App Development

Who Actually Owns Your Code? UAE Copyright Law and the Clause Most Contracts Are Missing

SKIMBOX Team

Paying for software is not the same as owning it. UAE law requires a written assignment that names the right, the purpose, the duration and the place, and says the developer keeps everything not expressly transferred. Many contracts do not do that.

Who Actually Owns Your Code? UAE Copyright Law and the Clause Most Contracts Are Missing

A UAE business pays an agency to build an app. The invoice is settled, the app is live, and the business assumes it owns the software it just funded. That assumption is not supported by the law that applies to it.

UAE copyright law provides that a transfer of economic rights must be in writing and must specify the right transferred, its purpose, its duration and its place of use. The same provision states that the author retains any right not expressly assigned [1]. Paying an invoice does not do that. Holding the only copy does not do that. Having your company name on the app store listing certainly does not do that.

This article sets out what the statute actually says, and it is careful about the difference between what we could establish from the primary text and what we could not. Two sibling pieces cover the operational half of ownership: the accounts and keys your business must hold and how to change development agency.

This is not legal advice. It is a description of what the law publishes, written by people who build software. Take your own position to a qualified UAE lawyer.

Yes. Federal Decree-Law No. 38 of 2021 on Copyright and Neighbouring Rights runs to 53 articles and explicitly covers computer programs and applications as protected subject matter [1]. Protection arises automatically on creation rather than depending on registration, and registration where available serves an evidentiary purpose rather than creating the right [1]. The law text is also published through WIPO's legislative database [2], and the Ministry of Economy is the federal body responsible for intellectual property administration [3].

That last point cuts in an uncomfortable direction. You did not need to register anything to be protected. Neither did the developer who wrote your software. Their rights existed from the moment the code was typed, whether or not anyone filed a form.

Who is the author, and why that is the wrong question to stop at

The default author is the person who created the work, unless the statute's own attribution rules or a written agreement move that attribution elsewhere [1]. So the starting position is that the rights sit with whoever wrote the code.

The law then provides a set of default rules for the author's economic rights in relation to third parties, and the whole provision opens by saying it applies unless otherwise agreed in writing [1]. That single phrase is the most load-bearing thing in this entire subject. It means the statutory defaults are a fallback, and your contract is what actually governs.

The employee rule, and the gap where an agency should be

For your own employees, the law provides a default that generally favours you. Where an employee or worker creates a work during employment that relates to the employer's activities or business and was directly or indirectly mandated by the employer, or was created using the employer's expertise, information, tools, machinery or materials, the economic rights are attributed to the employer, taking the worker's intellectual effort into account [1]. The mirror case is also covered: an employee's work unrelated to the employer's business and made without the employer's resources stays with the employee [1].

Now the part most articles on this subject get wrong.

Those clauses are written about an employee or worker during his employment. The words contractor, agency and commissioned do not appear anywhere in the statute's 53 articles. We checked the full text. There is a separate, broader clause providing that where an author makes an innovation in favour of another person, the copyright is attributed to that person [1], and read literally that could describe a commissioning relationship. But the English translation is ambiguous, it is not tied to employment on its face, and we found no official UAE interpretation of how it applies to an external supplier as opposed to a member of staff.

So we are not going to tell you that UAE law automatically hands a client the copyright in agency-built software. It might. We cannot establish it from the primary text, and this is precisely the question a business hiring an external developer needs answered. Put it to a qualified UAE lawyer.

What follows from the uncertainty is the practical answer, and it is a clean one. Do not rely on a default rule that may not apply to you. Get the written assignment.

What a written assignment must contain

The law is specific. A transfer of economic rights must be in writing and must specify the right transferred, its purpose, its duration and its place of use, and the author retains any right not expressly assigned [1].

Read that as a checklist rather than as prose. Four particulars, named. And a default that everything unmentioned stays with the developer.

Whether a short clause saying intellectual property transfers on final payment satisfies that standard is a drafting question we are not qualified to answer, and we are not going to guess at it in an article that businesses might rely on. What we can say is that the requirement is specific enough to be worth having checked rather than assumed, and that contracts often describe what will be built in great detail and what will be owned in a single sentence.

