SoftwareUAE8 min read
Custom Software Development in Dubai: A Buyer's Guide
Custom software development in Dubai: when building beats buying, the UAE rules your system must satisfy, how to scope and own the code, and what goes wrong.
By Quickship Editorial Team · Published
Looking for the software itself? See our custom software development Dubai.
Custom software development in Dubai is worth paying for in one situation: the process is how your business competes, and no product on the market fits it. Everything else should be bought, because a subscription is cheaper than a codebase you have to maintain. This guide covers how to make that call, the UAE rules a business system has to satisfy before it goes live, from structured invoice data to seven year record retention, how to scope and own the work, and the things that go wrong on Dubai projects.
Custom software development in Dubai: when building beats buying
Run this test before you commission anything. Building is defensible when at least two of the following are true.
- The process is your edge, and it is shaped by where you trade. An allocation rule that splits stock between a Jebel Ali free zone position and mainland stock, or pricing that differs for free zone and mainland customers, is not something you buy from a product catalogue.
- The integrations are the product. The value is in joining Amazon.ae or noon, a GCC courier, a bank feed and an accounting package that nobody else has joined, and in doing it once instead of re-keying.
- A regulated workflow has to be auditable your way. Federal Tax Authority Corporate Tax record keeping, a Wages Protection System salary file for your bank, or the declaration evidence behind an import, each with your own record of who approved what and when.
If none of those hold, buy the product and spend the budget on implementing it properly. Where part of the job is already solved, the sensible build sits on top of what exists rather than starting from an empty repository.
The UAE rules your system has to satisfy
These are not nice-to-haves bolted on at the end. Each one changes the data model or the hosting decision, which means it belongs in the scope document.
| Area | What the official source says | What it means in the build |
|---|---|---|
| Invoicing | The Ministry of Finance describes a Decentralized Continuous Transaction Control and Exchange model in the PINT AE format, in which invoice tax data is reported to the Federal Tax Authority through accredited service providers. It states that PDF, Word, images, scanned copies and emails are not eInvoices | Invoices are structured data with mandatory fields, exchanged through an integration. A PDF generator is not a compliance feature |
| Record keeping | For Corporate Tax, the FTA states that Taxable Persons and Exempt Persons must retain relevant records for at least seven years following the end of the Tax Period they relate to, including records of transactions, assets, liabilities and shares held | No hard deletes on financial objects. Plan archival storage, an export path and a way to reproduce a document years after the feature that created it changed |
| Personal data | Federal Decree-Law No. 45 of 2021 prohibits processing personal data without the consent of its owner, with exceptions, lets people ask for inaccurate data to be corrected and for processing to be restricted or stopped, and sets requirements for cross-border transfer | Consent has to be a stored record with a timestamp, not a tick box. Correction and restriction are screens someone has to build |
| Payroll | u.ae states that under Ministerial Resolution No. 340 of 2026 salaries for the previous month are due on the first day of each Gregorian month, that at least 85 per cent of wages must be transferred on time, and that transfers go through banks, exchange houses or financial institutions authorised by the Central Bank | A payroll feature owes you a due-date clock and a bank file, not just a payslip PDF |
| Health data | The DHA Telehealth Policy states it is not permitted to store, develop or transfer health data and information outside the country where it relates to health services provided within the country, except in the cases in Article 2 of Ministerial Decision No. 51 of 2021 | For health projects, the hosting region is decided first and the architecture follows |
| Identity | The UAE PASS documentation describes a national digital identity and digital signature platform using the OAuth 2.0 framework, with account levels where SOP1 has mobile and email verified and SOP2 adds a verified Emirates ID | If you need identity you can rely on, the login flow and the account level are a scoping decision |
Two notes. First, the tax rules apply to the records, not to a particular product, so a custom system inherits them the moment it becomes the place an invoice is created. Second, none of this removes the need for your own tax or legal advice on your specific case. It does mean a developer who has never heard of PINT AE or a Wages Protection System file will quote you a system you cannot use.
A worked example: a Dubai distributor
Figures here are made up for illustration.
Say a Dubai distributor sells to 140 retail accounts across the UAE, raises roughly 900 sales invoices and 300 purchase invoices a month, holds stock in one leased warehouse in Al Quoz, and employs 24 people. Accounting runs in an off-the-shelf package. Orders arrive by WhatsApp, email and two salespeople's notebooks, and someone re-types them into the accounting system and a stock spreadsheet.
Here is how the scope divides.
- Buy, do not build: accounting, email, payroll calculation. These are solved products with regulatory updates maintained by someone else.
- Build: the order capture and allocation layer. That is where the business logic lives: credit terms per account, part-allocation when stock is short, and the rule about which salesperson owns which account.
- Integrate: the accounting package, so an approved order becomes an invoice once, and the invoice exchange path for e-invoicing.
- Design around retention: at 1,200 invoices a month, sales and purchase together, seven years of records is about 100,800 invoice documents that must stay readable and retrievable. That is a storage and export decision, not an afterthought.
- Design around consent: the delivery contacts at 140 retail accounts are personal data. Where consent is the basis for processing, it has to be recorded, and correction and restriction have to be possible.
The distributor's first release does one thing: order capture to allocation to invoice, for one sales team. It replaces the spreadsheet. The second release adds purchasing. Nothing is specified for a workflow nobody has used yet.
Scope, contract and ownership
Vague briefs produce quotes that are guesses, and the guess comes back as change requests. Settle these in writing before any work starts.
- A written scope with exclusions. What version one does, and what it explicitly does not do.
