As of 8 October 2026, none of the four legal AI platforms here lists a processing location in the Gulf: Harvey, Legora, Lexis+ with Protégé and CoCounsel run in the US, Europe, Canada or Australia, with some model calls routed globally or across Asia-Pacific. Of the two general assistants, ChatGPT Enterprise documents data storage and model processing in the UAE for new workspaces, and Microsoft 365 Copilot can keep data at rest in the UAE or Qatar while its model calls may still go abroad. All six say they do not train on a firm's data by default, so for a Gulf firm the choice turns on where the data and the model run, and on Arabic.
I build private AI systems for law firms, which is one of the options this page compares, so each claim below links to the vendor's own page, or to the press where the vendor publishes nothing.
The six legal AI tools side by side
For a Gulf firm, the best legal AI tool is the one that fits two facts about the firm: where its client data may go, and whether it works in Arabic. This table holds only what the vendors' public pages documented on 8 October 2026.
| Tool | Data stored in the Gulf | Model runs in the Gulf | Arabic interface | Gulf legal sources | Public price |
|---|---|---|---|---|---|
| Harvey | No: US, EU, Switzerland, Australia; other requests where its cloud providers allow | No Gulf location among its model providers | Not listed (Arabic in translation workflows since 2024) | UAE and Bahraini legislation, Saudi regulations, a Kuwaiti ministry source | No |
| Legora | No: US, EU, Asia-Pacific | No | Yes, with Al Tamimi: announced November 2025, launch reported June 2026 | Not stated | No |
| Lexis+ with Protégé | No: primary and backup in Europe | No Gulf location on its sub-processor list | Not stated for the AI product | UAE federal and emirate law, plus five other Gulf states | No |
| CoCounsel | No: US, with UK, Australia and Canada options | No: OpenAI and Gemini calls in the US | Not stated, and Arabic is not in its document language list | Practical Law Middle East integration announced 2025; research answers described as UK, US and AU content | No Gulf price |
| Microsoft 365 Copilot | Yes: UAE or Qatar | Not guaranteed; UAE expected by the end of 2026 | Yes | None built in | $30 per user per month, paid yearly |
| ChatGPT Enterprise | Yes: UAE, for new workspaces | Yes: UAE, two models | Yes | None built in | No (the smaller Business plan is public) |
"Not stated" means I did not find it on the vendor's public pages.
Harvey: hosted in the US, the EU or Australia, Arabic in its translation workflows
Harvey is a web platform for legal work. It has a chat assistant for drafting and research, Vault to "Securely store, organize, and bulk-analyze legal documents", Knowledge for research across legal sources, and agents for longer tasks (Harvey). It also works inside Word, Outlook and SharePoint (ecosystem).
It hosts on Microsoft Azure and offers "processing in the EU and Switzerland or Australia" to customers who need data kept in one place (security); its trust portal lists production environments in the US, the EU and Australia. The portal names no Gulf environment, and adds: "We can accommodate customer data-residency requests where supported by our cloud providers and applicable law". The sub-processor list of 21 September 2026 names Microsoft, OpenAI, Google Cloud, AWS, Anthropic and Mistral as model providers, located in the US, the EU, Switzerland or Australia, and no Gulf location. In August 2026 Harvey also showed its own post-trained open-weight model, Harvey Tenet, as a "Research Preview" (Harvey).
Harvey's General Counsel wrote in June 2026 that "The data of European companies, if they use a US-subject cloud or LLM provider, remains reachable by US authorities under the CLOUD Act, even if they have no US presence, and process and store the data in the EU." The same post says Harvey has "never received a request for customer data from the US government" (Harvey).
Harvey's public release notes say it has supported Arabic in its translation workflows since September 2024: "Harvey now supports Arabic, Indonesian, and Japanese in its translation workflows" (release notes). The languages of its interface localisation, in the notes of 1 October 2026, are English (UK), German, Italian and Portuguese, and Arabic is not among them (release notes). Its Help Center articles need a login. Arabic was an aim of its first Gulf partnership: in November 2023, Al Tamimi & Company said it would work with Harvey "to enhance the platform's Arabic language proficiency" (Al Tamimi). Harvey's Knowledge sources include "United Arab Emirates legislation", "Bahraini legislation", "Kuwaiti Ministry of Finance" and "Saudi Arabian regulations, agreements & treaties", with no Qatar or Oman source and no UAE case law (Harvey, September 2025).