Moral rights, which you cannot buy

The law states that the author's moral rights are not subject to prescription or assignment [1]. They include first publication of the work, attribution of the work to its author, and objecting to modification [1]. So these are not available for purchase in the way economic rights are.

The statute addresses assignment. It does not address waiver, which is a different mechanism, and we could not establish whether a clause purporting to waive moral rights would be effective here. That is an open question rather than a settled one.

One genuinely unusual detail is worth knowing. The moral right to have a work recalled from circulation is expressly carved out for smart applications, software and software applications [1]. UAE law treats an author's position in software differently from other creative works on that specific point.

The subcontractor chain, which nobody checks

Your supplier can only assign rights they actually hold, so a break anywhere in the chain behind them leaves rights sitting with somebody you have never met.

This is the failure mode that survives even a well-drafted contract. Suppose your agency signed a proper assignment transferring the rights to you. If part of the work was done by a freelancer or a subcontracted studio, and that supplier never took a valid written assignment from them, your agency may have transferred rights it did not fully hold. The chain has a break in it several links back, and nothing in your own paperwork reveals it.

The law does not help you here. It requires the written, specific assignment at each transfer, and the author retains what is not expressly assigned [1]. A break anywhere in the chain leaves rights sitting with whoever wrote that part.

Two practical questions are worth asking before final payment, and they are reasonable questions rather than accusations. Was any part of this work performed by anyone other than your own employees? And do you hold written assignments from each of them covering the work delivered to us? A supplier running a normal subcontracting model will have thought about this. One who has not will tell you so by hesitating.

There is a related point about version history. History records who wrote what and when, which is occasionally the only available evidence of who contributed to a codebase. That is a second reason to insist on the repository rather than an export, beyond the practical value to a future developer.

Access is possession and assignment is title, and they are secured by two entirely different mechanisms.

You can hold full administrative access to every repository, every environment and every account, and still not hold the economic rights in the code, because those move only by a written assignment meeting the requirements above. Access is possession. Assignment is title. They are secured by two entirely different mechanisms, and it is common to have carefully arranged the first while assuming the second came with it.

The reverse is also true and slightly cheering: a valid assignment does not become worthless because a supplier is being difficult about access. Those are separable problems with separable remedies.

A pattern we see. A business asks for the source code at the end of a project, receives a zip file, and considers the matter closed. What it actually holds is a snapshot with no history, no build instructions, no dependency list, and no assignment clause naming any of the four particulars the law requires. Everything looked complete. Nothing was.

What delivery of source code should actually mean

Ask for these, and ask before the final payment rather than after it:

  • Repository access with its history, not an export. History tells a new developer why the code is as it is, which change introduced a defect, and what was tried and abandoned
  • Build and deployment instructions that somebody other than the author has followed successfully
  • Environment configuration, and a map of where third-party credentials live
  • A dependency list with the licence attached to each component
  • Documentation of the decisions a newcomer would otherwise have to reverse-engineer

None of that is unreasonable and none of it is expensive for a supplier who has worked properly. The request itself is diagnostic.

The open source inside your product

Your software is almost certainly assembled partly from published components, which is normal rather than alarming. The licences attached to those components carry conditions, and the risk is never that open source is present. It is that nobody made a list.

The licences fall broadly into two groups. Permissive licences such as Apache 2.0 and MIT impose modest conditions, generally around retaining copyright notices and licence text [6][7]. Copyleft licences such as the GNU General Public License require that if you distribute software containing the component, you pass on the same freedoms, which in practice means making corresponding source available under the same terms [4].

The distinction that matters most for a hosted product is between the ordinary General Public License and the Affero version. The ordinary licence attaches obligations to conveying the software, so a business running modified code on its own servers may not trigger them. The Affero version extends the obligation to users interacting with the software over a network [5]. If you run a web product, which of the two you have is a materially different situation.

Whether obligations bite in your specific case depends on the specific licence and how your software reaches users. That is a question to have answered, not assumed, and it is answerable from a dependency list in an afternoon.

What getting it wrong costs

The statute sets out penalties for infringement, with fines running from AED 10,000 up to AED 1,000,000 depending on the offence [1]. We are quoting the statutory range rather than predicting any outcome, because what would happen in a particular case depends on facts only a lawyer could assess.

The cost that arrives most often, though, is not a penalty. It is a transaction going sideways.

