Many suppliers now sell "AI". You still have to decide where to use it first in a business that works in Arabic and English, holds customer phone numbers and addresses, and sends invoices across borders. Start with one process that costs your team time every week, not with a tool.
This article gives five starting points, each with the data that goes in, what can go wrong and who checks the result. It then covers how to test Arabic quality, which personal data rules to ask about in the UAE, Saudi Arabia and Bahrain, and a pilot plan that ends in a decision. Pages were read on 4 November 2026.
Start with one process, not a tool
Choose a task that repeats often, has a clear right answer and costs little if one result is wrong. Answering "where is my order?" fits. Deciding who gets a refund does not. Pick one a person does today, so that person can spot wrong output.
Keep two ideas apart. Automation follows rules you write, such as tagging every order from one city. AI produces an answer from patterns, so it can be wrong in ways a rule never is. Use a rule where a rule will do. If your data still lives in spreadsheets, read our article on moving from spreadsheets to one system first. Whether you build in house or use AI and automation support, the steps below stay the same.
Five places to start
- Customer support triage and drafts. In: customer messages, order status and your policy text. Wrong: a draft promises a refund or delivery date you did not approve, treats an angry message as routine, or answers in a tone or dialect that does not fit. Check: a support lead reads every draft before it goes out during the pilot, and reviews a sample of the labels each week. If customers write to you on WhatsApp, see WhatsApp orders for a Gulf Shopify store.
- Arabic and English product content. In: the product facts you supply, such as materials, sizes and care, plus notes on your brand voice. Wrong: the tool adds claims you never gave it. Shopify's own help page uses a T-shirt example where generated text could call the shirt machine washable. Check: the product owner checks every fact against supplier data, and a native Arabic reader checks the Arabic. Arabic and English on one store covers the store side.
- Document and invoice data capture. In: supplier invoices, delivery notes and receipts, which can show bank details and tax numbers. Wrong: a misread digit, date or total, or a page that mixes Arabic and English. Check: accounts staff compare total, date and tax number with the paper, and a list of uncertain items catches what the tool is unsure about. If the data then flows into your books, see connecting Shopify to ERP and accounting.
- Internal search. In: policies, price lists, manuals and perhaps contracts. Wrong: the tool shows a file to someone who should not see it, quotes an old version, or invents an answer when nothing matches. Check: the document owner. Ask for the source file with every answer, and test with questions whose right answer is "not in our documents".
- Reporting summaries. In: sales and order figures exported from your store or accounts. Wrong: the summary names a trend the numbers do not support, or mixes currencies or dates. Check: the person who owns the figures recalculates two or three of them from the source before the summary goes out. Reporting for a Gulf online store lists the weekly numbers worth summarising.
Arabic quality: test it, do not assume it
Do not assume that a tool that works well in English works as well in Arabic, or in your customers' dialect. In a preprint posted on arXiv on 31 October 2025 (the page does not say it was peer reviewed), researchers tested 19 open-weight language models on questions in Syrian, Egyptian, Emirati, Saudi and Moroccan dialects. They report that scores fall on the dialects compared with Modern Standard Arabic and English, a trend they say holds across the Arabic-enabled models they evaluated. The models were small (roughly 1 billion to 13 billion parameters), so the study cannot tell you how your tool will behave. It shows what to test.
Vendors also differ on which languages each feature supports. Microsoft's language support page for its Document Intelligence prebuilt models (footer dated 5 May 2026) lists languages model by model, and several models, such as its bank statement and contract models, list English only. Shopify's help pages say that availability of AI features can depend on plan, device and language, and that you stay responsible for the accuracy of text you publish. Ask each supplier for the current language list for the exact feature you plan to use, then run your own test.
A simple Arabic test:
- Collect real examples from your own business, not invented ones. Include messages in the dialect your customers use, mixed Arabic and English text, product names in Latin letters inside Arabic sentences, and numbers written with both Western and Arabic-Indic digits.
- Decide what "good" means before you test: the meaning is right, the tone fits, no facts are invented and your product terms are used.
- Ask a native reader from your market to score the results without knowing which tool wrote them.
- Repeat the test when the supplier changes the model or you change the instructions you give it.
Personal data: where it goes and which rules to ask about
Many of these tools send your text to a server you do not run, so a customer's name or order in that text is personal data you are sending. Put these questions to each supplier in writing:
- In which country is our data processed and stored?
- Is our data used to train or improve models, and can we switch that off?
- How long is it kept, and how do we delete it?
- Which people and which other companies can see it?
- What will you tell us if there is a breach, and how fast?
This is what the texts opened for this article say.
- UAE. The UAE legislation portal publishes an English text of Federal Decree-Law No. 45 of 2021 on personal data protection. It says controllers and processors must adopt security measures that fit the risk. A controller must notify the regulator of a breach within time limits set in executive regulations. It allows transfers abroad in listed cases, such as a destination with adequate protection or a binding contract. It gives people a right to object to decisions made by automated processing, with exceptions such as a contract or consent, and says the controller must have a person review an automated decision when the person asks. Ask your adviser which executive regulations are in force.
