Sovereign AI in the UAE 2026: What Enterprise Technology Leaders Must Know About Infrastructure, Models and Competitive Strategy

The UAE has moved sovereign AI from policy ambition to operational reality. Core42's sovereign cloud is live. Nvidia Blackwell GPUs are in Abu Dhabi. The Falcon LLM family runs inside UAE data perimeters. And the Personal Data Protection Law has been in force since January 2026, with full enforcement arriving in January 2027. For enterprise CIOs, CTOs, and technology strategy leads, the question is no longer whether to engage with sovereign AI. It is whether your organisation is moving fast enough.

In this article

• What sovereign AI actually means in the UAE context
• Why 2026 is the inflection year
• The infrastructure layer: Core42, Aleria, and the GPU race
• The model layer: Falcon, Jais, and the case for Arabic-first AI
• The build, buy, or partner decision framework

What sovereign AI actually means in the UAE context

The term "sovereign AI" is used to describe different things depending on who is speaking. National governments use it to mean domestically controlled AI infrastructure that reduces reliance on foreign technology ecosystems. Vendors use it to mean cloud services hosted within a country's borders. Enterprise leaders increasingly use it to mean AI systems that process sensitive data without that data leaving their jurisdiction or their control.

In the UAE context, sovereign AI refers to a layered set of capabilities spanning infrastructure, models, and governance. At the infrastructure layer, it means AI compute hosted on hardware located within UAE borders, operated by entities subject to UAE law, with data that does not leave UAE jurisdiction. At the model layer, it means large language models and AI systems trained on or fine-tuned with UAE-relevant data, with Arabic-language capability that reflects the linguistic and cultural context of the region's workforce and customers. At the governance layer, it means documented frameworks for AI decision-making, data handling, and accountability that satisfy UAE regulatory requirements and are auditable by UAE authorities.

Eric Leandri, chief executive of Aleria, has articulated a practical framing that enterprise leaders should use as a starting point. Sovereignty efforts target the most sensitive 30 per cent of data, covering healthcare, finance, government, and personal information, rather than everyday digital activities. The strategy prioritises end-to-end control across hardware, data, and software within closed systems to safeguard intellectual property and strategic decision-making. This is not an all-or-nothing proposition. Not every workload requires sovereign infrastructure. The discipline is identifying which workloads do, and ensuring those workloads are running on the right architecture before regulatory

enforcement or a security incident forces the decision.

Why 2026 is the inflection year

For the past three years, sovereign AI in the UAE has existed primarily as a strategic direction rather than an operational reality. The infrastructure was being built. The models were being trained. The regulatory frameworks were being drafted. Enterprise technology leaders who followed the developments closely could see where it was heading, but the ecosystem was not yet mature enough to make concrete architectural decisions with confidence.

That has changed materially in 2026. The convergence of four developments has moved sovereign AI from a planning consideration to an operational imperative for UAE enterprises.

The first is infrastructure maturity. Core42's sovereign cloud platform is no longer in early deployment. It is operationally live, serving regulated sector clients in government, finance, and healthcare, with the scale and reliability that enterprise workloads require. The capability gap between sovereign cloud and hyperscaler deployments for regulated workloads has closed to a point where it no longer represents a meaningful compromise.

The second is model availability. The Falcon LLM family has evolved from a research demonstration of UAE AI capability into a production-grade set of models available for enterprise deployment within UAE data perimeters. Arabic-language capability, which was the most significant gap in early sovereign model offerings, has improved substantially. Enterprises evaluating Arabic-first AI for customer engagement, regulatory document processing, and internal knowledge management now have production-viable options that did not exist two years ago.

The third is regulatory enforcement. The UAE PDPL took effect on 1 January 2026. The UAE Data Office is actively building its enforcement capacity, and organisations that treat the January 2027 full compliance deadline as a distant horizon are already behind. The PDPL's requirements around AI systems that process personal data are substantive, and the fines for severe violations reach AED 20 million. The compliance clock is running.

The fourth is geopolitical infrastructure risk. The AWS data centre incidents in the UAE during the regional escalation earlier in 2026 demonstrated in concrete terms what had previously been a theoretical risk: dependence on foreign-operated cloud infrastructure creates a category of operational vulnerability that domestic sovereign infrastructure does not. For enterprise boards with risk functions that had previously treated sovereign AI as a strategic preference rather than a resilience requirement, that demonstration has changed the conversation.

"The infrastructure questions have been answered. Core42's sovereign cloud is mature enough for regulated enterprise workloads, Falcon is production-viable for Arabic-language AI use cases, and the PDPL compliance timeline is no longer abstract. The CIOs who are still treating sovereign AI as a future consideration are going to find themselves making reactive decisions under regulatory pressure rather than strategic decisions on their own timeline." Senior technology strategy adviser, UAE financial services sector, May 2026.

