Two questions separate a safe software company from a risky one. Ask the agency what they have built that still runs today. Then ask who the code belongs to when the work is finished. Ask them out loud, word for word, in the meeting.
A price quote will not answer either question. It gives you a price and a finish date, and both are fixed before any work starts. Neither the price nor the finish date tells you what the software costs to keep running afterwards. A peer reviewed study tracked 30 systems across three large companies. Over five years, 79 percent of the cost came after launch, not during the build.
The cost after launch is one risk. The contract is the other. In the UAE, two articles of the copyright law say different things about who owns software you paid for. The courts have not decided between them. So "you own it, obviously" is not an answer, and neither is a price.
The twelve questions
| # | Ask this | What you are really testing |
|---|---|---|
| 1 | "Who writes the code, and where do they sit?" | Whether the work is subcontracted |
| 2 | "Show me something you built that still runs" | Whether they can support what they build |
| 3 | "What worries you about my plan?" | Whether they read it |
| 4 | "Can I speak to a client who left you?" | Whether they only show happy clients |
| 5 | "Is this fixed price or by the hour?" | Who carries the risk |
| 6 | "What is the warranty, and what do I get if it fails?" | Whether the promise can be enforced |
| 7 | "What will this cost me every year after launch?" | Whether they have told you the real price |
| 8 | "Which paid services will this depend on?" | The bill that arrives after you launch |
| 9 | "Who does the code belong to when we finish?" | Whether you can leave |
| 10 | "What happens if you are late?" | Whether the contract protects you |
| 11 | "Where will my data live?" | Whether you are allowed to build it that way |
| 12 | "What is in the requirements document?" | Whether anyone agreed what you are buying |
The team and the work
1. "Who writes the code, and where do they sit?"
The answer you want. Names, roles and locations. How many are employees. Who is the lead.
The answer that should worry you. "We have a team of 200 developers." Team size is not an answer. Neither is "our resources". Ask whether any part is subcontracted to another company, and get the answer in the contract.
Staff augmentation means renting developers who work under you. White labelling means another company writes the code and the agency you hired puts its name on it. No standards body defines either term, or a "dedicated team". Each seller means something different, so ask what the words mean in your contract.
2. "Show me something you built that still runs"
The answer you want. A live product, with a link, that they still support.
The answer that should worry you. A portfolio of screenshots. Building software and running software are different jobs, and most agencies only do the first.
At COM8 STUDIO we build and run COM8 Realty, a CRM used by Dubai brokerages, so we also pay to fix whatever we get wrong. Ask any agency what they still run, and who answers the phone when it breaks.
3. "What worries you about my plan?"
The answer you want. A specific concern about your own plan. Something like: "The reports page you asked for needs numbers your team does not collect anywhere yet." That answer proves they read your plan.
The answer that should worry you. "It all looks good." Nobody's plan is all good. An agency that agrees with everything in a sales meeting will agree with everything later, and then bill you for the changes.
4. "Can I speak to a client who left you?"
The answer you want. A name, or an honest explanation of why not.
The answer that should worry you. Only current, happy references. Every agency can produce those. The useful conversation is with someone whose project ended.
The money
5. "Is this fixed price or by the hour?"
Both models are normal. They put the risk on different people.
The United States federal procurement rules define both clearly. A firm fixed price contract, in the words of FAR 16.202-1, "places upon the contractor maximum risk and full responsibility for all costs and resulting profit or loss". Time and materials, which means paying by the hour, is the opposite. FAR 16.601 says it "provides no positive profit incentive to the contractor for cost control or labor efficiency".
One rule from the same regulation belongs in your contract. Time and materials work must have a ceiling price, and a supplier who goes above it carries that extra cost itself.
A 2017 paper in the International Journal of Project Management reported two separate studies. The finding: "the use of fixed price contracts is connected with a higher risk of project failure compared to time and materials types of contracts". A fixed price does not remove risk. It turns the risk into an argument about what the price covered.
The answer you want. A fixed price after a paid stage where they study what you need, or time and materials with a ceiling.
The answer that should worry you. A fixed price quoted in the first meeting, before anyone has written down what you are buying. That price is a guess, and you will pay for the guess through change requests.
6. "What is the warranty, and what do I get if it fails?"
Ask two things. How long does the warranty last, and what must they do if something breaks? Most people ask only the first.
There is no published industry standard for a software warranty period. The "30 to 90 days" figure you will be quoted comes from agency blogs and contract template sites, not from any standards body.