On terms, Harvey says: "We don't use inputs, outputs, or uploaded documents to train underlying models." It adds that "Harvey requires Zero Data Retention (ZDR) by model providers", and that a model is trained on a firm's data only when the firm asks, in which case "a bespoke model is created exclusively for you" (security). Its staff have no standing access to customer environments and must request time-limited, audited access for specific tasks; backups are kept for up to 30 days (trust portal). It lists SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001, and says it "syncs and enforces your firm's existing ethical wall policies" (security).
In the Gulf, Harvey's first partner was Al Tamimi & Company, in 2023 (see the timeline below). Eversheds Sutherland (International), whose scope includes the Middle East, chose Harvey in February 2026 (Artificial Lawyer), and Harvey says "80% of Am Law 100 law firms use Harvey" (Harvey, September 2026). I found no Harvey office in the Gulf: none of the roughly 330 jobs on its public job board is in the region, and its three Arabic-speaking roles are in London and Dublin.
Harvey publishes no price, and I found no primary source for the figures quoted on comparison blogs.
Legora: an Arabic interface, no Gulf region
Legora, a Swedish company, sells an AI workspace for lawyers: an agent for drafting and review, Tabular Review for bulk document review, workflows and legal research, with Word and Outlook add-ins (Word add-in, Outlook add-in).
Legora is "hosted on Microsoft Azure with a small footprint on AWS (for Anthropic models)" and offers "three processing regions; US, EU and AP" (security FAQ). A region does not fix where the model runs: in Asia-Pacific, hosting is in Australia while AI models run in "EU/APAC" and OpenAI models in the EU (sub-processor list). A Legora job post for the region, dated 21 September 2026, says: "Arabic capability and a credible answer on data protection and local hosting are the price of entry here" (job post).
Legora entered the Middle East with Al Tamimi in November 2025, in a release that says it "launches its platform in Arabic" and that the firm would help "develop the platform's Arabic interface" (Legora). A post of 8 June 2026 reports the launch of that interface, "developed with direct input from Al Tamimi's lawyers", without giving a launch date (Legora). Its pages do not state Arabic answers or Gulf legal sources; the research page names US federal and state coverage and "global content partnerships", with no Gulf source named (legal research).
Legora says it "will not use your data to train or fine tune any AI models" (security) and that "The models we use do not retain or learn from any input or output. All processing is ephemeral." Its engineers have no standing access to sensitive customer data, and the CTO can grant temporary access "only if written, explicit consent is provided by the customer" (security FAQ). Customers set retention periods, and their data is deleted when the contract ends. Enterprise customers can bring their own keys through Azure Key Vault. Its certifications include SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023 (trust center).
Legora is building a Dubai team, with posts such as "Director of Legal Engineering, Dubai". The posts say "The region is currently served from our European hubs" and name Saudi Arabia "as the larger long-term opportunity" (job board). I found no announcement of a Dubai office on legora.com.
Legora publishes no price, and I found no source for the per-seat figures on comparison blogs. In June 2026 it moved its top product, Agent Pro, to consumption-based pricing, while the standard Legora Agent stays "available to our customers at no additional cost and no changes to their existing contract terms" (Legora).
Lexis+ with Protégé: the most Gulf legal content, hosted in Europe
LexisNexis renamed Lexis+ AI as Lexis+ with Protégé in the first quarter of 2026. It is "a legal AI workflow solution for drafting, research, and analysis" built on LexisNexis content (product page). In the Gulf it sits on Lexis Middle East, a research database of laws, cases and regulations "across the Middle East, in both English and Arabic" (lexis.ae).
The product runs on Microsoft Azure and AWS Bedrock, and "Primary and back-up locations are in Europe" (product page). Its models come from OpenAI on Azure, Anthropic on AWS Bedrock, and Mistral (Lexis Middle East). The sub-processor list for file uploads, updated 8 October 2026, gives locations in Europe, North America and Australia, lists Google as "Global*", and names no Gulf location. The two Middle East launch releases of 2026 do not say where Gulf customers' data is hosted.
Of the six tools, Lexis documents the most Gulf legal content. The MENA launch of 2 October 2026 describes "translation and summarisation capabilities for case decisions that help professionals work across Arabic and English source materials", with content on "UAE federal law and all seven emirates" (LexisNexis). The June 2026 release adds content "across key jurisdictions, including the UAE, Saudi Arabia, Qatar, Kuwait, Bahrain and Oman" (LexisNexis). Its pages do not state an Arabic interface for the AI product.
