Going Paperless in the UAE: Two Questions That Decide Everything

Frequently asked questions

• Is a scanned copy of a signed paper contract legally valid in the UAE?

  Under Federal Decree-Law No. 46 of 2021, Article 6, a storage requirement set by any UAE law is satisfied by an electronic document, including one kept in any form that can prove it accurately represents what was originally created. That language covers a scan of a paper original, provided the file stays usable and referenceable. Article 6.4 also lets a government authority set stricter rules for documents under its own jurisdiction, so confirm high stakes categories with the relevant regulator and a qualified adviser.

• Can I sign a contract by typing my name at the bottom of an email?

  Possibly, but it is the weakest option available to you. The law defines an electronic signature very broadly, covering letters, numbers, symbols, sound, a fingerprint or an electronic form processing system attached to a document to verify identity and approval. A typed name can meet that definition. Whether it also meets the stronger reliable or qualified standards is a separate question with a different answer. For anything valuable or likely to be argued over, use a proper signing platform rather than a typed name.

• What is the difference between an electronic, reliable and qualified electronic signature?

  Three tiers, three levels of weight. An electronic signature is the broad category and covers almost any electronic mark showing identity and approval. A reliable electronic signature adds conditions in Article 19: sole control by the signatory, the ability to identify them, and a link to the data so any later change is detectable. A qualified electronic signature is a reliable one created on a device the regulator has qualified, issued on a certificate from a licensed qualified trust service provider.

• Is a qualified electronic signature the same as a wet ink signature?

  In terms of legal effect, yes. Federal Decree-Law No. 46 of 2021, Article 18.3, states that a qualified electronic signature is considered equal in its authenticity to a manual signature and has the same legal effect. That wording is used for the qualified tier specifically. An ordinary electronic signature is still valid and still admissible under Articles 5 and 18.1, but the law does not extend that automatic equivalence to it. The distinction matters most when a document is likely to be disputed.

• Does a UAE court have to accept an electronic document as evidence?

  Article 18.1 of Federal Decree-Law No. 46 of 2021 says admissibility of an electronic document, signature, seal or transaction as evidence in legal proceedings is not precluded by the mere fact that it arrived in electronic form. So it cannot be thrown out simply for being electronic. How much weight a judge gives it in a specific case is a different question that depends on the facts and on how well you can show the file has not been altered. For an actual dispute, get legal advice.

• Are there UAE documents that legally must stay on paper or be notarised?

  We could not confirm any such list from a primary source. We read Federal Decree-Law No. 46 of 2021 and its executive regulations in Cabinet Resolution No. 28 of 2023 and found no specific schedule of excluded categories. The claim circulates widely on vendor and law firm pages, and the Cabinet does hold the power under Article 2.2 to exclude transactions from the law. Before assuming any specific document type can go fully electronic, check with a qualified adviser or the relevant authority.

• Who regulates electronic signatures and trust services in the UAE?

  The Telecommunications and Digital Government Regulatory Authority, usually shortened to TDRA. It licenses trust service providers and qualified trust service providers and sets the technical and security standards those providers must meet under Federal Decree-Law No. 46 of 2021. Where a trust service touches government sector data, the Federal Authority for Identity, Citizenship, Customs and Port Security sets additional controls under Article 16. If a signing vendor tells you it is licensed here, that is a claim you can ask them to evidence.

• If a client emails me a signed purchase order and I never get paper, can I rely on it?

  As a general rule the law is on your side. Article 5.1 says an electronic document does not lose its legal force or enforceability for being in electronic form, and Article 10.2 says a contract does not lose validity, evidential weight or enforceability merely because it was made as electronic documents. Whether one specific order is enforceable still depends on the facts, on what the parties agreed about how documents would be exchanged, and on your own records. Confirm high value cases with a lawyer.

• How long do I have to keep my tax records in the UAE?

  Cabinet Decision No. 74 of 2023, Article 3, sets the current periods. A taxable person keeps records for five years following the tax period they relate to. Other persons who still carry a record keeping duty keep them five years from the end of the calendar year the document was created. Real estate records run seven years from the end of that calendar year. Periods can extend further in audit or dispute situations. Confirm what applies to your own records with the Federal Tax Authority.

• I have heard real estate records need fifteen years. Is that still right?

  No, and this one catches people out. The fifteen year figure traces back to the regime that applied before 2023, and it appeared in an older Federal Tax Authority VAT guide. That regime was repealed. Under the current rule in Cabinet Decision No. 74 of 2023, Article 3, real estate records are kept for seven years from the end of the calendar year in which the document was created. A lot of guidance still circulating online has not been updated. Check tax.gov.ae rather than a summary.

• Can my retention period ever run longer than five years?

  Yes. Cabinet Decision No. 74 of 2023, Article 3, adds extensions in specific circumstances. A further four years applies where there is a dispute with the Federal Tax Authority over your tax obligations, or you are subject to an ongoing tax audit, or the authority has told you it intends to audit you before the normal period expires. A further year applies from the date of a voluntary disclosure filed in the fifth year. A legal representative keeps records for one year after representation ends.

• Does Corporate Tax carry the same retention period as VAT?