The moment ownership actually gets examined is rarely a dispute with your developer. It is when somebody else needs to be satisfied: an investor doing due diligence, an acquirer, a bank, or an enterprise client whose procurement team asks you to warrant that you own what you are selling them. At that point somebody reads your contracts properly for the first time, and a missing assignment stops being an abstraction. It becomes a condition to be remedied before the deal closes, on a timetable you do not control, with a supplier whose cooperation you may no longer be able to assume.

That is the practical argument for fixing this while the relationship is good and nothing depends on it. The work is small. The same work under deal pressure is not.

There is no published figure for what it costs to fix a project where ownership was never assigned, because that is a legal-fees and rebuild question nobody publishes. What we can price is the technical half. A code and licence audit starts from around AED 2,500 with us, covering what is actually in the repository, the dependency tree, the licences attached to it, and what the handover is missing. These are our own figures rather than a market survey. Final pricing depends on the size of the codebase.

The legal half belongs with a lawyer, and we would be wary of any development company that offers you an opinion on your IP position as part of a sales conversation.

What to do, in order

  • Find your contract and read what it says about ownership, not about scope
  • Check whether it names a right, a purpose, a duration and a place, and get a UAE lawyer's view if it does not
  • If you never had an assignment, ask for one now, while there is still goodwill or a final payment outstanding
  • Inventory what you actually hold: repository, history, build instructions, dependencies, licences
  • Get the licence obligations in your dependency tree established before you next ship
  • On the next project, put the assignment in the contract before work starts, not in the handover

The most useful sentence in the whole statute is that the author keeps whatever is not expressly assigned [1]. It reframes the question from whether you paid to whether anybody wrote down, specifically, what was being transferred.

If you would like to know what is genuinely in your codebase before you take the legal question to a lawyer, contact us.

References

[1] UAE Federal Decree-Law No. 38 of 2021 on Copyright and Neighbouring Rights. uaelegislation.gov.ae

[2] WIPO Lex, United Arab Emirates copyright legislation. wipolex.wipo.int

[3] UAE Ministry of Economy, intellectual property. moec.gov.ae

[4] GNU General Public License version 3. gnu.org

[5] GNU Affero General Public License version 3. gnu.org

[6] Apache License version 2.0. apache.org

[7] MIT License. opensource.org

Frequently asked questions

  • If I paid for software, do I own it?

    Not automatically, and this is the single most expensive assumption in commissioning software. UAE copyright law provides that a transfer of economic rights must be in writing and must specify the right transferred, its purpose, its duration and its place of use. It also provides that the author retains any right not expressly assigned. Paying an invoice, holding the only copy, or having the app in your name does none of that on its own.

  • Which UAE law covers software copyright?

    Federal Decree-Law No. 38 of 2021 on Copyright and Neighbouring Rights. It runs to 53 articles and it explicitly covers computer programs and applications as protected subject matter. Protection is automatic on creation rather than dependent on registration, and registration where available is evidentiary rather than the source of the right. That means the rights exist from the moment the code is written, in somebody's hands.

  • Who is the author of software under UAE law?

    The person who created it, unless the statute's own attribution rules or a written agreement move that attribution elsewhere. That is the default position and it is the one that surprises buyers. The developer who typed the code is the starting point for ownership, and moving it requires either a statutory rule that applies to your situation or a written assignment that meets the law's requirements.

  • What does a valid assignment have to contain?

    Four things, per the law itself. A transfer of economic rights must be in writing and must specify the right being transferred, the purpose of the transfer, its duration and its place of use. The same provision states that the author keeps any right not expressly assigned. So a contract that says the developer will build an app, with no clause naming the rights transferred and those particulars, may not achieve what the client assumes.

  • Is a line saying IP transfers on payment enough?

    We cannot tell you that, and nobody honest can without reading your contract. The law requires the right, purpose, duration and place to be specified, and whether a short single sentence meets that standard is a drafting question for a qualified UAE lawyer rather than something an article can settle. What we can say is that the requirement is specific enough that a one-line clause is worth having checked rather than assumed.

  • What about work my own employee writes?

    The law has a default rule for employees that generally favours the employer. Where an employee or worker creates a work during employment that relates to the employer's business and was mandated by the employer, or was made using the employer's expertise, information, tools or materials, the economic rights are attributed to the employer, taking the worker's intellectual effort into account. That rule is expressly framed around employment.