LexisNexis says: "We never use customer data to train AI models" (Protégé page). Vaults are kept until you delete them, and uploads not saved to a Vault are purged at the end of each session. Vault results stay for 90 days in the conversation history (product page). The same Gulf page says "Identifiable information is removed from AI interactions so that we can improve performance without compromising privacy", which I read as de-identified interaction data being used to improve the service. The MENA launch release of 2 October 2026 says customer data is "never used to train public AI models or to improve performance for other customers" (LexisNexis). A 2024 security document for Australia says a restricted group of support experts can review customer usage data, with customer association "pseudonymized", and that an independent auditor performs an annual SOC 2 Type 2 examination of Lexis and Lexis+ (security information). I found no ISO 27001 or ISO 42001 certificate for the product.
LexisNexis has been in the region for 16 years and launched Lexis+ with Protégé commercially in MENA on 2 October 2026, "starting with the UAE" (LexisNexis), after announcing "a multi-million-dollar investment" in June (LexisNexis). It names no Gulf client for the AI product yet and says it "will share validated regional performance data as it becomes available". There is no public price: LexisNexis "offers customised pricing tailored to individual needs" (product page).
CoCounsel: hosted in the US, Arabic in a separate product
Thomson Reuters sells CoCounsel for legal research, drafting and document analysis, with "end-to-end agentic workflows, Deep Research, and an expert-built prompt library" (plans page), grounded in Westlaw and Practical Law content.
Its FAQ says: "Systematic procedures and hosting are in the U.S. We process all interactions with OpenAI GPT and Google Gemini in the U.S." It adds: "Region-based hosting is available in the UK, Australia, and Canada" (CoCounsel). The Middle East product page does not say where Gulf customers' data is hosted. Thomson Reuters does host a different product, Legal Tracker for legal spend, in the UAE (Thomson Reuters, May 2025). In August 2026 it launched its own model, Thomson, which "starts from a strong open-source foundation", and said there were plans for "more sovereign AI options to follow" (Thomson Reuters).
The Middle East page says CoCounsel can process documents in languages "including but not limited to Japanese, French, German, Portuguese, and Spanish". Arabic is not named, and the content behind its answers is "authoritative UK, US and AU content". Arabic is in a separate research product, Westlaw Middle East, "with reliable Arabic-English translation". Since 2025, CoCounsel "now integrates with Westlaw International, Practical Law Middle East, and ONESOURCE" (Thomson Reuters, May 2025).
Thomson Reuters says user content and prompts are not used to train CoCounsel or the models behind it, and that "All interactions with GenAI LLM providers use zero-retention API calls" (CoCounsel). It has turned off the providers' abuse monitoring "to ensure there is no human access to Thomson Reuters customers' data", and requests reach the model providers under the name "Thomson Reuters", never the customer's. Retention is set per organisation. Its public pages do not say when Thomson Reuters staff can access customer data. Thomson Reuters says CoCounsel is in the scope of its ISO/IEC 42001:2023 certification (Thomson Reuters, June 2025); its trust center lists ISO 27001 at company level, and the CoCounsel reports need an account.
Thomson Reuters has a MENA office in Dubai Media City (contact) and launched CoCounsel to UAE customers in March 2025 (Thomson Reuters, May 2025). Salik, the Dubai toll operator, is a named client: its Chief Legal Counsel says CoCounsel "relies on its own database, which is built in very accurately" (customer story). US prices appear after a form for new customers, and I found no Gulf price.
Microsoft 365 Copilot: data at rest in the UAE or Qatar, processing can leave
Microsoft 365 Copilot is a general assistant inside Word, Outlook, Teams, Excel and PowerPoint. It answers from the firm's own Microsoft 365 mail, files and chats, and "only surfaces organizational data to which individual users have at least view permissions" (privacy page). It has no legal content of its own: legal sources and document systems come through add-ons from iManage, NetDocuments, Harvey and LexisNexis.
Its data at rest can stay in the UAE or Qatar: both are "Local Region Geographies" for Microsoft's Advanced Data Residency, which covers Copilot, and Saudi Arabia is not on the list (data locations). Model processing is a separate promise. Microsoft says Copilot's calls to the model "can call into other regions where capacity is available during high utilization periods", and "Customers outside the EU may have their queries processed in the US, EU, or other regions" (privacy page). It announced in-country processing for "qualified UAE organizations" in October 2025 (Microsoft), and in April 2026 wrote that it is "expected to become available" in the UAE "by the end of 2026" (Microsoft). I found no page that confirms it is live.
