Dubai Robotaxi Reality Check 2026: RTA Rules, Fleet Software and What It Costs to Build

Dubai has stopped testing robotaxis and started charging for them. WeRide and Uber launched fully driverless, fare-paying operations in Dubai on 31 March 2026, and Baidu’s Apollo Go went commercial on the Uber app on 20 August 2026. If your software touches a vehicle, a fleet or a kerbside in this emirate, Dubai Law No. (9) of 2023 and the executive regulations the RTA adopted in December 2025 now dictate your technical requirements — teleoperation, event data retention, secure over-the-air updates and a live control-centre link are no longer nice-to-haves.

The numbers Dubai is actually working to

Most operators still talk about autonomy as a 2030 story. The published targets and the 2026 permits say otherwise:

• 25% of all journeys in Dubai are targeted to be smart and driverless by 2030 under the Dubai Self-Driving Transport Strategy – that is a quarter of the city’s trips, not a quarter of its taxis.
• More than AED 22 billion a year in projected annual benefits from the same strategy, through saved travel time, lower operating cost and reduced accident burden.
• Apollo Go put 50 RT6 vehicles on designated Dubai roads in August 2025, earned Dubai’s first fully driverless testing permit, and opened a 2,000 m² Operations and Control Centre in Dubai Science Park on 8 January 2026, with more than 1,000 vehicles planned.
• WeRide started public rides in Jumeirah and Umm Suqeim in December 2025 through the Uber app, received an RTA driverless trial permit in February 2026, and has at least 1,200 robotaxis committed across Dubai, Abu Dhabi and Riyadh.
• Freight is next: the RTA has approved a framework for autonomous heavy vehicles in logistics transport, rolling out in two phases, with phase two opening five pilot routes covering Al Maktoum International Airport, Jebel Ali Port and its Rail Freight Terminal, Dubai Investments Park and Ibn Battuta Mall.

Most Dubai businesses read autonomy as a vehicle procurement problem. Read the executive regulations and it is a software, data and control-centre problem with a vehicle attached.

What Dubai Law No. (9) of 2023 demands from your stack

Dubai Law No. (9) of 2023 governs autonomous vehicles in the emirate, and the RTA’s executive regulations adopted in December 2025 turned it into operating detail. Four things matter if you are the one writing the software.

1. Six vehicle categories, one permit regime

The regulations define six categories of autonomous vehicle, running from light passenger vehicles through heavy passenger and freight vehicles to self-driving motorcycles. Your permit, your route approvals and your safety case are scoped to the category you operate, so a passenger robotaxi platform and a yard-to-port freight platform are not the same compliance artefact.

2. Liability lands on the operator

The framework places strict civil liability on the “operator” of the autonomous vehicle, with a right of recourse against whoever actually caused the harm – a manufacturer, a software supplier, a maintenance contractor. In practice that makes your logs the evidence. If you cannot reconstruct what the vehicle perceived and decided, you cannot exercise recourse.

3. Named software obligations

These are written into the regulations, not inferred from them:

• Secure real-time software updates – signed, auditable, revertible over-the-air delivery.
• Data retention – trip, sensor and event data kept and producible.
• Continuous digital monitoring of the fleet while it operates.
• Automatic transition to a safe mode on fault or loss of confidence.
• Connectivity with control centres – a live link, not a nightly sync.

4. Fines are small until they are not

Penalties under the framework run from AED 500 to AED 20,000, rising to AED 50,000 for repeat offences. The commercial risk is not the fine, it is the permit: an operator that cannot demonstrate monitoring and safe-mode behaviour does not get route expansion.

Ras Al Khaimah followed with its own Law No. (1) of 2026 in January 2026, regulated by RAKTA, so a UAE-wide rollout means two regulators and two evidence packs, not one.

The seven software layers behind one driverless ride

Nobody buys “an AV platform”. You buy or build the layers between the vehicle vendor’s autonomy stack and your customer. Vendors such as WeRide and Apollo Go supply the driving; fleet service operators such as Tawasul and New Horizon Luxury Transport supply the depot work. The layers below sit in the middle, and they are where almost all local software spend goes.