- Intellectual property assignment. The code your project pays for belongs to the company on the trade licence, on payment, not to the agency or to a freelancer it subcontracted.
- Source code and repository access. From day one, not at handover.
- Accounts in your name. Hosting, domain, app store, database and third-party API accounts registered to the company that holds the trade licence, not to the agency building the system.
- Data export. A documented way to take your data out in a usable format, including the Arabic fields, tested before go-live rather than promised.
- Acceptance criteria per stage. Written as what a user can do, and checked on real data, including Arabic names and Emirates ID formats rather than test rows of Latin text.
- Integration access. Who obtains the credentials and documentation for every external system, and by when. On a UAE build that usually means the accredited service provider route for the e-invoicing exchange, your bank's salary transfer requirements, and, if you need UAE PASS, the staging user and staging app its documentation expects a developer to have before testing. Missing credentials are a routine cause of delay, so name an owner and a date.
- Arabic and right-to-left. Decide at the start whether the interface, documents or both need Arabic. Retrofitting is expensive.
- Support after launch. What is covered, response times and cost, and who covers a change forced by an FTA or MOHRE rule update.
- Jurisdiction. Agree in writing which courts hear a dispute. Ask your lawyer whether that is the onshore courts or a free zone jurisdiction, because the answer depends on where your company and the developer are registered.
What commonly goes wrong
- Discovery is skipped because the process is "obvious to everyone here", and in a Dubai SME the process usually lives with one person who also does the bank runs.
- Hosting region is chosen after architecture. For health data, and anywhere a sector regulator sets a residency rule, that is a rebuild.
- The old data is nobody's job. Migration from spreadsheets and the previous system, with trade licence numbers, TRNs and Arabic names that never matched across them, is a project of its own, with cleaning, mapping and a cutover plan.
- Go-live lands at month end. Month end in the UAE is not just a close. Salaries for the previous month fall due on the first day of each Gregorian month under the Wages Protection System, and the FTA asks Taxable Persons to file and pay Corporate Tax within nine months from the end of the Tax Period, so a year end cutover competes with the filing. Pick a quiet week.
- Nobody is trained. A system people do not understand gets a parallel spreadsheet, and then you have two systems.
- Support was never priced. Operating systems, browsers, payment providers and UAE tax rules change, and the software needs budget to keep up.
How Quickship approaches it
Quickship's custom software development service builds portals, dashboards, integrations and internal tools for businesses in Dubai and across the UAE. The pattern is the one above: you walk the team through the process and where it hurts, you get a written scope and a quote before work starts, the build runs in stages so working software arrives early, and it is supported and extended afterwards.
Where an existing Quickship module already does part of the job, such as the customs clearance module for inbound shipments and clearing agents, the build starts there instead of from zero. That is usually the cheapest honest answer to a custom brief: build the part that is genuinely yours, and connect the rest.
Frequently asked questions
When is custom software cheaper than an off-the-shelf product?
Rarely on day one. A product you subscribe to costs less to start and carries no maintenance burden, so custom software only wins once the licence line outgrows the cost of owning a codebase. That usually happens when the process it supports is how you compete, when licence counts grow faster than your headcount, or when the workaround spreadsheets have become a second system nobody owns. In the UAE, price in the work of making a bought product produce structured invoice data for the Federal Tax Authority exchange and a Wages Protection System salary file, because whatever it cannot do stays manual.
Who owns the code when a Dubai agency builds my software?
Whoever the contract says owns it. Intellectual property assignment, source code delivery, repository access and the right to hire another developer later are contract terms, not defaults. Ask for them in writing before the first invoice, and name the company on the trade licence as the assignee rather than a trading name, together with the environments, credentials and documentation you receive at handover.
Does my custom system have to handle UAE e-invoicing?
If it issues invoices, it has to produce structured invoice data, not just a PDF. The Ministry of Finance states that PDF, Word, images, scanned copies and emails are not eInvoices, and that invoice tax data is reported to the Federal Tax Authority through accredited service providers. Build the exchange as an integration point rather than a report.
Can a custom business system for a UAE company be hosted outside the country?
It depends on the data. General business data has no single residency rule, but sector rules do exist: the Dubai Health Authority's telehealth policy states that health data relating to services provided inside the country may not be stored, developed or transferred abroad except in the cases set out in Ministerial Decision No. 51 of 2021. Decide hosting region before architecture, not after.
What does UAE PASS login require before we can build it?
UAE PASS is a national digital identity and digital signature platform that uses the OAuth 2.0 framework, so your system relies on it rather than storing its own passwords. Decide the account level you need first: the documentation describes SOP1 as mobile and email verified, and SOP2 as mobile, email and Emirates ID verified. Before testing can start, the integration pre-requisites expect a user created on the staging environment and the staging app installed on the developer's device, so put that in the plan rather than in the last sprint.
Sources
- UAE Ministry of Finance: eInvoicing programme
- Federal Tax Authority: record keeping obligations for Corporate Tax (27 August 2025)
- Federal Tax Authority: Corporate Tax Returns due within nine months from the end of the Tax Period
- u.ae: Data protection laws (Federal Decree-Law No. 45 of 2021)
- u.ae: Payment of salaries and the Wages Protection System
- Dubai Health Authority: Telehealth Policy (DHA/HRS/HPSD/HP-20)
- UAE PASS integration documentation: overview
- UAE PASS integration documentation: web application pre-requisites
Rules and fees in the UAE and Saudi Arabia change. This guide reflects the sources above on 2 November 2026. Check the official source before acting on it.
