IT AMC SLA Guide for
Dubai Businesses

Photo by Austin Distel on Unsplash

P1–P4 Priority Levels: What They Mean in Practice

When your server goes down at 9am on a Monday, you want your IT provider to treat it differently than a request to install a printer on Thursday afternoon. Priority levels — typically P1 through P4 — are how professional IT AMC contracts formalise that difference. Without defined priorities, every issue becomes urgent and none of them get the urgency they deserve.

Here is how the levels generally break down in a UAE business context:

The table looks simple, but the disputes happen in the grey area. If your POS system at a retail outlet stops working, is that P1 (revenue is halting) or P2 (staff can process cash)? Your contract should include worked examples for your specific business type — this is something worth pushing for during negotiation, especially if you operate a customer-facing environment.

Who Classifies the Priority?

A common tension in IT support is that clients often classify their own issues as P1 while engineers assess them as P3. A good AMC contract assigns initial classification responsibility to the client but gives the provider's first responder authority to reclassify with a documented reason. That stops the process becoming adversarial, and it creates an audit trail if there is a dispute later.

Response Time vs Resolution Time: Not the Same Thing

These two terms get conflated constantly, and the distinction is financially important. Understanding both is central to evaluating any managed IT contract.

Response time is how long it takes for an engineer to acknowledge your ticket and begin active work. "Active work" typically means the engineer has logged in remotely, called you, or is physically en route to your site. It is not the time your ticket sits in a queue unread.

Resolution time is when the issue is fully fixed and the affected service is restored to normal operation. This is harder to define precisely, which is why many providers are much more specific about response commitments than resolution commitments.

A well-structured SLA will list both, along with what constitutes "clock stop" events — situations where the resolution clock pauses. Common clock stop events include waiting for a part to be delivered, waiting for a third-party vendor to respond (like a hardware manufacturer), or waiting for the client to provide access to a system. Make sure these are documented in writing, not just explained verbally by the sales rep.

Calculating Real SLA Performance

If your provider reports 98% SLA compliance but has had three P1 outages that lasted six hours each, the raw percentage means little. Ask for SLA reports that break down compliance by priority level, not just an aggregate figure. Any provider offering onsite IT support across the UAE should be able to produce monthly performance reports as a standard deliverable.

What Is Typically Excluded from an IT AMC

The exclusions section is the part most businesses do not read carefully enough. These are the scenarios where you call your provider in a crisis and discover, at the worst possible moment, that the contract does not cover the problem in front of you.

Standard exclusions across most UAE IT AMC contracts include:

• ISP and telecommunications outages. If your internet goes down because Etisalat or du has a line issue, your IT provider cannot fix that. They can help you manage around it — activating a backup SIM, configuring failover — but the outage itself is outside their scope. This is worth noting because ISP issues account for a disproportionately high share of P1 calls.
• Power failure and UPS faults. Unless your contract explicitly includes electrical systems, power-related outages are typically excluded. Many UAE offices experience brief power cuts during summer, and the resulting server restart issues can masquerade as hardware faults. Make sure your contract is clear on this.
• Physical damage. Water ingress, fire, impact damage from dropped hardware — these are generally excluded and handled by your property or equipment insurer, not your IT provider. Some contracts include data recovery assistance even if the cause of damage is excluded, which is a useful clause to request.
• End-user-caused data loss. If a staff member deletes a folder or accidentally formats a drive, most contracts class this as out of scope unless a backup and recovery service is included. This is a gap worth filling — data recovery services should be listed explicitly in your contract appendix.
• Third-party software bugs. If a vendor update breaks an ERP system, the issue is between you and your ERP vendor. Your IT provider can assist with the environment (server, network, access), but cannot be held to resolution time targets for code they did not write and cannot patch.

The practical implication is that your IT AMC contract should be read alongside your list of critical systems. Map each system to a potential failure mode and check whether that failure mode is in or out of scope. If you find gaps, raise them before signing.

Escalation Paths That Actually Work

A good escalation path answers one question: if the first engineer cannot fix the problem in the committed time, what happens next? Without a documented escalation process, issues can stall for hours while the engineer escalates internally using whatever informal channel they happen to know.