Anthropic models are on "by default for most customers in commercial cloud (excluding EU/EFTA and UK)" and sit outside in-country processing commitments (Microsoft). A UAE tenant should check that setting in the admin center. Arabic is a supported language for prompts and responses on work accounts (supported languages).
Prompts, responses and data reached through Microsoft Graph "aren't used to train foundation LLMs", and Copilot has opted out of the human abuse review available in Azure OpenAI (privacy page). Admins set retention in Microsoft Purview, and Microsoft staff access goes through Customer Lockbox (Customer Lockbox). Copilot is in the scope of Microsoft's ISO 42001 certification (ISO 42001).
The public US price is "$30.00 user/month, paid yearly", and "A separate license for a qualifying Microsoft 365 plan is required" (pricing). The UAE page showed no price when I checked.
Microsoft has cloud data centres in Dubai and Abu Dhabi (Microsoft) and a local region in Qatar. I found no Gulf law firm named as a Copilot user. Clifford Chance, a global firm with Gulf offices, deployed Copilot to its employees worldwide in 2024; it was also "one of the first law firms globally to build its own private and secured AI tool, Clifford Chance Assist, developed on Microsoft's Azure OpenAI platform" (Legal Technology).
ChatGPT Enterprise: storage and model processing in the UAE, with limits
ChatGPT Enterprise is OpenAI's general AI workspace for large organisations, with chat, file analysis, deep research, agents and connected apps, and no legal content of its own (pricing page).
It is the only one of the six that documents both storage and model processing in the UAE. OpenAI's help center lists the United Arab Emirates for data residency and for inference residency, with limits: "GPT-5.5 and GPT-5.6 Luna are currently available in ChatGPT with UAE inference residency", image generation and internal search are not supported, and storage in a chosen country is open to "new ChatGPT Enterprise/Edu customers". Some steps can run elsewhere, such as "extracting text from uploaded PDF or Word files", and data sent to an external app, MCP server or web browsing provider follows that provider's own terms. The press reported on 12 August 2026 that OpenAI had switched on inference residency in the UAE (Middle East AI News). Saudi Arabia and Qatar are on neither list.
In early October 2026, OpenAI's business data page still named only the US and Europe for in-region inference, so the UAE terms belong in the contract (ChatGPT Business, Enterprise or private AI). The interface is available in Arabic (language settings), and there are no built-in legal sources.
OpenAI says: "By default, we do not use your business data for training our models." Workspace admins set retention, and deleted conversations are removed within 30 days "unless we are legally required to retain them" (enterprise privacy). Its staff open conversations only to resolve incidents, to recover one "with your explicit permission", or "where required by applicable law". Zero data retention exists for the API only, after approval (API data controls).
In 2025 a US court order in the New York Times case forced OpenAI to keep consumer, Team and standard API content. ChatGPT Enterprise was excluded, and "Our obligations under the earlier order ended on September 26, 2025" (OpenAI). OpenAI reports a SOC 2 Type 2 examination, ISO/IEC 27001:2022 and ISO/IEC 27701:2019 certifications, and an ISO/IEC 42001:2023 AI management system (security and privacy).
Enterprise is "Custom pricing". The smaller Business plan, for 2 to 200 users, is public: from a UAE connection, a standard seat shows as AED 73 a month, the local price of $20 billed annually ($25 billed monthly) (pricing page). OpenAI's business data page lists data residency for Enterprise, Edu, Healthcare and the API; Business is not on that list.
OpenAI is building "A 1GW Stargate UAE cluster in Abu Dhabi with 200MW expected to go live in 2026" (OpenAI) and has posted engineering and sales roles in Abu Dhabi (job board). The UAE users named at the residency launch include G42, Mubadala and several universities, and no Gulf law firm (Gulf News).
Harvey vs Legora: the Al Tamimi timeline
Al Tamimi & Company has worked publicly with both:
- 9 November 2023: Al Tamimi announces it "has become the first regional firm to partner with Harvey and begin deploying its system with the firm's lawyers" (Al Tamimi).
- 3 November 2025: Legora names Al Tamimi its first Middle East partner and says "The Legora platform has been rolled out firmwide to all Al Tamimi & Company lawyers" (Legora). Legora's customer page shows "joined legora Sep 2026", which does not match.
- 8 June 2026: Legora reports the launch of its Arabic interface, built with Al Tamimi's lawyers. Al Tamimi's chairman says: "We worked with Legora's competitors. We tried different systems." (Legora)
- 8 October 2026: Al Tamimi's logo is still on Harvey's customer page.
