Blog

What a UAE Business Website Must Have in 2026: Arabic RTL, .ae Domain, Hosting, Speed and Legal Requirements

UAE business website requirements for 2026: Arabic RTL, .ae vs .com, hosting and speed, legal footer with licence and TRN, WhatsApp path and AI-readable code.

Quick Answer

A UAE business website in 2026 needs six things working together: a language decision made on data rather than habit (English-only is legitimate for many businesses, Arabic is essential for others); a domain strategy that usually means owning both the .ae and the .com; hosting or a CDN with a presence in the Gulf so the site loads fast on the UAE’s overwhelmingly mobile audience; a legal footer and privacy setup that reflect the e-commerce law, the Consumer Protection Law and the Personal Data Protection Law; a WhatsApp-first enquiry path, because WhatsApp is the most-used platform in the country; and a technical build whose content is present in the HTML itself, so that Google, Bing and the AI assistants that now answer buyers’ questions can all read it. The 25-point checklist at the end of this guide covers each of these in the order a build should address them.

Most UAE business websites are commissioned the way a shop fit-out is commissioned: pick a look, agree a price, launch. The result is a site that photographs well in a proposal and then quietly underperforms for years, because none of the decisions that actually determine whether it produces enquiries were made deliberately. Language was whatever the founder speaks. The domain was whatever was available. Hosting was wherever the developer’s other clients are hosted. The footer was copied from a template written for another country. And the enquiry form goes to an inbox that nobody checks on a Friday, in a market where the customer expected a WhatsApp reply within minutes.

This guide is written for the owner or marketing lead commissioning a new site or rebuilding an old one in the UAE. It sets out what the market’s own data says visitors expect, what the .ae domain rules actually are, why server location matters more here than in most countries, what the law requires you to show and how you handle personal data, why WhatsApp belongs in the header, and one technical requirement that almost no brief includes but that now decides whether your site exists for AI search at all. Each section ends in a checklist line, and the full list is at the bottom. We build to this list at Blackstone; you are welcome to hand it to whoever builds yours.

What Visitors in the UAE Expect in the First Five Seconds

The UAE is one of the most connected markets on earth, and the numbers shape everything that follows. According to DataReportal’s Digital 2026 report for the United Arab Emirates, the country had 11.3 million internet users in early 2026, a penetration rate of 99.0 per cent, 12.5 million social media user identities (equivalent to 110 per cent of the population, because many people hold more than one account) and 23.0 million mobile connections, or 202 per cent of the population. Median mobile download speed, measured by Ookla and reported in the same source, was around 614 Mbps, among the fastest in the world.

Two consequences follow. First, your visitor is almost certainly on a phone, on a fast connection, with high expectations of how quickly things should load; a site that takes four seconds to become usable is not “a bit slow” here, it is broken by local standards. Second, the visitor is comparing you not to other websites in your category but to the last app they used, which was probably WhatsApp, Instagram or a bank. Clarity in five seconds is the bar: what you do, who you do it for, where you are, and how to contact you, visible without scrolling on a mobile screen.

Checklist: the mobile view answers what, who, where and how-to-contact above the fold.

Language: English, Arabic or Both, and How to Decide

The first thing to clear up is a common misconception. We found no federal rule requiring Arabic content on a private business website. Arabic requirements attach to government services and to specific consumer-facing contexts such as labelling, not to a company’s marketing site. So the Arabic decision is a commercial one, and it should be made on evidence rather than on assumption in either direction.

The evidence points both ways depending on who you sell to. CSA Research’s “Can’t Read, Won’t Buy” study (July 2020, conducted with Kantar across 8,709 consumers in 29 countries) found that 76 per cent of online shoppers prefer to buy products with information in their own language, that 40 per cent will never buy from websites in other languages, and that 75 per cent are more likely to buy again from a brand that offers after-sales support in their language. That is a global finding, not a UAE one, but it is the strongest evidence available that language is a purchase factor, not a courtesy.

In the UAE the picture is layered. A large share of the resident population reads and transacts in English, and many Emirati nationals are comfortable online in English as well as Arabic. But if your customers are Emirati families, government or semi-government buyers, Saudi or wider GCC audiences, or Arabic-first communities, an English-only site signals that you were not built for them. If your customers are predominantly expatriate professionals in Dubai’s private sector, English-only is often the right call and a poorly maintained Arabic version does more harm than none.