Government buyers ask for much more than that. The World Bank's standard contract for information systems sets a default warranty of thirty six months, and it starts at operational acceptance, not at delivery. California's standard IT contract terms keep software and services under warranty for as long as the state keeps using them.
Those terms also say what the buyer gets, and the buyer chooses. One option is to make the supplier fix the work. The other is to end the contract, take your money back, and make the supplier pay the extra cost of buying the same thing from someone else.
The answer you want. A warranty that starts when the software goes live, and a written promise of what they will do.
The answer that should worry you. A warranty that starts at delivery and runs 30 days. Bugs in real use take longer than that to appear.
7. "What will this cost me every year after launch?"
This is the number most quotes leave out, and it is bigger than the build price.
Ruediger Zarnekow and Walter Brenner of the University of St. Gallen measured it. Their peer reviewed paper tracked 30 systems across three large European companies. Over a five year life, 79 percent of total cost came after launch. Only 21 percent was planning and building.
Other sources put the share differently. Robert Glass records 40 to 80 percent. Stephen Schach's textbook says at least 67 percent. The estimates disagree on the size. They agree on the direction: building costs less than everything that comes after it.
You will also be quoted "15 to 25 percent of build cost per year" as the maintenance rate. We could not trace that figure to any research body, standards body or published dataset. It appears only on agency pricing pages.
The answer you want. A written annual figure, and a list of what it covers. Security patches, framework upgrades, hosting, and the work caused when a service you depend on changes.
The answer that should worry you. "We will sort that out later."
8. "Which paid services will this depend on?"
Your software will depend on other companies' software. Each one sends its own bill, and each one raises its price.
The answer you want. A list, with the monthly cost of each at your expected volume. Hosting, payment gateway, email and SMS, maps, identity checks, storage.
The answer that should worry you. A build price with no running costs attached. Those services are not optional extras. They are part of what you are buying. We listed those running costs for online stores in our guide to ecommerce platforms, where five of the payment providers we checked publish no price at all.
The contract and the law
9. "Who does the code belong to when we finish?"
Most advice says the developer keeps copyright unless the contract gives it to you. In the UAE that is not what the law says.
Federal Decree-Law No. 38 of 2021 protects software expressly. Article 2 lists "smart applications, software and software applications, databases" as protected works.
Article 28 then sets the default. It applies "unless otherwise agreed in writing". The rule itself reads: "If the Author makes an Innovation in favour of another Person, the copyright shall be attributed to such Person." So by this article alone, the client who paid for the work starts with the economic rights, which are the rights to copy, sell and license the software.
But Article 9 of the same law says the opposite. It says any right not expressly assigned stays with the author. It also requires every transfer to be in writing, naming the right, the purpose, the duration and the place of use.
The two articles conflict, and UAE courts have not decided between them. So do not rely on the default either way. Put the transfer in the contract in writing, naming each right, its purpose, its duration and where it applies.
Two more points from the same law. Moral rights cannot be transferred at all, so credit stays with the developer permanently. And registration is not required for protection. Article 4 says failure to register "shall not prejudice any aspect of the protection or rights established" by the law. Anyone who tells you that you must register software with the Ministry of Economy to own it is wrong.
The answer you want. A written transfer of the economic rights, naming the right, the purpose, the duration and the place. Plus the source code repository, in your company's account, from day one.
The answer that should worry you. "You own it, obviously." If the answer is obvious, it is easy to write down.
10. "What happens if you are late?"
The UAE rewrote its civil law recently, and most advice online is still based on the old one.
Federal Decree-Law No. 25 of 2025 replaced the 1985 Civil Transactions Law. It came into force on 1 June 2026. Almost every guide you will read still cites Article 390 of the old law for penalty clauses. That law no longer exists. The equivalent is now Article 340.
Under Article 340 you may agree the compensation in advance. A court may reduce it if the amount was excessive, or if part of the work was done. Under Article 337, you usually have to send the supplier a formal written notice before compensation is due, unless your contract says otherwise.
Article 813 is the one to know before you sign. A contract for work must state what is being made, the method, the period of completion and the payment. If no period is agreed, Article 818 requires the work to be finished within a reasonable time.
The World Bank's contract shows one way to write down what happens when the supplier is late. Under it the supplier pays 0.5% of the contract price for every week of delay, up to a limit of 10%.