  • Does that employee rule cover an external agency too?

    This is the honest gap and we are not going to paper over it. The clauses that create the employer default are written about an employee or worker during employment. The words contractor, agency and commissioned do not appear anywhere in the statute's 53 articles. A separate clause referring to work made in favour of another person is broader on its face but ambiguous in translation, and we found no official UAE interpretation of how it applies to an external supplier.

  • So how do I actually secure ownership from an agency?

    By getting a written assignment that meets the law's requirements, rather than relying on a default rule that may not apply to you. That is the practical conclusion of everything above. The employee default is not available to you when you hire an external company, and the broader clause is too uncertain to build a business on. The written assignment is the route that does not depend on an unresolved question.

  • Can the default rules be overridden by contract?

    Yes, and this is why the paperwork matters more than the statute. The provision setting out the author's economic rights in relation to third parties opens by saying it applies unless otherwise agreed in writing. That makes the entire default framework a fallback rather than a mandate. Whatever your contract says, if it is written and valid, is what will govern, which cuts both ways.

  • What are moral rights and can I buy them?

    Moral rights are the author's personal rights in the work, and the law states they are not subject to prescription or assignment. They include first publication, attribution of the work to its author, and objecting to modification. So you cannot purchase them the way you purchase economic rights. Whether they can be contractually waived, which is a different mechanism from assignment, the statute does not say.

  • Is there anything specific to software in the moral rights provisions?

    Yes, and it is a genuinely unusual detail. The moral right to have a work recalled from circulation is expressly carved out for smart applications, software and software applications. So UAE law treats an author's moral-rights position in software differently from other creative works on that specific point. It is a narrow carve-out rather than a general exclusion of moral rights from software.

  • I have full access to the repository. Does that mean I own it?

    No, and the distinction is worth internalising. Holding the repository is possession, not title. You can have full administrative access to every line of code and still not hold the economic rights, because those move only by a written assignment meeting the law's requirements. Access and ownership are two separate things, secured by two separate mechanisms, and businesses routinely secure the first and assume the second.

  • What should delivery of source code actually include?

    Repository access with its history rather than a zip file, build and deployment instructions, environment configuration, a list of third-party dependencies and where their credentials live, and documentation of the decisions somebody would otherwise have to reverse-engineer. A zip file of code with no history, no instructions and no dependency list is technically a delivery and practically an obstacle, and it is what most businesses are handed.

  • Why does version history matter?

    Because it is the difference between inheriting a codebase and inheriting a mystery. History tells a new developer why something is the way it is, which commit introduced a defect, and what was tried and abandoned. A zip file discards all of that. It also has an evidential quality: history shows who wrote what and when, which is occasionally useful if ownership is ever disputed.

  • What is open source doing inside my product?

    Almost certainly a great deal, and that is normal rather than alarming. Modern software is assembled from published components, and the licences attached to those components carry conditions. Most are permissive and impose little beyond attribution. A minority are copyleft and can impose obligations on what you distribute. The problem is never that open source is present, it is that nobody made a list.

  • What does a copyleft licence require?

    Broadly, that if you distribute software containing the component, you pass on the same freedoms, which in practice means making corresponding source available under the same terms. The GNU General Public License is the best-known example and its text is published openly. The obligations are triggered by distribution, so whether they bite depends heavily on how your software reaches its users.

  • What is the difference between the GPL and the AGPL?

    The Affero version closes what people call the network loophole. Under the ordinary General Public License, obligations attach to conveying the software, so a business running modified code purely on its own servers may not trigger them. The Affero version extends the obligation to users interacting with the software over a network. For a hosted product this is the more consequential of the two, so knowing which one you have matters.

  • Are permissive licences safe to ignore?

    They are much lower risk and still not nothing. Licences such as Apache 2.0 and MIT impose conditions that are modest but real, generally around retaining copyright notices and licence text. Ignoring them is a compliance failure even where the practical consequence is small. The reasonable position is a list of what you are using and what each licence asks, kept current, rather than either panic or indifference.

  • Does it matter if my software is never distributed?