When you do build Arabic, three technical points separate a professional bilingual site from a translated one. Arabic is right-to-left: the whole layout mirrors, not just the text, and the page must declare dir="rtl" and lang="ar" so browsers and search engines treat it correctly. Each language version needs hreflang tags (ar-AE and en-AE) so Google shows the right version to the right searcher rather than treating them as duplicates. And Arabic web fonts must be chosen and tested, because many “bilingual” templates render Arabic in a fallback font that looks amateurish to a native reader. Our upcoming guide on whether you need an Arabic website goes through the decision in more depth.

Checklist: language decision documented against the customer segments you serve; if Arabic, RTL layout, hreflang and tested Arabic typography.

Domain: .ae, .com or Both

The .ae country-code domain is administered by .aeDA, the .ae Domain Administration, which sits under the UAE Telecommunications and Digital Government Regulatory Authority (TDRA). The rules are less restrictive than most people assume. A second-level .ae domain (yourbrand.ae) is open to anyone, individual or company, local or international; no UAE trade licence, Emirates ID or local office is required. The restricted zones are the third-level ones: .co.ae requires a valid UAE trade licence or a registered UAE trademark connected to the name, and .net.ae requires a trade licence that specifically lists IT services. Registration is for one to five years and renewable, and because the ccTLD is treated as a national asset, false registration information can lead to revocation.

For a business that serves the UAE market, the .ae carries two advantages. It is a trust signal to local visitors, who read it as “this company is actually here.” And it is a geo-targeting signal to Google, which treats a country-code domain as a strong indicator that a site is relevant to searchers in that country; a generic .com can be geo-targeted through Search Console settings, but the .ae does it by default. The .com carries a different advantage: it is what people type from memory, and it is the natural home for a brand that will expand across the GCC or beyond.

The practical answer for most UAE businesses is both: register the .ae and the .com, choose one as the primary that all pages live on, and permanently redirect the other to it. Which one is primary depends on whether the brand is UAE-focused (make .ae primary) or regional (make .com primary and consider country domains later). What you should not do is run the same content on both without redirects, which splits your search authority in half.

Checklist: .ae and .com both registered; one primary; the other 301-redirected; renewal set to auto.

Hosting, Speed and Where Your Visitors Actually Are

A website hosted in a US or European data centre serves a UAE visitor from thousands of kilometres away. Every request travels that distance and back, and a modern page makes dozens of requests. On a fast Gulf mobile connection the bottleneck is no longer the visitor’s network; it is your server’s distance. The fix is either to host in the region or to put a content delivery network in front of the site that has edge locations in the Gulf. Both are now straightforward: Amazon Web Services operates a UAE region (me-central-1), Microsoft Azure operates UAE North, and Cloudflare and other CDNs serve the Gulf from local edge nodes.

Speed should be measured against Google’s Core Web Vitals rather than against a developer’s assurance. The three thresholds are: Largest Contentful Paint (LCP) at or under 2.5 seconds, meaning the main content is visible; Interaction to Next Paint (INP) at or under 200 milliseconds, meaning the page responds when tapped (INP replaced First Input Delay as a Core Web Vital in March 2024); and Cumulative Layout Shift (CLS) at or under 0.1, meaning the layout does not jump around while loading. Test on a mid-range Android phone on a mobile connection in the UAE, not on the developer’s laptop on office wifi, and test the real pages people land on, not just the homepage.

Data residency is the third reason to host regionally. The Personal Data Protection Law (covered below) contains rules on transferring personal data outside the UAE. Hosting customer data in-region does not remove your obligations, but it removes a category of questions your clients’ procurement teams and your own lawyers will otherwise ask.

Checklist: regional hosting or Gulf CDN in place; LCP ≤ 2.5 s, INP ≤ 200 ms, CLS ≤ 0.1 on real mobile tests; data location documented.

The Legal Footer: Licence, TRN, Privacy and Terms

This is where most UAE websites are copied from templates written for other jurisdictions. Four pieces of law shape what a business site should show and how it should behave.

