Who owns software code in the UAE: employee, contractor or company?

UAE software ownership depends on who created the work, why it was created, the relationship between the parties, employer instructions and resources, and any written agreement. Article 28 can attribute economic rights to an employer or commissioning person in specified circumstances, but it does not justify saying that every line written by any employee or contractor automatically belongs to the company.

The practical question is chain of title: can the company prove that it owns or has sufficient rights to every material part of the product?

Ownership matrix

The matrix is a due-diligence tool, not a substitute for reviewing the actual law and contracts.

What UAE copyright law says

Federal Decree-Law No. 38 of 2021 protects smart applications, computer programs, applications and databases within the copyright framework.

Article 28 states, unless otherwise agreed in writing:

1. when an author creates a work in favour of another person, copyright is attributed to that person;
2. employee economic rights are attributed to the employer where the work relates to the employer's activity and is directly or indirectly mandated, or employer expertise, information, tools, machinery or materials are used; and
3. an unrelated employee work created without those employer resources remains with the employee.

This is more specific than the slogan “employer always owns”. The business must prove the facts connecting the work to the rule.

Economic rights and moral rights

Economic rights cover exploitation such as reproduction, distribution, modification, communication, licensing and making software available. These rights support commercial control and can be allocated under law and agreement.

Article 5 states that the author's moral rights are not subject to prescription or assignment. Contracts should therefore distinguish economic ownership and licences from authorship and moral-right treatment rather than using “all rights of every kind” as if the categories were identical.

For software, the statute also contains specific treatment relevant to withdrawal and licensing. The agreement should be drafted for the actual asset, not copied from a generic media contract.

Why a contractor invoice is not enough

An invoice can prove that money was requested or paid. It may not prove:

• who actually wrote each component;
• whether the contractor used employees or subcontractors;
• whether pre-existing tools were included;
• whether source code, documentation and credentials were delivered;
• whether the company received ownership or only a limited licence;
• whether third-party and open-source conditions were disclosed;
• whether later fixes and derivatives are covered.

A custom-development agreement should identify background IP, new deliverables, repositories, documentation, acceptance, economic rights, licences, third-party materials, open-source rules, warranties, assistance with recordals and exit handover.

Founder code before incorporation

Code written before the company exists is often the largest gap in an investment round. The founder may own it personally, a former employer may have a claim, or it may include contractor and open-source material.

The remediation file should contain:

1. a dated inventory and repository history;
2. confirmation of where and under which employment the code was created;
3. a signed assignment or sufficiently broad licence to the company;
4. corporate approval and the consideration or contribution basis;
5. disclosure of background tools and excluded assets; and
6. warranties qualified by a real dependency review.

Share ownership or founder status does not itself transfer copyright.

Open source and third-party code

Owning the proprietary layer does not erase licence obligations in dependencies. The company should maintain a software bill of materials showing component, version, source, licence, use, modification and distribution model.

Controls should distinguish permissive, weak-copyleft, strong-copyleft, commercial and source-available terms. The consequence can depend on whether software is distributed, provided as a network service, linked, modified or combined.

Notices, source offers, attribution, modification disclosure and patent clauses must be implemented where applicable. Replacing the package name in a register is not compliance.

AI-assisted code

AI tools add evidence questions:

• who selected and edited the output;
• what terms governed the tool and account;
• whether prompts contained confidential or personal data;
• whether generated code reproduces third-party material;
• whether the output is sufficiently original for protection;
• what open-source or model-output restrictions apply.

The company should not promise exclusive copyright in every generated line. It should document human contribution, provenance checks, tool terms and review results.

Chain-of-title audit

1. Map the product. Repositories, services, apps, models, data, designs, documentation and deployment assets.
2. Map contributors. Employees, founders, agencies, freelancers, vendors and communities.
3. Classify rights. Economic ownership, moral rights, assignment, exclusive/non-exclusive licence and third-party restrictions.
4. Match evidence. Contracts, instructions, commits, invoices, acceptance, payroll, access and handover.
5. Scan dependencies. SBOM, licences, notices, vulnerabilities and distribution triggers.
6. Identify gaps. Missing assignment, wrong entity, former employer, undocumented subcontractor or incompatible component.
7. Remediate. Sign confirmatory instruments, replace components, add notices and correct repositories.
8. Maintain. Onboarding, procurement, contribution and release controls keep the chain current.

The transactional owner is technology protection in the UAE. The guide supports ownership due diligence and does not replace asset-specific advice.

Registration and evidence

Article 4 states that failure to register a work or disposition does not prejudice statutory protection. The Ministry register can nevertheless provide an official record of work, author, rights holder and dispositions.

Registration is therefore an evidence tool, not the source of copyright. A registration with the wrong owner or incomplete chain does not cure the underlying defect. The Copyright Executive Regulations should be checked for the current filing evidence.

Frequently asked questions

Does the UAE employer own employee code?

Article 28 may attribute economic rights to the employer where the work relates to its business and is mandated or uses employer resources. Unrelated work made without those resources is treated differently.

Does a contractor own custom code?

The commissioned-work rule may attribute copyright to the person for whom the work was created unless otherwise agreed in writing, but the facts, scope, background IP and contributor chain still require proof.

Does payment transfer the copyright?

Payment alone does not document the full scope, contributors, background tools, source delivery or third-party restrictions. Use a signed agreement and acceptance record.

Must software copyright be registered?

No. Article 4 says non-registration does not prejudice protection, though registration can strengthen evidence.

Are moral rights transferable?

Article 5 states that moral rights are not assignable or time-barred. Separate them from economic rights in the analysis.

Can the company call open-source code its own?

It may own its original layer but uses open-source components under their licences. Those conditions remain.

What should investors request?

Contributor agreements, founder assignments, repository history, SBOM, licence review, IP schedule, disputes and evidence that the contracting company is the correct rights holder.

Official UAE legislation checked 23 July 2026. This material is general information and not advice on a specific codebase or transaction.