    It matters a great deal for copyleft obligations, because distribution is generally the trigger. Software used purely internally sits in a different position from software shipped to customers or, under the Affero licence, made available over a network. That is a genuine and useful distinction. It is also the kind of question where the answer depends on the specific licence and your specific deployment, so get it looked at rather than assumed.

  • What happens if I use code I do not have rights to?

    The law sets out penalties for infringement, and the ranges are substantial. The statute provides for fines running from AED 10,000 up to AED 1,000,000 depending on the offence. We are quoting the statutory range rather than predicting an outcome, because what would actually happen in any particular case depends on facts a lawyer would need to assess. The point is that the exposure is not theoretical.

  • Do I need to register the copyright?

    Not to have the right. Protection arises automatically on creation, and registration where available serves an evidentiary purpose rather than creating the right. That is worth knowing because it cuts both ways: you do not need to register to be protected, and neither did the developer who wrote your software. Their rights existed from the moment the code was written, regardless of paperwork.

  • Is the position different in DIFC or ADGM?

    We could not confirm it either way from a primary source. Those zones operate their own legal frameworks in various areas, and there is commentary suggesting divergence on intellectual property, but the only sources we found for it were secondary commentary rather than the zones' own published law. If you are licensed in either, ask a lawyer who practises there rather than relying on the federal position.

  • Should I use a US-style work for hire clause?

    Importing that concept would misdescribe UAE law, so no. Work for hire is a doctrine of a different legal system, and the UAE statute does not use that terminology or the words contractor or commissioned anywhere in its 53 articles. A contract drafted around a foreign doctrine may not do what its author expects here. Have it drafted for the law that will apply.

  • What should I ask for before the final payment?

    A written assignment that a lawyer has looked at, the repository with its history, build and deployment instructions, a dependency and licence list, and confirmation that no component carries an obligation you have not accepted. The final payment is your only remaining leverage, so it is the right moment to ask, and a supplier who has done the work properly will not find any of it difficult.

  • My project is already finished and I never had an assignment. What now?

    Get the assignment executed now rather than deciding it is too late. A supplier on good terms will usually sign, particularly if there is ongoing work or a final payment outstanding. If the relationship has ended badly, take advice on your position, and in the meantime establish exactly what you hold: the code, its history, its dependencies and its licences. You cannot make a decision about a codebase you have not inventoried.

  • Does an audit tell me whether I own the code?

    It tells you what you have, which is the half of the question we can answer. A technical audit establishes what is in the repository, which third-party components are present, what licences they carry, and what obligations those licences create. Whether your contract validly transferred the rights is a legal question for a UAE lawyer. The two together give you an answer. Neither does on its own.

  • What does a code and licence audit cost?

    A code and licence audit starts from around AED 2,500 with us, covering what is actually in the repository, the dependency tree, the licences attached to it, and what is missing from the handover. These are our own figures rather than a market survey. Final pricing depends on the size of the codebase. The legal review of your contract is separate and belongs with a lawyer.

  • Can you tell me whether my contract is valid?

    No, and you should be wary of any development company that says it can. We are not lawyers and this article is not legal advice. What we can do is tell you what is technically in your codebase and what a proper handover should contain, then set that alongside whatever your lawyer says about your paperwork. Anyone offering you a legal opinion on your IP position as part of a development pitch is overreaching.

  • What is the single most useful thing in this article?

    That the law says the author keeps whatever is not expressly assigned. Everything else follows from it. It reframes the question from whether you paid to whether anybody wrote down, specifically, what was being transferred. Most contracts say a great deal about what will be built and very little about what will be owned, which is a drafting habit rather than anyone's bad intent.

SKIMBOX Team

Tech Consultancy

Get fresh writing in your inbox

One email a fortnight. No filler.

By subscribing, you agree to our privacy policy.

Want us to build something?

We work with teams across MENA, UK, USA, and India to build products, run programs, and grow.

Get in touch

Continue reading

How to Read a Software Proposal: The Clauses That Decide Whether You Get a Product or a Dispute

How to Read a Software Proposal: The Clauses That Decide Whether You Get a Product or a Dispute

Blogs
Should Your Agency Use AI to Build Your Product? What to Ask Them

Should Your Agency Use AI to Build Your Product? What to Ask Them

Blogs
Can AI Coding Tools Replace Your Development Agency?

Can AI Coding Tools Replace Your Development Agency?

Blogs