If you are the engineer in the room when your company shortlists an app development company in Dubai, your job is not to be impressed by the portfolio. Your job is to find the failure modes before they cost six figures in AED. Sales decks are optimized to survive exactly the questions non-technical buyers ask, which is why the useful due diligence starts where the deck ends. This is the checklist I'd run — grouped by what it actually protects.
One framing note before the list. The biggest shift in this evaluation since 2023 is AI. A large share of what a modern app does — in-app assistants, natural-language search, document understanding, personalization — now ships by integrating a foundation model rather than being hand-built. That collapses the cost of some features and moves engineering effort into data pipelines, evaluation, and guardrails. So half of due diligence in 2026 is checking whether a Dubai firm understands that shift, and half is the timeless stuff: QA, IP, security, and who actually writes your code.
1. Verify the code, not the case study
Portfolios are curated; shipped software is not. Make the firm prove delivery you can independently inspect.
- Get live App Store and Google Play links to apps they built, then check ratings, recent review sentiment, and update cadence yourself. An app last updated in 2022 is telling you something.
- Ask for a reference call with a client whose project matches yours in size and domain — and ask that client specifically what went wrong and how the firm handled it.
- Request a redacted architecture diagram from a past build. Fluency here is hard to fake; hand-waving is easy to spot.
- Confirm which legal entity signs the contract and where the engineers physically sit. "Dubai firm" can mean a local studio, a blended UAE-plus-offshore team, or a phone number in front of pure offshore delivery — all valid, but you must know which.
2. Interrogate the QA and release pipeline
This is where cut corners hide, because testing is invisible until it isn't.
- Have them walk you through automated testing, device-matrix coverage, TestFlight and staged rollouts, and crash and performance monitoring. Vague answers here predict buggy launches.
- Ask how they handle phased rollouts and rollback when a release regresses in production.
- Ask what their crash-free-session target is and how they measure it. A real number signals a real process.
3. Pressure-test AI capability with a scenario
Do not accept "we use AI" as an answer. Give them a concrete problem and listen to the shape of the response.
- Pose a specific scenario: "How would you add an Arabic-and-English in-app support assistant?" A capable team talks about retrieval, evaluation harnesses, hallucination and latency measurement, fallbacks for when the model is wrong, and cost control. A weak one says "we'll use ChatGPT."
- Ask which features they'd deliver with a model versus build traditionally, and why. The reasoning matters more than the answer.
- Ask to install a live app they shipped with AI inside it. Working software beats a slide titled "AI Capabilities" every time.
- Confirm they treat prompts and retrieval as versioned, tested assets — not strings pasted into a config once and forgotten.
4. Nail down data protection and cross-border flow
The UAE is not a compliance-light market, and this is where offshore-only teams most often stumble.
- Confirm they understand the UAE Personal Data Protection Law (PDPL): consent, purpose limitation, and cross-border transfer obligations.
- Ask specifically how AI features stay compliant. The instant user content goes to a third-party model provider, you have a cross-border data flow and a processor relationship the PDPL cares about. The right answer includes data minimization before anything leaves your environment, regional model endpoints where available, and records of what is processed where.
- For fintech or health apps, confirm awareness of the additional Central Bank, DFSA/ADGM, or health-data obligations layered on top.
5. Lock ownership and continuity in writing
Two contract terms protect you more than any SLA.
- Confirm unconditional source-code and IP ownership, with handover written in so you can leave with the full repository at any time. Resistance here is a walk-away signal.
- Meet the actual engineers and product manager assigned to your account — not just the sales lead — and get commitment that they won't be reassigned to a bigger client mid-build. Team continuity is the strongest predictor of a smooth delivery.
6. Sanity-check the AED budget
Use market ranges to spot both padding and dangerous discounts.
- A polished single-platform MVP typically runs AED 90,000 to AED 250,000; a full cross-platform consumer app AED 250,000 to AED 600,000; enterprise or regulated builds beyond AED 600,000, usually as an ongoing engagement.
- If a quote sits ~60% under the others, find what was removed — it is almost always QA, security review, or senior oversight.
- If intelligent features are still priced like bespoke research projects, the firm hasn't updated its cost model for AI. That's padding.
Insist on a paid discovery sprint before the main build. A short, well-run discovery produces a clickable prototype, a technical architecture, and a realistic estimate — the cheapest insurance against a six-figure misunderstanding. For the full buyer-side framework, TechCirkle's guide to choosing an app development company in Dubai is a solid reference, alongside their mobile app development and AI development services pages.
Frequently Asked Questions
What's the single most revealing due-diligence question?
"Show me a live app you built with AI inside it, and walk me through how you made it reliable." It forces the firm off marketing language and onto engineering specifics — retrieval, evaluation, guardrails, fallbacks, cost. Teams that can answer have shipped real AI; teams performing AI theater can't produce the installable proof.
How do I check QA capability without seeing their code?
Ask process questions with numeric answers: crash-free-session target, device-matrix coverage, staged-rollout and rollback strategy, and how they monitor performance in production. Firms with mature pipelines give concrete figures and named tools; firms without one deflect to reassurances. The specificity of the answer is the signal.
Does the PDPL really affect AI features?
Yes, directly. Sending user content to a third-party model provider creates a cross-border data flow and a processor relationship the UAE Personal Data Protection Law governs. A capable Dubai team designs for it: minimize data before it leaves your environment, prefer regional model endpoints, and keep records of what is processed where. Treat "we hadn't considered that" as a red flag.
Why insist on source-code ownership in the contract?
Because it's your leverage. Unconditional ownership of the repository and IP, with handover written in, lets you change vendors, pass technical due diligence for funding, or exit a bad engagement without rebuilding from scratch. A firm that resists or obscures this is prioritizing lock-in over your interests, regardless of price.
How do I use AED ranges during vetting?
As a two-sided filter. A quote far above the AED 90k–600k+ bands may be padding — especially if intelligent features are priced as bespoke research rather than model integrations. A quote far below usually means QA, security review, or senior oversight was quietly cut. Normalize scope across bids before comparing totals.
Is a paid discovery sprint worth it?
Almost always. A short, well-run discovery yields a clickable prototype, a real architecture, and a defensible estimate before you commit the main budget. It surfaces misunderstandings while they're cheap to fix. Vendors who push for a fixed all-in quote with no discovery are optimizing to sign you, not to ship you.