Arabic was a stated aim of both partnerships. On the public facts, Legora has the Arabic interface and is hiring in Dubai, while Harvey lists some Gulf legislation among its sources, supports Arabic in its translation workflows and counts 80% of the Am Law 100 as users. Neither publishes a price or a Gulf hosting region. When a vendor names a Gulf firm as a reference, ask which product tier that firm uses and where its data is processed.
Tools built for the Gulf and for Arabic law
A few regional tools answer the hosting question differently. Qistas, headquartered in Amman with offices in Dubai, Abu Dhabi and Riyadh, offers Arabic and English legal research across nine Arab jurisdictions, with AI assistants (Qistas). It says "Institutions can run the platform inside their own infrastructure, so data never leaves their environment" (Qistas). It does not name its AI providers, and I found no SOC 2 or ISO certificate on its pages.
HAQQ, from Lebanon, offers a "Middle East" region without naming the country or the cloud, as well as deployment in a firm's own cloud or on its premises, and marks each security standard "Not certified" (HAQQ). realLaw AI, in Dubai, stores its UAE legislation database in the UAE and runs its MCP server in Finland (realLaw). Laiwyer, in Qatar, covers laws and rulings for Qatar, the UAE, Saudi Arabia and Egypt, and does not state where it hosts data (Laiwyer).
The Arabic legal AI tool on this site compares the options for Arabic legal work.
What to ask a legal AI vendor before you sign
- Where the model runs, written into the contract next to where files are stored.
- Which model providers process your data in your region, and whether you can switch each one off.
- Whether the model providers keep anything, and whether anyone reviews prompts.
- Who at the vendor can open client files, and on what trigger.
- Which company holds the data, and what the vendor does when a foreign court orders it to keep or hand over data.
- The audit report, and the scope of each certificate.
- Where each connector sends data. OpenAI states that data sent to an external app or MCP server follows that provider's own terms, and the same question applies to each tool's links to iManage, NetDocuments or SharePoint.
When a private system is the only option that meets a residency requirement
I found no Gulf law that requires a law firm to keep client data in the country. The data protection laws of the UAE, the DIFC, ADGM and Saudi Arabia regulate transfers and do not require localisation (the rules by jurisdiction). Sector rules, such as those on health data, may differ, and I did not read them. So, outside sector rules like those, a firm's residency requirement usually comes from a client contract or from its own policy.
The public pages sort the six tools by what they can promise:
- Data and model in the UAE: ChatGPT Enterprise, for new workspaces and two models, with text extraction, routing and connected apps possibly outside. Copilot keeps data at rest in the UAE and expects in-country processing by the end of 2026.
- Data and model in Saudi Arabia, Qatar or another Gulf state: none of the six. Copilot can keep data at rest in Qatar, and its model calls may still leave.
- Processing inside the DIFC or ADGM, or no outside company holding the files: none of the six.
In the last two cases, a system on infrastructure the firm controls is the only option I found. A firm can buy one, since Qistas and HAQQ offer on-premise deployment, or have one built. A system built for the firm takes one of two shapes (ChatGPT Business, Enterprise or private AI):
- The firm's own cloud account in a UAE region. On Azure, only regional deployment types keep processing in the region. In UAE North, as of October 2026, the regional chat models are provisioned deployments with reserved capacity, and the pay-per-token regional option lists embedding and speech-to-text models only (Azure availability table). On AWS, the Bedrock table for me-central-1 shows two Amazon Nova models running in-region, and the rest use global routing (Bedrock regions). The cloud provider stays the firm's processor.
- Open-weights models on the firm's own hardware. Nothing leaves the building. The local model I benchmarked this way still trails the largest cloud models on hard reasoning, and the hardware is paid for up front.
Outside the UAE, I did not check which models the cloud providers run in-country. The own-hardware shape works in any jurisdiction.
Harvey's General Counsel, quoted in the Harvey section, writes that data held by a US-subject provider stays reachable under the CLOUD Act wherever it is stored; his post is about European companies, and Harvey says it has never received such a request. The same post says the Act does not "override conflicting foreign laws automatically" and calls such requests "exceedingly unlikely" for Harvey. On my reading, the same question applies to a Gulf firm whose provider is subject to US law, whichever region it picks. On hardware the firm owns, no outside company holds the files, and none of the vendor questions above applies.
A private system also gives something up. It comes without the platforms' licensed content, such as Lexis Middle East or Westlaw, and answers only from the sources the firm loads into it. The Harvey, Legora or private AI tool on this site walks through these trade-offs for your firm.