- Saudi Arabia. The official law text could not be opened for this article, so these points come from SDAIA's guide to the Personal Data Protection Law (version 1.0, December 2023), which says it is not binding. The guide says the law came into force on 14 September 2023. It says the law covers processing in the Kingdom and processing of data about people who live there by parties outside it. In its example of a Saudi online store that uses a US cloud provider, it says the law still regulates the data. It lists a separate regulation on transfers outside the Kingdom without describing it, so read that regulation or ask an adviser.
- Bahrain. Law No. 30 of 2018 on personal data protection, in the Ministry of Legal Affairs' English guidance text (the Arabic text prevails), generally bars sending personal data outside the Kingdom. Exceptions include countries the authority lists, case-by-case approval and some other cases such as consent (Articles 12 and 13 in that text). Article 8 asks for a written contract with any processor that handles data for you. If you plan to use a foreign AI service, ask your adviser how these articles apply and whether the law has been amended.
- Qatar, Oman, Kuwait and Iraq, including the Kurdistan Region. This article did not review official texts for these places. Ask a local adviser which data protection and AI rules apply, and whether your sector regulator adds its own.
What the government papers say
A UAE Cabinet news page dated 21 April 2019 reports that the Cabinet adopted the National Artificial Intelligence Strategy 2031. The u.ae page on the UAE Charter for the Development and Use of AI, shown as updated on 3 July 2026, lists twelve priorities, including data privacy and human oversight. It does not say whether the charter is binding. SDAIA's AI Ethics Principles (version 1.0, September 2023) say they apply to public, private and non-profit bodies that develop or use AI systems in the Kingdom. They set seven principles and four risk levels, and they ask for human oversight where outcomes are hard to reverse. SDAIA may have issued a newer edition, so check its site for the current text.
Use these papers as a checklist, not a legal test: keep a named person in charge, limit the personal data you send, and be able to explain what the tool did.
A pilot plan: measure, review, decide
The US NIST's AI Risk Management Framework is voluntary and groups its work into four functions: govern, map, measure and manage (NIST page updated 10 June 2026; version 1.0 released 26 January 2023). A pilot in a small business can follow the same shape.
- Pick one process and one owner. Write down who does the task today and what a good result looks like.
- Measure before. For a set period, record volume, minutes per item, errors found and customer complaints. Without this you cannot say later whether anything improved.
- Write the rules. List what data may go in, what must never go in, and what the tool may do. In the pilot it drafts and a person sends.
- Build the test set. Use real examples, including Arabic ones, and set the pass mark before you see any results.
- Review every output. Log each correction by type: wrong fact, wrong tone, wrong language, missing data.
- Compare with the baseline. Count the time spent on review, not only the time saved on drafting.
- Decide in writing. Stop, change the setup, or extend it to a larger share of the work, and set a date to review again.
This is general information, not legal or tax advice. Check the current rules or ask a qualified adviser before you decide.
If you would like help with this, ESTASOFT offers AI and automation. Send a short brief on the contact page. If your tools will touch customer data, security review for a Gulf business website is a useful next read.
Sources
- UAE Cabinet adopts National Artificial Intelligence Strategy 2031: date shown on the news page, 21 April 2019 (checked 4 November 2026)
- The UAE Charter for the Development and Use of Artificial Intelligence (u.ae): twelve priorities, human oversight, page updated 3 July 2026, binding status not stated (checked 4 November 2026)
- Federal Decree by Law Concerning the Protection of Personal Data (UAE legislation portal): English text: security, breach notice, transfers abroad and automated decisions (checked 4 November 2026)
- AI Ethics Principles, version 1.0, September 2023 (SDAIA): scope, seven principles, risk levels and human oversight (checked 4 November 2026)
- Guide to the Saudi Personal Data Protection Law for controllers and processors (December 2023): entry into force, scope and the US cloud example, from a non-binding guide (checked 4 November 2026)
- Law No. 30 of 2018, Personal Data Protection Law (Bahrain Ministry of Legal Affairs, English guidance translation): transfers abroad, security and processor contracts, English guidance text (checked 4 November 2026)
- NIST AI RMF Playbook: four functions, voluntary use, release and update dates (checked 4 November 2026)
- DialectalArabicMMLU: Benchmarking Dialectal Capabilities in Arabic and Multilingual Language Models (arXiv): dialect test results for 19 open-weight models, posted as a preprint (checked 4 November 2026)
- Language and locale support for prebuilt models (Microsoft Learn): languages listed model by model, English only for several models, footer dated 5 May 2026 (checked 4 November 2026)
- Automatically generating content in the online store editor (Shopify Help Center): owner responsible for accuracy, T-shirt example (checked 4 November 2026)
- AI-powered tools (Shopify Help Center): availability varies by plan, device and language, and outputs can contain errors (checked 4 November 2026)