  We did not confirm that, so we are not going to claim it. The periods we have cited come from the Tax Procedures executive regulation, which underpins general Federal Tax Authority record keeping duties. Corporate Tax sits under its own law, and we did not separately verify whether every Corporate Tax record type carries an identical period. Do not assume the two are automatically the same. Confirm your own position with the Federal Tax Authority or with a registered tax agent before you set a deletion rule in any system.

• Can I keep scans instead of original paper invoices for tax purposes?

  Cabinet Decision No. 74 of 2023, Article 4, allows accounting records and commercial books to be kept either by holding the original supporting documents, or by holding a register plus the information from those originals saved or stored in a photocopy or electronic format. The condition is that it stays easily readable and can be extracted if the Federal Tax Authority asks. That is a fairly clear permission for scanning, but confirm your own situation with a registered tax agent before you dispose of anything.

• Can I throw away paper invoices once they are scanned?

  Not as a blanket rule, and not on our say so. Two things need checking first. Whether the retention period for that record has actually lapsed, including any of the extension scenarios that can apply if an audit or dispute is open or pending. And whether your own sector regulator has set stricter storage rules for documents under its jurisdiction, which Article 6.4 of the electronic transactions law expressly permits. Ask your accountant or tax agent to sign off a disposal policy before the shredder appears.

• Is a WhatsApp message with an attached invoice a valid business record?

  We found no government guidance dealing with WhatsApp specifically. The general validity principles for electronic documents would apply to the content in principle, but that misses the real risk. Messages get deleted, threads are tied to one person's phone, there is no permission control, and nothing is searchable in any structured way. Treat messaging apps as a channel documents arrive through, not as the place records live. Pull the attachment into your document store on the day it arrives.

• What is the actual difference between a shared drive and a document management system?

  A shared drive stores files. A document management system stores files plus everything you need to answer questions about them. Version history that records every save with an author and timestamp. Permissions applied at the document or metadata level rather than folder by folder. An audit trail of who opened, edited, downloaded or deleted a file. Retention rules that flag or block deletion. Full text search inside the document rather than across filenames. Approval workflow with a timestamped record of each sign off.

• Do I always need a document management system, or is a shared drive enough?

  A shared drive is often enough, and we have told clients so. The honest test is not how many gigabytes you have. It is whether you can answer four questions: who holds the current version, who approved it, can I find every document tied to one counterparty in under a minute, and what are we required to keep. If a tidy folder structure and a consistent naming pattern answer all four, buy nothing. If two of them fail regularly, a system starts paying for itself.

• What does OCR do and do I need it?

  Optical character recognition turns a scanned image of a page into text a computer can read and search. Without it, a scanned invoice is a picture. You cannot search for the invoice number, the client name or a clause inside it, so someone has to open files one at a time until they find the right one. If a meaningful share of your documents arrive as scans or photographs rather than born digital files, OCR is the feature that decides whether they are findable later.

• Is Arabic OCR as accurate as English OCR?

  Generally it is harder, for structural reasons. Arabic is cursive by default and letters change shape depending on their position in a word, so the recogniser has far more visual variants to resolve. UAE business documents often mix right to left Arabic with left to right English and numerals on the same page, which complicates reading order. Everyday printed Arabic usually drops diacritics, adding ambiguity. Test any vendor on your own real bilingual documents rather than trusting a general accuracy claim benchmarked on English.

• What should I look for beyond can it scan documents?

  Seven things, in roughly this order. Full text search inside documents. OCR quality on your own bilingual samples. Permissions that can be set once and enforced centrally. An audit trail that a non technical person can actually read. Retention rules that can flag or block deletion at the right date. Version history with rollback. Approval workflow with timestamps. Then one commercial question that people forget: can you export everything in a usable format if you ever want to leave.

• How much does document management software cost per user in the UAE?

  It splits by category. General cloud storage and office suites such as Zoho WorkDrive, Google Workspace and Microsoft 365 Business publish transparent per user monthly tiers on their own pricing pages. Dedicated document management platforms aimed at heavier compliance workflows are mostly quote based. M-Files publishes an entry tier price and quotes its enterprise tier. DocuWare does not publish pricing at all. Check each vendor page from a UAE session, because several of them show different figures by region.

• Do document management vendors publish their pricing?

  Some do and some do not, and the split follows the product category rather than the vendor size. Cloud storage and office suite products publish clear per user per month tiers you can budget from without talking to anyone. Dedicated document management platforms built for regulated or workflow heavy environments generally do not. DocuWare states on its own pricing FAQ that pricing is customised and requires contacting its team. Any range you see quoted for those products came from a review site, not the vendor.

• What hidden costs should I watch for on vendor pricing pages?

  Two traps recur across nearly every vendor we check. The first is an introductory rate shown large on the first page load, which reverts to a higher standard rate after a fixed window. Budget on the standard rate and diarise the day the discount ends. The second is a price displayed in one currency while billing is processed in another, so your real charge moves with the exchange rate. Also check whether local taxes are added on top of the listed figure.

• What does a document management setup and migration project cost?