The infrastructure layer: Core42, Aleria, and the GPU race

The physical foundation of UAE sovereign AI has been assembled with a speed and scale that few enterprise leaders have tracked in full. Understanding what has been built, by whom, and on what timeline matters for enterprise technology strategy because the infrastructure landscape shapes the options available for sovereign workload deployment.

Core42, a G42 company, functions as the UAE's primary sovereign cloud and AI infrastructure provider. Its platform combines sovereign cloud hosting with AI compute capabilities, advisory services, and managed services designed to support enterprise-scale AI adoption within UAE data sovereignty requirements. The UAE Sovereign Launchpad, now fully operational, is designed to give regulated sector organisations a pre-built, regulator-aligned infrastructure foundation for AI deployment, hosted locally in the AWS UAE region and managed by Core42. This gives enterprises access to hyperscaler-grade infrastructure with the data residency guarantees that regulated workloads require.

In April 2026, Core42 announced a strategic partnership with Solutions+ to accelerate sovereign AI infrastructure deployment across the Mubadala Investment Company Group and UAE government entities. The agreement positions Core42 as the foundational infrastructure provider supplying sovereign cloud and AI compute, while Solutions+ serves as the lead implementation and data services partner for Mubadala portfolio companies. This partnership is significant for enterprise technology leaders because it signals the direction of UAE sovereign AI architecture at the institutional level, with the pattern of sovereign infrastructure plus enterprise implementation partner likely to be replicated across other large conglomerates and government-linked entities.

The GPU layer is equally significant. Aleria, an Abu Dhabi-based AI infrastructure provider, has committed to deploying 8,640 Nvidia Blackwell Ultra GPUs with expansion to 16,000, alongside early access to DGX Vera Rubin supercomputing systems. This represents a compute capability at the frontier of what is available globally, deployed domestically within UAE borders. For enterprise AI workloads that require significant compute for model training, fine-tuning, or inference at scale, the availability of frontier GPU capacity within UAE data perimeters removes what was previously a significant technical constraint on sovereign AI deployment.

For enterprise technology leaders evaluating infrastructure options, the practical question has shifted from whether sovereign infrastructure is technically viable to which sovereign infrastructure option best fits the organisation's workload profile, compliance requirements, and existing technology investments.

The sovereign AI infrastructure timeline:

April 2024: Microsoft invests $1.5 billion in G42. The strategic minority investment marked the inflection point in UAE sovereign AI, bringing Microsoft's enterprise cloud expertise into direct partnership with G42's sovereign infrastructure and validating the UAE's position as a globally significant AI destination.

Q4 2025: Core42 Sovereign Launchpad reaches operational maturity. Core42's sovereign cloud platform moved from early deployment to production-grade service delivery for regulated sector clients, removing the technical immaturity that had previously constrained enterprise adoption decisions.

January 2026: UAE PDPL takes effect. Federal Decree-Law No. 45 of 2021 became actively enforceable, placing PDPL compliance obligations on all organisations processing personal data of UAE residents and starting the one-year transition clock toward full mandatory adherence.

May 2026: Core42 and Solutions+ partnership announced. The Mubadala-aligned partnership established the enterprise sovereign AI deployment model that is likely to define institutional AI infrastructure across the UAE for the next three to five years.

May 2026: Aleria deploys frontier Nvidia Blackwell GPU capacity in Abu Dhabi. The arrival of Nvidia Blackwell Ultra GPUs in Abu Dhabi established frontier compute capability within UAE data perimeters for the first time, removing the last significant technical constraint on high-performance sovereign AI workloads.

January 2027: Full PDPL compliance mandatory. The transition period closes and the UAE Data Office's enforcement authority reaches full effect across all organisations processing personal data of UAE residents, with fines of up to AED 20 million for severe violations.

The model layer: Falcon, Jais, and the case for Arabic-first AI

Infrastructure provides the foundation for sovereign AI, but the model layer determines whether enterprises can actually build AI systems that serve UAE customers, process UAE regulatory documents, and operate effectively within the linguistic and cultural context of the GCC. The UAE's investment in domestic AI model development is now producing assets that enterprise technology leaders should be evaluating for production deployment.

The Falcon LLM family, developed by Abu Dhabi's Technology Innovation Institute in partnership with G42, is the UAE's primary open-source large language model contribution. Falcon weights and inference run inside UAE data perimeters, ensuring sensitive government and enterprise data never leaves UAE jurisdiction. The models have been continuously developed since their initial release, with successive versions improving performance on Arabic-language benchmarks to the point where Falcon is now competitive with international models on tasks requiring Arabic comprehension, generation, and reasoning.

