The ASP lock-in questions nobody asks before 30 October

The Ministry of Finance gave Phase 1 businesses three extra months. The May 2026 amendment to Ministerial Decision No. 244 of 2025 moved the appointment deadline from 31 July to 30 October 2026. What it did not change is the nature of the decision — and the nature of the decision is what most selection processes are getting wrong.

With roughly 32 Accredited Service Providers on the register, the market has produced what markets always produce: comparison content. Feature matrices. Pricing tiers. Integration checklists. All of it useful, none of it sufficient, because every one of those guides evaluates the relationship at its beginning. The questions that determine whether you have bought a service or signed yourself into dependency are all questions about the end.

Here are the five we believe every Phase 1 firm should put in writing to every shortlisted provider before October.

1. Who holds the cryptographic keys?

The UAE model runs on a five-corner Peppol exchange, and the technical trust in that exchange rests on certificates and signing material. The question is blunt: are the keys that identify your business held by you, or held by your provider on your behalf?

If the answer is the latter — and for most SaaS-style offerings it will be — then ask the follow-up: what is the documented procedure, and the documented timeframe, for transferring or re-issuing that material if you change provider? A provider who cannot answer in writing has not built the procedure. You will be the one who discovers that, at the worst possible moment.

2. Can you export your full invoice archive — in what format, at what cost, in what timeframe?

Your cleared and exchanged invoices are a legal record you are obliged to retain, and they are also the most granular commercial dataset your business produces. Both of those facts argue for the same test: ask for a written commitment to full archive export in a structured, machine-readable format — not PDF renderings, the structured XML — with a stated cost and a stated turnaround.

The answers vary more than you would expect. Some providers include export in the contract. Some price it per record. Some quote "professional services" — which is a number that gets decided after you have announced you are leaving, when your negotiating position is at its weakest. Get the number now, while they still want your signature.

3. What happens to in-flight invoices during a migration?

Invoicing does not pause for a vendor change. On the day you cut over, there will be invoices issued but not yet transmitted, transmitted but not yet acknowledged, and disputed documents waiting on credit notes. Ask each provider to describe — specifically, not reassuringly — how documents in each of those states are handled during an exit: who completes the transmission, how acknowledgements are routed after the switch, and how the audit trail stays continuous across two providers.

A typical failure pattern looks like this: the old provider stops accepting submissions on the contract end date, the new provider's connection goes live three days later, and nobody owns the gap. The fix is contractual, and it has to be negotiated before signature, because no provider volunteers an overlap obligation afterwards.

4. Does the contract bind you through the first mandate revision?

The UAE framework will change. Every e-invoicing regime in the region has revised its technical requirements after go-live, and there is no reason to expect the UAE's data dictionary, validation rules, and process documentation to stay frozen through 2027 and 2028. The contractual question is whether you are locked in across that first revision cycle.

A two- or three-year initial term looks unremarkable on a pricing page. But it means your first realistic exit window arrives after the provider has rebuilt its product for revision one — and after you have paid for whatever "regulatory change" fees the contract permits. Look for the change-fee clause, the term length, and the renewal mechanics together. They are one question wearing three disguises.

5. Is the integration code yours?

Somebody is going to write the mapping between your ERP and the PINT AE format: field mappings, tax-code translations, enrichment logic, error handling. That work encodes months of decisions about your own data. If it lives inside the provider's platform as proprietary configuration, it leaves with them. If it is delivered as artefacts you own — documented mappings, source code, transformation specifications — then your next implementation starts from ninety per cent done rather than zero.

Ask for the intellectual property clause that covers integration deliverables, and ask what you would physically receive on exit. The difference between "you may request a copy of your configuration" and "the mapping specifications are your property" is the difference between a service and a hostage arrangement.

The cost of not deciding

Cabinet Decision No. 106 of 2025 puts numbers on delay: AED 5,000 per month for failing to appoint an ASP, and AED 100 per non-compliant invoice, capped at AED 5,000 per month. Those figures are modest enough that some firms will be tempted to treat the deadline casually. We would read them differently — the penalties are calibrated to make non-appointment irritating rather than ruinous, which means the real risk was never the fine. The real risk is making a rushed appointment in October that you spend three years regretting.

Ask everyone. Including us.

ClayDesk operates in this market, so read this article with appropriate scepticism: a provider telling you which questions to ask providers. Our defence is simple — put these five questions to every name on your shortlist, including ours, in writing, and compare the answers.

Ours, for the record: the keys are yours, the integration code is yours, and the archives are yours — in structured format, at no exit fee, on a stated timeline. We hold that position because we think the providers who win the next decade of this market will be the ones who never needed lock-in to keep their clients.