Layer	What it has to do	Typical build (AED)	Timeline
Remote assist & teleoperation console	Live video, intervention queue, safe-mode confirmation, operator audit trail	180,000 – 420,000	10 – 16 weeks
Fleet orchestration & dispatch	Geofenced service areas, demand matching, charge-aware assignment, route approvals	140,000 – 320,000	8 – 14 weeks
OTA update & software inventory	Signed releases, staged rollout, rollback, per-vehicle version ledger	90,000 – 200,000	6 – 10 weeks
Event data recorder & retention	Trip and incident capture, tamper-evident storage, regulator export	110,000 – 260,000	8 – 12 weeks
Safety case & incident reporting	Disengagement taxonomy, RTA-shaped reports, corrective-action tracking	60,000 – 140,000	4 – 8 weeks
Depot operations	Charging slots, cleaning, maintenance, parts and inspection scheduling	80,000 – 190,000	6 – 10 weeks
Rider app, fares & payments	Booking, pickup choreography, AED fare capture, VAT-correct invoicing	120,000 – 300,000	8 – 14 weeks

Two local details decide whether this works on day one. First, Dubai’s driverless zones are expanding into Dubai Silicon Oasis, Dubai Investment Park Second, Jabal Ali Industrial First, Nad Al Sheba, Wadi Al Safa, Warsan, Ras Al Khor and Al Hamriya Port, so geofence and route data must be versioned, not hard-coded. Second, the kerbside is already digital: if your vehicles touch tolled roads or paid parking, the Salik, Parkin and nol integrations have to reconcile per trip, per vehicle, automatically.

What to build first, and what it costs

Almost nobody needs all seven layers at once. Three realistic starting points, with the AED ranges we actually quote in Dubai:

• Fleet operator serving an AV vendor (AED 250,000 – 600,000). You do not own the autonomy stack. You own depot operations, charging, cleaning, inspection and shift scheduling, plus the reporting the vendor and the RTA expect. This is the most common 2026 engagement, and it is close in shape to conventional fleet tracking and logistics software.
• Mixed human and driverless ride-hailing (AED 400,000 – 900,000). One rider app, two supply types, different pricing and different liability. Start from a proven ride-hailing app build and add AV dispatch plus the remote-assist handoff.
• Permit-ready AV operator platform (AED 900,000 – 2,400,000+). Teleoperation, event data retention, OTA governance and a control-centre feed. Budget for the safety case as a deliverable with its own timeline, not a document written the week before submission.

Electrification sits on top of all three. Driverless fleets are electric fleets, so charging-session data, depot load management and CPMS integration belong in the first release rather than a later phase — a robotaxi queueing for a charger earns nothing while still depreciating.

The real cost of getting this wrong is not the AED 50,000 repeat-offence ceiling. It is being the operator who cannot evidence continuous monitoring when the RTA opens the next batch of routes, while a competitor with clean logs takes the expansion. Dubai’s own framing is explicit: the RTA described the new control centre as proof of the “strong confidence of leading global companies in Dubai’s advanced regulatory environment”. Regulators that move this fast reward operators who can prove things on demand.

How Aquarius handles it

We build the middle layers — orchestration, remote assist, event data, depot operations and the rider-facing app — against whichever autonomy vendor you have signed. We open with a two-week mapping sprint that turns the regulation’s software obligations into a module list and an evidence matrix, so the build and the permit pack are one project instead of two. Data handling is designed to UAE PDPL expectations from the first sprint, because AV camera and location data is personal data. See our pricing for engagement shapes, or tell us which vendor and which zones and we will come back with a scoped phase one.

FAQ

Can a private company operate robotaxis in Dubai?

Yes, under permit. Dubai Law No. (9) of 2023 and the RTA’s December 2025 executive regulations set the categories, licensing path and operating conditions, and current commercial services run as partnerships — Apollo Go with Dubai Taxi Company and a fleet operator, WeRide with Uber and a fleet service operator. Expect to arrive with a vendor, a fleet operator and a safety case, not just a business plan.

Who is liable if a driverless vehicle crashes in Dubai?

The framework imposes strict civil liability on the operator, with a right of recourse against the party genuinely at fault. That recourse is only as strong as your event data, which is why retention and tamper-evident storage are build requirements rather than paperwork.

Do I need my own control centre?

You need continuous digital monitoring and connectivity to a control centre. Many operators consume their vendor’s centre and run their own monitoring and depot layer alongside it. Apollo Go’s 2,000 m² Dubai Science Park facility shows the full-scale version: daily vehicle operations, maintenance, charging, software updates, inspection, safety testing, operational response and safety-driver training in one building.

Does the UAE PDPL apply to autonomous vehicle data?

Treat it as applying. Exterior cameras capture identifiable people and plates, and trip data is location data tied to an individual. Build retention limits, access control and a lawful basis for each stream — our UAE PDPL compliance checklist covers the baseline controls.

How long does a first AV fleet platform take?

A depot and monitoring platform for a fleet operator is realistically 10 to 16 weeks. A permit-ready operator platform with teleoperation and event data retention is 6 to 9 months, and the safety case is the critical path more often than the code is.