What an IT AMC actually covers in 2026
An IT Annual Maintenance Contract in Dubai is a fixed-fee agreement under which an IT services company owns the day-to-day health of your technology estate — endpoints, servers, network, firewalls, Wi-Fi, printers, backup and (increasingly) cloud tenants and SaaS identities. The right AMC replaces unpredictable break-fix invoices with a single monthly or annual number and a documented set of outcomes.
For a typical UAE SME (25-250 users), a modern AMC bundles four things: (1) unlimited remote and on-site support during agreed hours, (2) proactive monitoring and preventive maintenance, (3) patching, antivirus/EDR and backup management, and (4) a named engineer or account manager accountable for the relationship. Anything less is a reactive contract dressed up as managed services.
The 12-point IT AMC checklist for Dubai businesses
Use this as a scoring sheet when comparing IT services companies in Dubai. A credible AMC provider should say yes to every item and put each one in writing.
1. Coverage hours and 24/7 support — Standard business hours (Sun-Thu 8am-6pm) vs 24x7x365. Confirm which systems fall under after-hours cover — usually servers, firewalls and internet links, not end-user laptops.
2. Emergency response times (SLA) — For Dubai SMEs, expect P1 (site down / all users offline) response within 15-30 minutes, P2 (department affected) within 1 hour, P3 (single user) within 4 hours, and P4 (request) within 1 business day. Ask for response AND resolution targets, not just response.
3. On-site visits — Number of included on-site visits per month (typically 2-4 preventive plus unlimited reactive within Dubai), and travel-time coverage to Abu Dhabi, Sharjah and the Northern Emirates.
4. Preventive maintenance schedule — Monthly health checks on servers and firewalls, quarterly UPS load tests, semi-annual cabling and rack audits, annual DR test. Get the calendar in the contract.
5. Patch management — Windows, macOS, Linux, third-party apps and firmware. Patching windows, testing process, and rollback plan.
6. Cyber security baseline — EDR/antivirus, DNS filtering, MFA enforcement, phishing simulation, and a documented incident-response runbook. In 2026 this is not optional.
7. Backup and disaster recovery — Backup software, retention (typically 30-90 days), off-site / cloud copy, immutability, and monthly restore tests with a signed report.
8. Asset and license management — CMDB kept current, warranty tracking, and annual Microsoft/Adobe/antivirus license true-up so nothing lapses.
9. Ticketing and reporting — A real ticketing portal (not WhatsApp), monthly reports on tickets closed, SLA attainment, patch compliance and backup success rate.
10. Named engineer and escalation matrix — Primary engineer, backup engineer, technical lead and account manager, each with a direct phone number.
11. Vendor coordination — The AMC provider raises tickets with Etisalat/du, Microsoft, hardware OEMs and application vendors on your behalf, and stays on the call until resolution.
12. Exit clause and data ownership — 30-90 day notice, documented handover pack (passwords, network diagrams, licenses), and a clear statement that all documentation and data belong to you.
Response times: what is realistic in the UAE
Dubai's compact geography makes aggressive on-site SLAs achievable — a certified engineer can reach most of Business Bay, DIFC, JLT, Deira and Dubai Silicon Oasis within 60-90 minutes of dispatch. For Abu Dhabi and the Northern Emirates, budget 2-4 hours unless the provider has an engineer stationed there.
For remote response, the industry benchmark is a live engineer on the ticket within 15 minutes for critical issues. If a provider quotes '4 hour response' for a P1 site-down, that is a break-fix SLA, not a managed services SLA. Push back.
Pricing models and what drives cost
Most UAE IT services companies price AMCs per user per month (typical range AED 90-250) or per device (typical range AED 60-180). Enterprise and regulated clients (finance, healthcare, government-adjacent) sit at the top of the range because of compliance overhead — ISO 27001 evidence, UAE IA / NESA controls, and audit support all add cost.
The single biggest cost driver is not headcount — it is after-hours coverage and on-site frequency. A 100-user firm with 8x5 remote-first cover and monthly on-site visits will pay a fraction of the same firm on 24x7 with a resident engineer. Right-size to your actual risk: which systems truly cannot wait until morning?
Red flags when evaluating IT services companies in Dubai
No written SLA, or SLAs expressed only as 'best effort'. Support delivered exclusively over WhatsApp with no ticketing trail. Refusal to name the engineer who will be assigned. No monthly reporting. Backup and cyber security priced as costly add-ons rather than baseline. No professional indemnity or cyber insurance. No references from clients of similar size and sector in the UAE.
A credible provider will happily share sample monthly reports, an anonymized SLA-attainment record from the last 6 months, and put you in touch with two reference customers before you sign.
Key takeaways
- A real IT AMC in Dubai covers proactive monitoring, preventive maintenance, cyber security and backup — not just break-fix.
- Insist on written P1-P4 SLAs with both response AND resolution targets.
- Get the preventive-maintenance calendar, monthly report format and named engineer written into the contract.
- Price per user (AED 90-250) is normal; after-hours coverage and on-site frequency drive the range far more than headcount.
- Walk away from any provider without a ticketing system, monthly reports or a documented exit and data-handover clause.
