App development cost Dubai: why we won't quote a range

UAE PASS, the federal digital identity a Dubai consumer app is routinely expected to support, documents a four-phase onboarding process with two formal assessments and video recordings of every tested scenario — and publishes no turnaround time at all. That is the short version of why there is no honest app development cost dubai figure, and why this page does not invent one. What moves the number is a list of market-specific obligations, most of which are calendar time before they are code.

Be clear about where we are standing. Creuto has shipped mobile and platform work for clients in India, the UK and the US, and we exhibit at GITEX Global in Dubai, but we are not reporting completed UAE delivery here. Everything below is read off the public rules: the UAE PASS developer documentation, the Central Bank rulebook, a Dubai Health Authority policy, the VARA rulebook, and Apple's and Google's own docs. Where we read between the lines, we say so.

Why we won't publish an app development cost dubai range

Search this query and you get price tables: a simple app at one band, mid-complexity at another, enterprise at a third. Open the pages and look for the source of those bands. There isn't one. They are not survey data, not published rate cards, and not derived from any disclosed sample of projects.

We could produce our own table in ten minutes and it would rank about as well as theirs. We won't, because a figure with no provenance is worse than no figure: it anchors your budget to someone's guess and survives in your board deck long after you have forgotten where it came from.

There is a real argument on the other side, and it deserves its strongest form. A buyer who has never commissioned software has no prior at all. A rough band, even a badly sourced one, tells them whether this is a conversation about tens of thousands or hundreds of thousands. A page that refuses to give one is, from that buyer's point of view, refusing to help.

The band does not fail at the level of precision, though. It fails at the level of what it is counting. Two Dubai quotes for the same product brief can differ by a multiple because one assumes you already hold a UAE PASS integration and a merchant acquiring relationship, and the other assumes it has to get you both. No range distinguishes those cases, and that distinction decides your number. For the general shape of how mobile scope converts into effort, our breakdown of what it costs to build a mobile app in 2026 works through the variables without pretending a market-specific figure falls out of them.

UAE PASS is calendar time before it is engineering time

This is the driver a generic estimate never contains, and the one most likely to move your launch date. The UAE PASS service provider onboarding documentation sets out four phases — Initiation, Development, Assessment and Go-live — and most of the work in them is not yours to compress.

In the initiation phase you raise the request through the UAE PASS Developer Portal and declare whether the entity is government or private. A private entity is then asked for a valid UAE trade licence, and which onboarding team you deal with depends on the emirate you are registered in. You submit a completed questionnaire per feature — authentication, digital signature, e-Seal, hash signing and data sharing authorisation are listed separately — plus a workflow diagram of the user journey and UI wireframes for each journey. Only then does the onboarding team evaluate and approve the use case, and the documentation warns that a use case deviating from the prescribed guidelines needs management approval, which "may extend the overall processing time".

It does not stop there. Staging credentials arrive with a Service Provider Agreement to sign. You integrate against staging, then UAE PASS schedules an assessment session, with a second round if issues are found. Before go-live you share video recordings of every scenario you tested, those recordings go to management for approval, and the signed agreement has to be in first. Go-live needs a feature-specific form, after which production credentials are issued and a production assessment is run.

Here is where we disagree with most of what is written about this. Agency posts circulate a two-to-six-week approval window. We could not find that figure, or any figure, in the issuing body's documentation — UAE PASS publishes a process, not a service level. The honest planning assumption is not a number of weeks but a shape: two assessment gates and at least one management approval between you and production, each with a queue you do not control, and another if your use case is non-standard.

One correction to a common misreading: not every UAE PASS feature is open to every entity. The documentation distinguishes availability by entity type, so a private company's feature set is not a government department's. Check what your use case qualifies for before you scope screens around it.

Payments: who needs the Central Bank licence, and who does not

Applying a rule to the party it exempts is the commonest error in this genre, and payments is where it happens. The Central Bank of the UAE's Retail Payment Services and Card Schemes Regulation (C 15/2021, in force from 6 June 2021) lays down licensing for what it calls nine categories of retail payment service, including payment account issuance, payment instrument issuance, merchant acquiring, payment aggregation, fund transfers, payment token services, payment initiation and payment account information services. Card schemes need their own licence.

Read the exclusions and the picture for a product team changes. The regulation does not apply to "services, provided by any technical service provider that supports the provision of any payment service, but does not at any time enter into possession of any money under that payment service", nor to processing or storing data, nor to authentication services. In plain terms: integrating a licensed gateway is normally not a licensable activity for you or for us. Holding user funds, aggregating merchant settlement or initiating payments on a user's behalf is a different product, and it needs a Central Bank conversation before it needs a sprint.

What this costs you is gateway choice, and that is not a line item you can defer. It sets card routing, settlement timing, whether recurring billing is native or has to be rebuilt as scheduled tokenised charges, and what refunds and chargebacks look like. Apple Pay is part of the same decision: Apple lists the United Arab Emirates among the regions where Apple Pay is supported, so UAE users expect it, but offering it depends on your processor supporting it in-market. Choosing the gateway late means repricing the payments work after the budget is agreed.