Professional IT AMC contracts structure escalation by time elapsed and severity. A typical example for P1 incidents:

• T+0: Ticket received; first-line helpdesk acknowledges and begins remote diagnosis
• T+30 minutes: If not resolved, senior engineer joins the session
• T+1 hour: Onsite dispatch authorised; client technical contact notified
• T+2 hours: Account manager or service delivery manager notified
• T+4 hours: Director-level notification; vendor escalation initiated if third-party system is involved

The specific times will vary by provider, but the principle — defined checkpoints, named roles, and automatic rather than manual escalation — is non-negotiable for critical infrastructure. If your provider cannot articulate this process, ask for it in writing. Vague verbal assurances about "escalating to senior engineers" are not a substitute for documented procedure.

Escalation Contacts on Your Side

Escalation works in both directions. Your provider needs named contacts on your side who are authorised to approve out-of-scope work, allow emergency access, or make decisions about system downtime. Define these roles in the contract — typically a primary technical contact and a secondary with full authority when the primary is unavailable.

24/7 Operations: Hotels, Hospitals, and Logistics

Standard AMC contracts are designed around a Monday-to-Friday, 9am-to-6pm service window. For most Dubai offices, that is adequate. For businesses that cannot tolerate even a few hours of downtime outside those hours, it is not.

Hotels operating at full capacity cannot wait until Sunday morning for a P1 server fault to be addressed — their property management system may be offline, blocking check-ins at 2am. Hospital radiology departments running PACS systems need imaging available around the clock. Logistics operators using WMS platforms to coordinate warehouse shifts need IT support when the shifts happen, not the next business day.

If your business falls into this category, the AMC contract needs explicit coverage for:

• On-call engineer availability outside business hours (not just a helpdesk voicemail)
• Response time commitments that apply regardless of time of day or day of week
• Cover during UAE public holidays — Eid, UAE National Day, New Year — when offices close but operations continue
• A named on-call contact and a verified process for reaching them, not just a generic support number

Expect to pay a premium for 24/7 coverage — typically 30–50% above a standard business-hours AMC. Whether that premium is justified depends entirely on the cost of an unplanned outage during off hours. For most hospitality or healthcare environments, a single night of operational disruption exceeds the annual cost difference. The IT AMC options available in the UAE vary significantly in how they price and structure extended coverage, so comparison shopping on this specific clause is worthwhile.

What to Negotiate Before Signing

Most IT AMC contracts arrive as standard templates. That does not mean they are fixed. These are the clauses worth pushing on:

Scope of Covered Assets

Get a hardware and software asset list attached to the contract as a schedule. If a device or system is not listed, it is almost certainly not covered. Review this list annually — equipment gets replaced, systems get added, and coverage gaps appear silently when the contract auto-renews without an asset review.

Preventive Maintenance Schedule

Reactive support (fixing things when they break) is only part of the value. Preventive maintenance — quarterly health checks, firmware updates, log reviews — should be documented with a minimum visit frequency. Without this clause, preventive work is discretionary on the provider's part.

Reporting Obligations

Ask for monthly reports covering: incidents by priority level, response time performance against SLA targets, open versus closed tickets, and any recurring issues. This data is how you hold the provider accountable and how you identify infrastructure problems before they escalate.

SLA Credits

If the provider misses their committed response time on a P1 incident, what happens? A strong contract includes a service credit mechanism — a small credit against future invoices for each SLA breach. Even if the credit is modest, the mechanism matters because it creates accountability and an audit trail.

Red Flags to Watch for in AMC Contracts

Having reviewed many IT AMC agreements for UAE businesses, these are the clauses that consistently cause problems:

• "Best efforts" language without committed times. If the contract says the provider will "endeavour to respond within a reasonable time," that is not an SLA. It is a vague promise that is impossible to enforce.
• Unlimited exclusions for "unforeseen circumstances." Some exclusion clauses are written so broadly that almost any complex outage can be classified as outside scope. Look for specific, enumerated exclusions rather than broad catch-all language.
• No auto-renewal opt-out window. Many contracts auto-renew with 30-day notice required to cancel. If you miss that window, you are locked in for another year. Set a calendar reminder 60 days before your renewal date to review the contract and renegotiate if needed.
• Hardware replacement not clearly defined. Understand whether the contract covers parts, labour, or both. "Parts at cost" and "parts included" are very different propositions when a server fails and needs a replacement drive.

If any of these appear in a contract you are reviewing, they are negotiating points, not fixed terms. A provider offering professional managed IT services in Dubai should be willing to clarify and strengthen the language on these specific points.