Jais, developed by Core42 and Mohamed bin Zayed University of Artificial Intelligence, offers an alternative Arabic-focused LLM with particular strength on classical and modern standard Arabic, making it well-suited for regulatory document processing, legal analysis, and formal communications in Arabic. Enterprise organisations evaluating Arabic-first AI should treat Falcon and Jais as complementary options with different performance profiles across different task categories rather than direct substitutes.

G42 has also announced a partnership with Mistral AI to build new models and platforms, extending the sovereign model ecosystem beyond the UAE's own development programmes and into strategic international partnerships that keep the UAE connected to the frontier of global AI development while maintaining domestic data and infrastructure control.

The practical case for Arabic-first AI in enterprise deployments rests on three arguments that generic global models cannot address. The first is performance. Fine-tuning Falcon or Jais on an enterprise's own Arabic-language data, including legal documents, regulatory filings, customer communications, and internal knowledge bases, produces a model that understands the organisation's specific Arabic-language context at a depth that a generic English-first model fine-tuned on Arabic translations cannot replicate. The second is compliance. Processing Arabic-language customer data through a non-UAE-hosted model API creates cross-border transfer obligations under the PDPL that sovereign model deployment avoids entirely. The third is competitive positioning. Enterprises that build internal Arabic AI capabilities ahead of market saturation will have accumulated proprietary training data and institutional model knowledge that late movers cannot quickly replicate.

The sovereign model landscape for UAE enterprise deployments currently includes six primary options: Falcon LLM running within UAE data perimeters for both Arabic and English enterprise tasks; Jais for classical and modern standard Arabic with particular strength in formal and regulatory contexts; models developed through G42's Mistral partnership for frontier European open-source capability under a sovereign framework; OpenAI models accessed through G42's commercial partnership under UAE-governed terms; Microsoft Azure UAE North providing Azure OpenAI services on in-country infrastructure; and enterprise fine-tuning on sovereign compute through the combination of Core42's cloud and Aleria's GPU capacity.

The build, buy, or partner decision framework

One of the most consequential decisions enterprise technology leaders will make in 2026 is how to configure their sovereign AI capability: building internal AI infrastructure and model development capability, buying sovereign AI as a managed service from providers including Core42, or partnering with a combination of infrastructure providers, system integrators, and model providers to assemble a sovereign AI capability that fits the organisation's specific requirements.

The build option is viable for organisations with large technology budgets, significant internal data science capability, and workloads that require a level of customisation and control that managed service offerings cannot match. Government entities and large financial institutions are the most likely candidates. For most enterprises, the capital cost of building internal AI infrastructure at meaningful scale, combined with the specialist talent required to operate it, makes pure build an impractical option.

The buy option, taking Core42's sovereign cloud and AI platform as a managed service, is the fastest path to sovereign AI capability for organisations that prioritise speed and compliance assurance over maximum customisation. Core42's platform is designed to be regulator-aligned by default, which substantially reduces the compliance burden on the enterprise technology team. The trade-off is reduced control over the infrastructure layer and a dependency on Core42's roadmap for future capability development.

The partner option, combining sovereign infrastructure from Core42 or Azure UAE North with model deployment through TII's Falcon family or Jais and implementation support from a system integrator, offers the most flexible configuration for organisations with complex requirements. This is the model that the Core42 and Solutions+ partnership with Mubadala illustrates at an institutional scale, and it is the architecture that most large enterprise deployments will converge on. The complexity is higher, and the governance burden of coordinating multiple partners around a coherent sovereign AI architecture requires dedicated programme management.

Four factors should drive the build, buy, or partner decision. The first is data sensitivity classification: the sensitivity of the data the AI system will process determines the stringency of the sovereign architecture required. The second is regulatory framework mapping: the cumulative requirements of all applicable regulatory regimes should drive the architecture, with the most restrictive applicable regime setting the baseline. The third is workload performance requirements: sovereign infrastructure must meet the performance requirements of the workloads it will support, and organisations should assess Core42 and Aleria's compute capacity against their specific performance profile before committing to an architecture. The fourth is Arabic-language capability requirements: organisations with material Arabic-language AI requirements should assess whether their current model strategy adequately serves those requirements or whether performance gaps are creating measurable commercial and compliance risk.

The regulatory implications of the infrastructure and model decisions described above are substantial. The PDPL compliance requirements, enterprise risk framework, sector-by-sector obligations, and governance readiness assessment for sovereign AI deployments in the UAE are covered in the companion analysis to this article: Sovereign AI Compliance in the UAE 2026: PDPL, Governance, and the 2027 Enforcement Deadline.

This research article draws on publicly available information including announcements from Core42, G42, TII, Aleria, the UAE Data Office, and independent analysis from Computer Weekly, The National, MIT Sloan Management Review Middle East, and Zawya. All regulatory requirements referenced are drawn from the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its executive regulations. Enterprise technology leaders should seek qualified legal advice before making compliance decisions based on this analysis.