Sovereign AI UAE: what the government MDASH rollout tells companies
Zeta42 · 19 October 2026
Microsoft, Core42 and the UAE Cyber Security Council are rolling out AI code scanning in government. Here is what it shows a company about where AI should run.
Sovereign AI UAE projects are moving from announcements to adoption, and a government security rollout shows what that looks like in practice. According to Intelligent CIO Middle East, Microsoft, the UAE Cyber Security Council, Core42 and Open Innovation AI are moving Microsoft's MDASH, an AI code-scanning system, into a new phase across UAE government entities.
What MDASH does and how the rollout works
MDASH uses more than 100 specialised AI agents to find weaknesses in software and to judge whether an attacker could exploit them. It uses several AI models to validate what it finds and to rank which fixes come first. The new phase covers pilot deployments, technical workshops, onboarding and implementation support, which Intelligent CIO describes as a move from availability to adoption.
The rollout extends the National AI Test and Validation Lab, which was set up earlier this year with the Cyber Security Council and Open Innovation AI. The lab is hosted in the UAE under Council governance. Core42, a G42 company, supplies sovereign infrastructure and onboarding support, Open Innovation AI handles the technical integration into the lab, and Microsoft provides technical expertise and implementation guidance. The partners have not said how many government entities are taking part or when wider deployment will finish.
Why sovereign AI in the UAE starts with where the work runs
The arrangement matters more to a buyer than the tool. Source code is among the most sensitive material an organisation holds, and this rollout places the AI that reads it inside a lab hosted in the UAE, under local governance, on sovereign infrastructure. A company can borrow the order of thinking: decide what data the AI will see, then decide where it is allowed to run.
Few companies will run a national lab, but the same questions apply at a smaller scale. If you want AI to read contracts, customer files, internal reports or code, someone has to say where those documents are processed, who governs that environment and how you would check it.
What a company can take from the rollout
- List the documents and systems the AI would touch, and mark the ones that must stay in the UAE. That list decides the hosting choice.
- Begin with pilots and training. The government phase opens with pilots, workshops and onboarding, which gives staff time to learn a tool before anyone depends on it.
- Name the owner of the environment. In this case the Cyber Security Council guides adoption; a company needs a named person or team who answers for where its AI runs.
Where on-premise AI fits
Zeta42 runs AI models on premise for clients with data residency needs, on desk-side AI computers that hold and run real models on the client's own network, so nothing leaves the building. Where the cloud is fine, we say so: on-premise costs more up front and earns it back only if the constraint is real. Our AI infrastructure work starts by sorting a company's data into what can sit in a sovereign cloud and what should stay on its own hardware.
The MDASH rollout is a government programme, and its details differ from a private company's needs. It does show that UAE organisations handling sensitive material are choosing UAE-hosted, locally governed infrastructure for AI, and treating a pilot as the first step.
Common questions
- What does sovereign AI mean for a UAE company?
- It means the AI, and the data it reads, run on infrastructure hosted in the UAE under governance you can point to. In practice it settles where documents are processed and who can reach them.
- Does a company need on-premise AI to keep data in the UAE?
- Not always. Where the cloud is fine, Zeta42 says so. On-premise costs more up front and earns it back only if the data constraint is real.
- How should a company start with AI on sensitive data?
- Pilot on one department's documents, on infrastructure you control, and list what the data requires before a wider rollout.
Source: intelligentcio.com