  With us it starts from around AED 3,000. That covers the index design, folder and metadata structure, naming rules, permission model, a scanning and triage plan for the backlog, retention flags, and training. It sits above our helpdesk setup floor of AED 2,500 and below our CRM floor of AED 3,500 for a specific reason: the software is simple, but the scanning, indexing and naming decisions are the actual work. Final pricing depends on scope.

• Where do most UAE businesses get stuck when digitising a paper backlog?

  Not the scanning. A decent departmental scanner or a scanning service clears volume quickly. The bottleneck is the decision layer around each document: which category it belongs to, what metadata it needs, and who should be allowed to see it. Businesses that scan first and organise later end up with thousands of unsearchable PDFs, which is the shared drive problem in a new format. Define the index before the first page goes through the feeder.

• Should I scan everything, or triage first?

  Triage first, always. Split the backlog into three piles: keep and digitise, keep as paper pending advice on anything high stakes, and eligible for disposal because the retention period has lapsed and no audit or dispute is open. Then scan in category batches rather than in physical or chronological order, because consistent indexing is far easier when every document in a batch needs the same fields. Get an accountant to confirm the disposal pile before anything is destroyed.

• What naming convention should I use for scanned files?

  A predictable pattern beats a clever one. Date first in year month day order so files sort correctly, then document type, then counterparty, then any reference number. Agree it once, write it down, and apply it to every batch. Naming matters most for anything that will sit outside a fully searchable system. Once real full text search is running, the convention matters less for retrieval and more for whether a human can recognise the right file while browsing a folder.

• Is the index or the scanner the more important investment?

  The index, and it is not close. The metadata layer plus OCR is what makes a document findable and what lets retention rules run automatically. A system can only flag that a record has passed its retention period if the record was tagged with its date and type at the point it was migrated. Correctly scanned but unindexed PDFs are barely better than a filing cabinet, because a person still has to open files one by one to find anything.

• Can a system flag when a retention period is about to end?

  Yes, this is what the retention rules feature exists for. A document management system can flag or archive a document once its period lapses, and block deletion before that date, which is sometimes described as a legal hold. It only works if the document carried the right date and category when it was indexed, which is the practical argument for getting the index right during migration. Confirm the periods themselves with the Federal Tax Authority or a registered tax agent first.

• Do UAE government authorities accept electronic documents and signatures?

  Federal Decree-Law No. 46 of 2021, Article 28.6, permits government authorities to accept the filing, submission, creation and storage of documents as electronic records, to issue permits, licences, decisions and approvals electronically, to collect fees electronically, and to run electronic tendering for procurement, all with the same legal effect. That is a permission for the authority rather than a guarantee about one specific counter. Each authority still runs its own procedures, so check the process for the service you need.

• What is UAE Pass and does it help with electronic signatures?

  UAE Pass is the national digital identity, described in the law as Digital Identity and issued under the regulator's electronic identification system. Under Federal Decree-Law No. 46 of 2021, Articles 28.3 and 28.4, it is accepted as meeting identification and personal presence requirements when accessing government electronic services, provided it meets the required trust and security level. For business to business contracts, treat it as an identity layer rather than assuming it settles every signature question for you.

• If an electronic signature turns out to be fraudulent, who is liable?

  The law splits the duty. Under Article 29 the relying party, meaning whoever accepts a signature, has to take reasonable steps to verify identity and validity, and a relying party who accepts one unreasonably carries the risk if it turns out invalid. Under Article 30 the signatory has parallel duties to protect their own signature data and report any compromise. That is a general allocation of responsibility rather than an answer to any particular incident. Get legal advice for a real one.

• Do I need to think about UAE data protection law when I digitise HR files?

  Yes, and it deserves its own conversation rather than a paragraph here. Employment contracts, visa paperwork and disciplinary records carry sensitivity that ordinary invoices do not, so permissions and audit trail matter far more for that part of the estate. Fewer people should be able to open an HR folder than a supplier folder, and you should be able to prove who did. Our separate guide on UAE data protection compliance covers the obligations properly.

• Does the electronic transactions law work the same way in DIFC or ADGM?

  We did not verify that, so we are not going to assert it either way. Everything cited in this guide is federal law, which applies onshore. DIFC and ADGM are financial free zones that maintain their own separate legal frameworks in a number of areas, and whether their electronic transactions rules mirror the federal position was outside what we checked. If you operate in either zone, get zone specific confirmation from a qualified adviser rather than assuming the federal analysis carries across.

• What happens to my records if my document management vendor shuts down?

  Ask that question before you sign, not after. Confirm the vendor supports a full export of both the files and the metadata in an open, usable format rather than something proprietary, and check whether the contract or pricing page mentions a retrieval fee on exit. Then test the export once during the trial, on real documents, rather than trusting a line on a feature list. This is standard software due diligence and it applies to any system holding your records.

• How long does a document management project take?

  The system side is quick. Configuring a cloud document platform, setting permissions and agreeing a folder and metadata structure is usually a matter of days for a small business. The backlog is what sets the timeline, and that depends entirely on how much paper exists and how much triage it needs. Running the new structure live for current documents while the backlog is scanned in batches behind it is generally faster and less disruptive than waiting for a full migration.