Arabic LLM hosting in UAE is a compliance decision before a technical one. This piece covers which UAE-origin models you can self-host, which hosting tier fits your risk profile, what the full stack costs in AED, and what latency users will feel.
Key Takeaways
- PDPL decides where your Arabic LLM can run — Federal Decree-Law No. 45 of 2021 governs personal data in the UAE, and DIFC or ADGM entities face additional layered consent and transfer obligations on top of it.
- Two UAE-origin models need no foreign API — Falcon-H1 Arabic (3B, 7B, 34B) from Abu Dhabi's TII and Jais (13B) from G42's Inception are open-weight, so you download the weights and run them on your own GPUs or a UAE-region cloud instance.
- Falcon-H1's 7B model beats every ~10B rival — It scores 71.47% on the OALL leaderboard, and starting there is usually more cost-efficient than jumping straight to the 34B model, which scores 75.36% but costs meaningfully more per request.
- Pick the hosting tier by data sensitivity — Managed API, UAE cloud, and on-premises trade data control against cost in different ways — the right choice hinges on PDPL exposure and latency needs, not which model tops a benchmark.
- The license is free, the stack isn't — Falcon-H1 and Jais cost nothing to license, but GPU compute, storage, inference-serving, fine-tuning and training the team who runs it are the real costs — UAE cloud pilots run AED 10,000-50,000, production AED 50,000-200,000.
Why Hosting Location Is a Compliance Decision First
Where your Arabic LLM runs decides who has jurisdiction over the prompts it sees. In the UAE, Federal Decree-Law No. 45 of 2021 (PDPL) governs personal data use, and compliance is mandatory regardless of which model provider you pick or where the vendor is headquartered.
Ship a customer's Emirates ID number, name, or contact detail into a prompt and PDPL applies from that moment.
Two additional layers apply inside the financial free zones. The DIFC Data Protection Law and the ADGM Data Protection Regulations sit on top of the federal PDPL, adding their own consent, transfer and breach-notification rules. DIFC or ADGM entities inherit both regimes.
Now consider what happens when an Arabic prompt hits a US-hosted API. The text, and anything personal in it, crosses borders and enters a jurisdiction outside UAE reach.
That is a cross-border transfer, and PDPL puts specific conditions on when it is allowed and how it must be documented. The safer default is to keep the data in-country and answer the compliance question before the infrastructure one.
Model choice and hosting choice are one decision made twice. See our companion piece on choosing between Jais, Falcon, GPT and Claude for Arabic business AI.
Arabic-language model research in the UAE is concentrated at MBZUAI in Abu Dhabi.
The Arabic Models You Can Actually Self-Host in UAE Today
Photo: panumas nikhomkhai on Pexels
Two UAE-origin open-weight families dominate, both runnable on UAE infrastructure with no foreign API.
Falcon-H1 Arabic, launched by Abu Dhabi's Technology Innovation Institute on 5 January 2026, comes in 3B, 7B and 34B parameter sizes. According to TII's own benchmarks, the 7B model scores 71.47% on the OALL leaderboard, surpassing all ~10B models.
The 34B model scores 75.36%, outperforming 70B+ systems including Qwen2.5 72B and Llama-3.3 70B. Three sizes let you match the model to the hardware you actually have.
Jais is a 13-billion parameter model open-sourced by G42's Inception in Abu Dhabi. Trained on 116 billion Arabic tokens and 279 billion English tokens, it's strong on both languages. Released under an open licence.
Both are open-weight. That is the operational point.
You download the weights, run them on your own GPUs or a UAE-region cloud instance, and no prompt ever leaves your infrastructure to reach a foreign endpoint. That is a very different compliance posture from calling a US API, no matter how good the API is.
One caution before picking by benchmark alone: OALL weights toward Modern Standard Arabic and general knowledge, not Gulf dialect or your domain. A 71.47% average says a model is competitive, not that it handles Emirati-dialect WhatsApp well. We go deeper in our piece on what Arabic AI benchmarks do and do not tell you.
Three Hosting Tiers for a UAE Business
There are three realistic paths. Each has a different compliance and cost profile.
Managed API in a UAE region
Falcon or Jais served through a UAE-region cloud endpoint. Lowest operational overhead, no GPU procurement, no ops team maintaining an inference server.
The trade-off is that the data still leaves your own servers and lands on the provider's, even if that provider is in-country. Before committing, run the specific test: does this satisfy PDPL for your data classes, and does it satisfy any DIFC or ADGM obligations that apply to your entity?
UAE cloud hosting
Rent GPU instances from a UAE-region provider (G42 and Khazna, Azure UAE North, or AWS Middle East UAE region), deploy the model yourself, and keep both the workload and the data in-country. This is the middle path.
You control the software stack and the data never crosses the border, but you pay for GPU time and someone on your team owns inference operations. Realistic project spend sits in the AED 10,000 to 50,000 band for a lighter pilot on a 3B or 7B model, and the AED 50,000 to 200,000 band for a production-grade deployment.
The gap between those bands is mostly GPU size, redundancy and the engineering work around them.
On-premises or private cloud
Bring the GPUs into your own data centre or a dedicated private-cloud tenancy. This is maximum data sovereignty and maximum capital cost.
It is the default choice for regulated sectors: banks, healthcare providers, and federal government entities where prompts routinely contain data that cannot leave the perimeter. If a compliance officer needs to prove the data never touched shared infrastructure, this is the only tier that answers that question cleanly.