The answer you want. A dated delivery schedule, a written consequence for missing it, and a notice process.
The answer that should worry you. A timeline in the proposal that never reaches the contract.
11. "Where will my data live?"
The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, contains no data residency rule. Across its 31 articles, nothing requires personal data to stay inside the country. Articles 22 and 23 instead set the conditions for moving data out of the country.
Two sectors are different. Health data must stay in the country. Federal Law No. 2 of 2019, Article 13, says it is "not permissible to store, process, generate or transform the health data and information outside State" where the service was provided inside the UAE. Article 24 sets the penalty at between 500,000 and 700,000 dirhams.
Banking has its own rule. The Central Bank's Consumer Protection Standards, clause 6.1.6.3, require licensed financial institutions to "hold and store all Consumer and transaction Data within the UAE".
The answer you want. A named country and provider for the database, and a check of whether the health or banking rules apply to you.
The answer that should worry you. "It is on the cloud." That is not a location.
12. "What is in the requirements document?"
If nobody wrote down what you are buying, there is no proof of what was agreed.
The current standard is ISO/IEC/IEEE 29148:2018. Clause 9.6 lists what a software requirements specification should contain. An agency that names IEEE 830 instead is quoting a document replaced twice, in 2011 and again in 2018.
Ask about acceptance too. The International Software Testing Qualifications Board defines user acceptance testing as testing "performed to determine if intended users accept the system". Your contract should say who tests, against what, and what happens if the users do not accept it.
The answer you want. A written specification you can read without a developer next to you, and a sign off process.
The answer that should worry you. "We are agile, so we do not write requirements." Agile changes the point at which you write things down. It does not remove the need to agree what you are buying.
The numbers you will be quoted that nobody can check
Software sales presentations are full of statistics. We tried to find where the common ones came from. Most have no traceable source.
| What you will be told | What we found |
|---|---|
| UAE data law fines reach 5 million dirhams | The PDPL sets no fine at all. Article 26 leaves penalties to a Cabinet decision that has not been issued |
| The PDPL executive regulations are in force | They were due in March 2022. They have still not been published |
| 70 percent of software projects fail | Traces back to arithmetic performed on a 1994 report by people other than its authors |
| Projects run 189 percent over budget | From 1994, and only for the projects that ran over. The same publisher reported 43 percent by 2002 |
| The IEEE says maintenance is 60 to 80 percent of cost | The IEEE's own body of knowledge says only "a major share" |
| Maintenance costs 15 to 25 percent of build per year | No research body publishes this. Only agency pricing pages |
| You must register software with the Ministry of Economy | Article 4 of the copyright law says registration is not required for protection |
| Penalty clauses are governed by Article 390 | That law was repealed on 1 June 2026 |
The most useful test of a statistic is to ask where it came from. Researchers once asked the publisher of the most quoted software failure numbers how its projects were selected. The answer they published was that the reports "should be considered Standish opinion and the reader bears all risk in the use of this opinion".
The same researchers showed why the numbers move. They took a real company that scored 5.8 percent successful, kept every estimating error exactly the same size, and changed only whether each estimate was too high or too low. With errors of the same size, the company then scored 94.2 percent successful.
Better numbers come from named studies you can check yourself. Oxford researchers Bent Flyvbjerg and Alexander Budzier analysed 1,471 IT projects and found an average cost overrun of 27 percent, with one in six running 200 percent over. Their projects were very large government programmes, with an average cost of 167 million dollars, so treat the finding as a warning about very big projects, not about yours.
Two UAE details that change the price
VAT applies, including from free zones. The standard rate is 5 percent. A common belief is that a free zone supplier charges none. For services that is wrong. Under Article 51 of the VAT Executive Regulation, a service supplied in a designated zone counts as supplied inside the country, and the company counts as based inside it too. Designated zone status covers goods, not services.
Check the trade licence. There is no national website that lists every UAE company. Licences are checked with the authority that issued them, and each emirate and free zone has its own authority. Ask which authority licensed the agency, and check with that authority.
How to run the meeting
Ask the twelve questions in order. Write the answers down as they are given.
Then look at the answers rather than the proposal. A supplier who answers question 2 and question 9 well is usually safe. A supplier who cannot answer either is selling you the build and leaving you to pay for everything after it.
If you would rather go through the twelve questions with someone, our custom software team answers them in writing before any contract is signed. If you have not decided whether to build software at all, that is a different question, and the answer is often no.