Arabic is a layout problem, not a translation line item

Quotes that treat Arabic as a per-word translation cost have mispriced the work. Right-to-left is a layout inversion touching every screen. Android's guidance on supporting different languages tells you to declare android:supportsRtl="true" on the application element, target API level 17 or higher, and convert every left and right in your layout resources to start and end. Where both are defined, start and end win — which is why a half-converted layout produces screens that pass review and break in Arabic.

The cost sits where automatic mirroring does not reach: directional icons, custom drawing and charts, swipe gestures, timeline components, mixed-direction strings where an Arabic sentence contains a Latin product name, and every piece of content your CMS now holds twice. None of that is translation. It is design, implementation and a second full QA pass, and a quote that does not say which of the three it includes is not comparable with one that does.

Data residency can rule out your cheapest hosting option

Where your data lives is a sector question in the UAE, not a preference. The clearest statement we found comes from the issuing body rather than a summary of it. The Dubai Health Authority's Telehealth Policy (DHA/HRS/HPSD/HP-20, issued 16 August 2021, effective 22 August 2021) states at clause 4.1.7 that "it is not permitted to store, develop, or transfer data and health information outside the country that is related to health services provided within the country, except in cases mentioned in Article no. (2) of the Ministerial Decision no. (51) of 2021".

Note the word develop. Read plainly, that reaches past the production database to anyone proposing a staging environment in a cheaper region, or a managed service with no UAE region. The federal law behind it applies broadly: the UAE government's own portal states that Federal Law No. 2 of 2019 regulates ICT use in the health care sector including its free zones, so a free-zone structure is not an exit from it.

The same policy stacks obligations that each carry an engineering cost: National Electronic Security Authority cyber security standards, Telecommunications and Digital Government Regulatory Authority requirements for the VoIP channel used in teleconsultation, Dubai Electronic Security Center requirements, and Dubai Health Insurance Corporation requirements for approvals, e-claims and documentation. In this sector the hosting and call-infrastructure decisions are both constrained before anyone opens a design file.

One caveat we will not paper over. The copy of that policy published on the DHA site carries a revision date of 16 August 2026, which has now passed. Treat the clause numbers above as what the published version says, and confirm against DHA before relying on them.

Sector licensing: DHA, VARA and where DIFC sits

Three regulators change the shape of a build, and which one you face is decided by what your app does rather than where your company is registered.

For health, the DHA Telehealth Policy applies to all DHA-licensed professionals and facilities providing telehealth services and requires at clause 4.1.2 that all telehealth services and platforms are licensed by DHA. The published policy lists the licensing areas as call centre, telebooth and add-on services. That is worth flagging: widely-cited summaries of the earlier 2019 telehealth standard describe different categories, including a standalone telehealth centre and a telehealth platform. The 2021 policy is the later document and the one on the DHA site, so get your classification from DHA rather than from a note about the previous instrument.

For anything touching virtual assets, the Virtual Assets Regulatory Authority rulebook describes VARA as the sole authority regulating virtual assets across Dubai's free zones and mainland, except within the jurisdiction of the Dubai International Financial Centre. That exception is the point: a DIFC-domiciled firm answers to the DFSA instead, and the two regimes do not produce the same evidence pack. VARA's Regulations on the Marketing of Virtual Assets and Related Activities 2024 took effect on 1 October 2024 and replaced the 2022 administrative orders, putting in-app promotional surfaces, risk warnings and educational content in scope, not only trading screens. That is a build cost, because someone has to own a review loop for every string.

Our read of the Dubai agentic AI mandate and what actually binds you works through who a published Dubai digital obligation binds and who it exempts. That is the question to ask of every regulator on this list.

What actually makes two quotes incomparable

Everything above is knowable before you commission anything. What buyers are rarely told is that the quotes themselves measure different objects. These questions separate them, and the answers are worth more to you than any number.

Ask this	Why the quotes differ	What a cheap quote usually assumes
What exactly is handed over at the end?	Handover can mean a binary, or source plus infrastructure-as-code, runbooks, environment config and a working CI pipeline.	A running app, with the build and deploy knowledge staying with the vendor.
Who owns the repository and the cloud accounts?	Ownership decides whether you can change supplier without a rebuild.	Vendor-owned repo and vendor-owned project, transferred later for a fee.
Is maintenance in or out?	OS releases, SDK deprecations and store policy changes arrive whether or not you planned for them.	Out of scope, quoted as a monthly retainer after you have signed.
Who submits to the stores after launch?	Post-launch submissions, review responses and expedited requests recur; they are not a one-off task.	The first submission only.
Does the price assume you already hold the integrations?	UAE PASS onboarding, merchant acquiring and a sector licence are prerequisites with their own calendars.	That you hold them, or will obtain them yourself in parallel.

The store question is the one most often waved away, and the one that recurs. Submission is not a single event: policy changes, rejected builds and release-timing pressure keep coming back, and knowing what Apple actually accepts for an expedited review is a capability someone owns after launch. If the quote does not name it, it is yours.

Scope the integration prerequisites as a separate workstream with its own start date, because that is what they are. The practice page for our mobile app development in Dubai work sets out how we engage, and our mobile app development service page covers delivery; we would rather talk through which drivers apply to your product than send you a number we cannot stand behind.

So change the question you ask a supplier. Not "what does an app cost in Dubai", which has no answer, but "which of UAE PASS, a licensed payment route, Arabic right-to-left, data residency and a sector approval does this quote assume I already have?" The supplier who answers that cleanly is the one whose number means something.