "high accuracy" without a percentage attached.
Response time is where most templates fall apart. It must be defined per channel because a real-time WhatsApp agent has nothing in common with a batch document processor.
One is measured in seconds. The other in hours.
Each metric needs its own threshold and breach definition written into the contract, not folded into a single headline number.
| Metric | Example Threshold | What It Must Define |
|---|---|---|
| Uptime | At least 99.5% Monthly Uptime Percentage | Downtime vs degraded service |
| Accuracy | At least 95% for NLP query interpretation | Task-specific number, dialect provisions |
| Response Time (WhatsApp, voice) | Seconds | First-response target, not blended uptime figure |
| Response Time (email, CRM) | Minutes to hours | Separate remedy from real-time channels |
Accuracy Commitments When Your Customers Write in Arabic and English
Your customers write in Arabic, English, and code-switched Arabizi, often in the same message. An accuracy figure covering only English is contractually inadequate for the UAE market.
Write accuracy separately for Arabic, English, and mixed-language inputs. Cover Gulf dialect and transliteration where customers type Arabic in Latin script.
Specify who runs the accuracy test, on what sample size, at what cadence, and what a passing result looks like. Without those four answers, "accuracy" is a marketing word rather than an enforceable clause.
Watch for a "carve-out for unsupported languages" phrase. Read literally, it can strip Arabic from the measurement basis of a contract you signed to serve Arabic-speaking customers. Replace it with a listed set of supported languages that includes Arabic and Emirati dialect.
Response Time SLAs for WhatsApp, Voice, and Async Channels
WhatsApp is the primary customer channel in the UAE, and a WhatsApp agent lives or dies on latency measured in seconds. Your contract has to state which threshold applies to which channel. A single blended figure hides a slow channel behind a fast one.
Split the clause. Synchronous channels like WhatsApp and voice need a first-response time target in seconds. Asynchronous channels like email and CRM tickets are measured in minutes or hours, with separate remedies.
Voice agents add another dimension. The SLA should cover time to first audio response, not just whether the call connected. A call that connects and then sits in silence is a failure whatever the dashboard says.
Define "degraded service" for each channel type. An agent that responds with a five-second delay on every WhatsApp message is not meeting a real-time commitment, even at full uptime.
Verizon's annual Data Breach Investigations Report is the standard reference for how breaches actually begin.
UAE Regulatory Clauses That Must Appear in Every AI SLA
Photo: RDNE Stock project on Pexels
The AI agent processes personal data. That brings your contract inside the UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021), with the UAE Data Office set up under Federal Decree-Law 44 of 2021 as federal regulator.
The SLA must name the data controller, the data processor, retention periods, and deletion obligations. DIFC and ADGM entities layer additional regimes on top of PDPL, so name the applicable framework and state which regime governs in a conflict.
Cabinet Resolutions 56 and 57 of 2024 on telemarketing took effect on 27 August 2024. If the agent makes outbound calls or sends marketing messages, non-compliance fines reach AED 50,000 for a first Do Not Call Registry breach, AED 75,000 for a second, and AED 150,000 for a third.
Assign this liability explicitly to vendor or client. State where agent logs, conversation data, and training inputs live: onshore UAE, inside a DIFC or ADGM perimeter, or offshore.
Remedies and Escalation When the Agent Misses Its Targets
Service credits for uptime breaches are standard practice. Accuracy breaches are harder to claim because they require a pre-agreed measurement method and a minimum sample. Negotiate both before you sign.
Require human-in-the-loop escalation for any query the agent scores below its accuracy threshold. A hybrid workflow acknowledges that human judgment still owns nuanced decisions, and it stops a wrong answer from reaching a customer.
A well-drafted SLA classifies breaches by severity inside the contract itself. A WhatsApp agent going silent during business hours is critical.
A minor accuracy dip on a rare edge case is standard. Remedies should be proportionate to the class of failure. Support costs across a full year also depend on the choice between retainer and pay-per-incident support, covered in this breakdown of AI support pricing models.
What to Negotiate, and Why a Retainer Covers What an SLA Cannot
A standalone contract defines what happens after a breach. A maintenance retainer includes proactive monitoring, retraining, and escalation before a breach reaches commercial impact. Our overview of AI maintenance and support retainers walks through what a real retainer includes, and this piece explains what a monthly AI maintenance retainer actually covers.
Push for three specific things at signing. Ask for accuracy reports with raw data rather than a pass or fail verdict, so you can audit trends yourself.
Ask for written advance notice before any model-version change, because a silent upgrade can flip your accuracy baseline. Ask for explicit ownership of retraining costs when model drift pushes accuracy below the SLA floor.
Two clauses deserve equal scrutiny. Uptime clauses that exclude scheduled maintenance windows without a cap on how many hours per month that exclusion may absorb.
Accuracy SLAs with a language-limitations carve-out that removes Arabic inputs from measurement. Both are common, and both are rejectable.
The terms you negotiate feed straight into your second year of ownership. Our piece on the real cost of owning an AI agent across Year One and Year Two shows where SLA choices become budget lines.
Get an honest read before you sign
Book a free 30-minute consultation with Lenoo AI. You'll get a plain reading of which contract terms actually protect your business, which are standard vendor deflection, and whether the numbers you've been offered make sense.
Related reading
FAQ
What uptime percentage should I require in an AI agent SLA?
Treat 99.5 percent Monthly Uptime Percentage as a floor, since published cloud AI SLAs commonly quote that figure. Push for 99.9 percent on customer-facing channels like WhatsApp. Insist that the contract defines downtime and degraded service in writing.
How do I write an accuracy commitment covering Arabic and English inputs?
Write three separate thresholds: Arabic, English, and mixed-language or Arabizi inputs. Name the Gulf dialects your customers use, and specify who tests, on what sample size, and how often. Reject any clause that carves out "unsupported languages" without listing exactly what remains in scope.
Which UAE laws must be addressed in an AI service level agreement?
The UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021) governs personal data processed by the agent, with the UAE Data Office set up under Federal Decree-Law 44 of 2021 as federal regulator.
DIFC and ADGM entities layer additional regimes on top of PDPL. Cabinet Resolutions 56 and 57 of 2024 apply if the agent handles outbound marketing calls or messages.
Who is liable for telemarketing compliance breaches caused by an AI agent?
Liability defaults to whoever the SLA names, and if silent it usually falls on the licence holder. Non-compliance fines start at AED 50,000 for a first Do Not Call Registry breach, AED 75,000 for a second, and AED 150,000 for a third. Assign this explicitly.
What remedies should I include if the agent's accuracy drops below the threshold?
Combine service credits with a mandatory retraining commitment and human-in-the-loop escalation. Pre-agree the measurement method and sample size at signing, because after-the-fact disputes usually favour the vendor. Match the remedy to the class of failure.
What is the difference between an AI SLA and an AI maintenance retainer?
An SLA defines what happens after a breach, usually through service credits. A maintenance retainer includes proactive monitoring, scheduled retraining, and escalation paths that prevent breaches from reaching commercial impact. The two are complementary.
How do I set response time targets for a WhatsApp AI agent?
Set a first-response time target in seconds, not a blended figure. Cover both time to first acknowledgement and time to a substantive reply, since a "typing" indicator without a real answer is not a response. Define degraded service too, so a slow but technically live agent still counts as a breach.