Company identity. The e-commerce law, Federal Decree-Law No. 14 of 2023 on Trading by Modern Technological Means, in force since September 2023 and administered by the Ministry of Economy, brings websites, apps, social media selling and virtual stores under one framework and requires sellers to be identifiable. The Consumer Protection Law, Federal Law No. 15 of 2020, and its Executive Regulation, Cabinet Decision No. 66 of 2023, require suppliers selling online to provide information about their identity and their products, and make platform operators responsible for third-party sellers on their platforms. The practical standard for a UAE business site is a footer that shows the legal entity name as it appears on the trade licence, the licence number and issuing authority (Dubai DET, Abu Dhabi DED, or the free zone), a physical address and a working contact channel. The Consumer Protection Law also restricts the use of consumer data for marketing, which links directly to the privacy point below.

Tax Registration Number. The Federal Tax Authority requires the 15-digit TRN on every tax invoice, credit note and VAT return. Displaying it on the website is not a separate legal requirement, but it is standard practice for VAT-registered businesses and a trust signal for B2B buyers who will check it against the FTA’s free verification tool. There is a further reason to get your invoicing house in order now: the UAE’s e-invoicing mandate, set out in Ministerial Decisions No. 243 and 244 of 2025 and the Ministry of Finance’s Electronic Invoicing Guidelines (February 2026), begins a pilot in July 2026 and becomes mandatory on 1 January 2027 for businesses with revenue of AED 50 million or more, on 1 July 2027 for businesses below that threshold, and on 1 October 2027 for government entities. A verified TRN is a mandatory field on structured e-invoices.

Prices. Show prices in AED and be explicit about whether VAT is included. The Consumer Protection framework is built around transparency of the total price to the consumer, and ambiguity here is a common source of complaints.

Privacy and personal data. The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in effect since 2 January 2022 and is overseen by the UAE Data Office. It applies across the UAE except in DIFC and ADGM, which have their own data protection regimes, and certain other free zones. Under the PDPL, consent for processing personal data must be freely given, specific, informed and unambiguous, and must be as easy to withdraw as to give; individuals have rights of access, correction, erasure and objection. The law’s Executive Regulations had still not been issued as of August 2026 (the UAE Legislation portal shows no related legislation, and the government’s data-protection page still describes the Data Office’s role prospectively); once they are issued, organisations get six months to comply. What this means for your website today: a privacy policy written for the UAE and the PDPL, not a copied GDPR template; a cookie notice with genuine choice for non-essential cookies and marketing pixels; and forms that ask for consent to marketing separately from consent to be contacted about the enquiry. Our upcoming guide to the PDPL for marketers covers the consent mechanics in detail.

Checklist: footer carries entity name, licence number, authority, address, TRN (if registered); UAE-specific privacy policy; consent-based cookie notice; terms, returns and refunds pages.

WhatsApp, Forms and the Enquiry Path

In most markets the contact form is the conversion. In the UAE it is WhatsApp. DataReportal’s Digital 2026 report, drawing on Meta and Kepios data, puts WhatsApp as the platform UAE users spend the most time on, at roughly 15 hours 16 minutes per month, and industry research puts its penetration above 90 per cent of the connected population. A visitor who wants to ask a question expects a WhatsApp button, not a five-field form and a promise to respond within 48 hours.

The build implications are specific. A click-to-chat WhatsApp button should be persistent on mobile and pre-filled with a message that tells your team which page it came from. The number behind it should be a WhatsApp Business account, not a personal phone, so that it can be staffed, tracked and kept if the employee leaves. The traditional form should stay for people who prefer it and for B2B buyers submitting requirements, but it should be short, it should confirm receipt instantly, and it should route to a monitored inbox with a named owner. Every enquiry channel should be tagged so you know which pages and campaigns produce the messages; without that, you will never know what the website is worth.

Link the site to your Google Business Profile as well. In the UAE a large share of local discovery happens in Google Maps, and a profile that links to a site whose name, address and phone match exactly is a small but real ranking and trust factor.

Checklist: WhatsApp Business click-to-chat with page-aware pre-fill; short form with instant confirmation and a named owner; enquiry sources tracked; Google Business Profile linked and consistent.