There is also a case for skipping self-hosting and running a well-prompted global model against non-personal traffic. We cover that in when a global model with good prompting beats a regional one.
These three tiers trade data control against operational cost in different ways.
The architecture underneath all of these models was introduced in the 2017 transformer paper.
| Tier | Data location | Cost | Best for |
|---|---|---|---|
| Managed API (UAE region) | Leaves your servers, lands on provider's in-country endpoint | Lowest — no GPU procurement or ops team | Non-personal traffic, limited ops capacity |
| UAE cloud hosting | Stays in-country, on infrastructure you deploy and control | AED 10,000-50,000 pilot; AED 50,000-200,000 production | Middle path needing control without capex |
| On-premises / private cloud | Never leaves your own perimeter | Maximum capital cost | Regulated sectors: banks, healthcare, federal government |
Latency: What UAE Deployments Actually Experience
Photo: panumas nikhomkhai on Pexels
Latency in a self-hosted Arabic stack is driven by three things: model size, tokenisation, and network path.
Model size sets the floor. A 3B or 7B Falcon-H1 will return the first token faster than a 34B model on the same GPU.
That matters most for real-time channels. UAE customers reach out on WhatsApp and expect a reply in minutes, not the next business day, and the perceived speed of your assistant is set by first-token latency more than by total generation time. Starting at 7B and only moving up when quality actually demands it is the pragmatic path.
Arabic tokenisation is the quiet cost multiplier. Most base tokeniser vocabularies were built primarily around English, so an Arabic sentence often consumes more tokens per word than its English equivalent.
That inflates both inference latency and, if you are on a per-token API, your bill, before dialect complexity is even on the table. Budget for the overhead and measure it against your own traffic rather than trusting an English-only benchmark.
Network path is the last piece. UAE-hosted inference removes the round-trip to US or EU data centres, and the difference is consistent across every request size. For a chat product with a human waiting, that saved round-trip makes the assistant feel responsive.
Keep retrieval latency and generation latency separate. When grounding a model in your own documents, vector search has its own budget and optimisation levers. See Arabic embeddings and search: the layer everyone gets wrong.
What to Budget and Verify Before Deploying
Work through this list before you commit GPU spend.
Confirm whether personal data is in scope. If prompts include names, contact details, Emirates ID numbers, financial or health records or anything covered by PDPL, then Federal Decree-Law No. 45 of 2021 applies, and UAE data residency is safest. DIFC or ADGM entities face additional layered obligations.
Size the model to latency and budget, not prestige. The 7B Falcon-H1 scores 71.47% on OALL while outperforming all ~10B models, a strong start before spending GPU budget on 34B. Test against your own prompts, in your dialect.
Budget the full stack, not the licence. Falcon-H1 and Jais are open-weight and free to license. Real costs are GPU compute, storage, inference-serving, any fine-tuning, and training the team who runs it.
Plan for the operational tail. Whoever builds it keeps it running: monitoring, prompt updates, retraining as new versions release, and answering compliance questions.
For a second opinion on which tier fits your obligations, book a consultation with our team. We'll walk through your data classes, compliance surface and realistic AED cost.
FAQ
Does hosting inside UAE change PDPL requirements for my business?
Hosting in-country simplifies cross-border transfer questions but does not remove PDPL obligations. You still need lawful basis, appropriate consent, and the technical and organisational controls PDPL expects.
What's the practical difference between deploying Falcon-H1 and Jais?
Falcon-H1 gives three sizes (3B, 7B, 34B) so you can match model to hardware and latency budget. Jais is a single 13-billion-parameter model trained on 116 billion Arabic and 279 billion English tokens. Falcon-H1 is more flexible on infrastructure; Jais brings a strongly bilingual profile.
When does a managed API make more sense than self-hosting?
When traffic doesn't include personal data under PDPL, you lack ops capacity, and time to production matters more than absolute data sovereignty. Managed removes GPU procurement and operations burden.
How does 7B versus 34B affect inference latency and GPU cost?
A 7B model produces faster first-token latency on the same GPU and needs less VRAM, so smaller and cheaper instances. A 34B model gives higher benchmark quality (75.36% vs 71.47% on OALL for Falcon-H1) but costs meaningfully more per request and per hour. Test both and pick the smallest model that clears your quality bar.
Which UAE cloud regions keep an open-source Arabic LLM in country?
UAE-region options include Azure UAE North and AWS Middle East (UAE), plus domestic providers G42 and Khazna. Confirm the specific region and data-residency terms in writing, and verify dependent services (logging, telemetry, backups) are also in-country.
Does Gulf dialect vs Modern Standard Arabic affect which model to host?
Yes. OALL and most public benchmarks lean toward Modern Standard Arabic and general-knowledge tasks, so a strong scorer there can still stumble on Emirati or Khaleeji dialect in real WhatsApp conversations. If users write in dialect, plan dialect-specific evaluation on your own data and a fine-tuning pass.
If I already send Arabic prompts to a US API, what's my compliance exposure?
Any personal data in those prompts is a cross-border transfer under PDPL, with the consent, contractual and documentation obligations attached. DIFC or ADGM entities add the free-zone layer on top. First step is a data-flow audit: know exactly what leaves, then decide whether the API tier is defensible.