Technical: Schema, Rendering and Being Readable by AI

Here is the requirement that almost no website brief includes and that increasingly decides whether a business exists in the places buyers now ask questions. Many modern websites are built as JavaScript applications: the browser downloads a shell and a script, and the script then fetches and draws the content. To a human they look identical to a conventional site. To a crawler that does not run JavaScript, they are empty.

Google does run JavaScript when it crawls, though it does so in a second, slower pass. The AI crawlers that feed ChatGPT, Claude, Perplexity and others do not. Research published by Vercel and MERJ in December 2024, analysing crawler traffic across Vercel’s network, found that none of the major AI crawlers rendered JavaScript: OpenAI’s GPTBot, OAI-SearchBot and ChatGPT-User, Anthropic’s ClaudeBot, Meta’s crawler, ByteDance’s Bytespider and PerplexityBot all fetched pages without executing client-side code. GPTBot downloaded JavaScript files in 11.5 per cent of requests and Claude’s crawler in 23.8 per cent, but neither executed them. The exceptions were Google’s own crawler (which also serves Gemini) and Apple’s. The consequence is blunt: a JavaScript-only business site can rank on Google and still be invisible to the AI assistants a growing share of your buyers consult before they shortlist anyone.

The fix is to make sure the content, the page titles and the structured data are present in the HTML the server sends, either by building the site with server-side rendering or static generation, or by adding a pre-rendering layer to an existing JavaScript site. The test takes ten seconds: open any page, view the page source (not the inspector), and search for a sentence you can see on screen. If it is not in the source, AI cannot read it. Our companion article explains why JavaScript-only sites vanish from AI search and how to fix one without a rebuild.

Two smaller technical items belong in the same section. Add structured data (schema.org markup) for your organisation, your services and any FAQs, again in the server-rendered HTML, so that search engines and AI systems can identify what the page is about without guessing. And make sure robots.txt does not block the crawlers you want; several popular security and caching plugins block AI bots by default.

Checklist: page content, titles and schema present in view-source with JavaScript disabled; Organization, Service and FAQ schema; robots.txt permits the search and AI crawlers you want.

The 25-Point Website Requirements Checklist

If your current site fails more than eight of these, a rebuild is usually cheaper than a repair. If it fails fewer, most items can be fixed in place. Either way, this is the list we build to at Blackstone, and you can see what the results look like in our portfolio. To talk through your own site against it, start a project or read more about our digital development work.

We build websites that meet every line of this checklist.

Bilingual, Gulf-hosted, PDPL-ready and readable by Google and AI search from day one. Hand us your brief, or hand our checklist to whoever builds yours.

Frequently Asked Questions

We found no federal rule requiring Arabic content on a private company’s marketing website; Arabic requirements attach to government services and specific consumer contexts such as labelling. The decision is commercial. Build Arabic if your customers include Emirati families, government buyers or Arabic-first communities; an English-only site is legitimate for many private-sector audiences, and a badly maintained Arabic version is worse than none.

No. A second-level .ae domain (yourbrand.ae) is open to anyone, local or international, with no licence or Emirates ID required. Only the third-level zones are restricted: .co.ae needs a UAE trade licence or registered trademark, and .net.ae needs a licence listing IT services. Registration is for one to five years, renewable, under .aeDA, part of the TDRA.

The legal entity name as on the trade licence, the licence number and issuing authority, a physical address and working contact details, and a UAE-specific privacy policy. VAT-registered businesses should show their 15-digit TRN, which the FTA requires on tax invoices and which buyers can verify. Prices should be in AED with the VAT position stated, and online sellers need clear terms, returns and refund pages.

If you collect personal data from people in the UAE through forms, cookies, pixels or WhatsApp, yes, unless you operate solely within DIFC or ADGM, which have their own regimes. The PDPL has been in force since 2 January 2022 and requires consent that is freely given, specific, informed and unambiguous, with rights of access, correction, erasure and objection. Its Executive Regulations were still pending as of August 2026; once issued, businesses get six months to comply.

Because the AI crawlers behind ChatGPT, Claude and Perplexity do not execute JavaScript, according to Vercel and MERJ’s December 2024 analysis. If your site draws its content with scripts after loading, those systems see an empty page and cannot cite or recommend you. Check by viewing the page source and searching for a visible sentence; if it is absent, you need server-side rendering or pre-rendering.