Bruxford Sovereign AI
العربية

“The compute and storage infrastructure of AI systems for both active and disaster recovery sites must be situated within the UAE.”

Department of Health Abu Dhabi, Responsible AI Standard, October 20253.1.4.5.1

We put healthcare AI inside the UAE, and document that it complies.

For global AI vendors selling to UAE hospitals, and for hospitals running AI they have bought: hosting in a UAE region, accuracy validation in Arabic and English, DoH and DHA documentation, and integration with EMRs and health information exchanges.

Read the landing checklistEmail us about a project

Three more rules your buyer will check

  • Federal Law 2/2019, Art. 13

    Health data about health services provided in the UAE may not be stored, processed or transferred outside the UAE, except in cases set by resolution.

  • DoH RAI 3.1.4.4.2

    Production data shall not be used to train the model.

  • ADHICS v2, DP 1.3

    Health data stays in the UAE even when anonymised or de-identified, unless DoH grants an exemption.

Summaries only. Quotes and sources are in the checklist. Checked 18 Oct 2026. Not legal advice.

Two sides of the same deployment

Global AI vendors

You have a product and a UAE buyer. Now it has to run here.

  • Your stack runs in US or EU regions, but Abu Dhabi hospitals need AI compute and storage in the UAE.
  • You validated your tool on another country's patients and languages.
  • Your development and support engineers work outside the UAE.
  • Procurement wants documents your team has never had to write.

UAE hospitals and clinic groups

You've bought AI tools. Now you have to show they comply.

  • Scribes, triage, imaging and coding tools are already in production.
  • In Abu Dhabi, the DoH standard binds the licensed facility, including for AI it buys from third-party vendors.
  • Vendors answer questionnaires with marketing copy, not evidence.
  • Nobody owns the risk classification, the monitoring or the incident process.

Four packages, each at a fixed price

Take one, or chain them: Landing, then Validate, then Integrate. Every package has a fixed price, agreed in writing after a scoping call.

For AI vendors, usually in this order

Landing

AI vendors entering the UAE

Get your product into a UAE region, with a data boundary you can defend to a hospital's security team.

  • Deployment architecture in a UAE region, on the cloud your buyer accepts
  • Data-boundary design: what stays in the country, what may leave, and how support access works
  • Gap assessment against the DoH Responsible AI Standard, ADHICS v2 and DHA requirements
  • A prioritised remediation plan, plus the documents a hospital's procurement team asks for
3–4 weeks

Fixed price, scoped in a call

Validate

AI vendors and hospitals

Show that the tool works on UAE patients, in the languages they speak, with evidence an auditor can follow.

  • A study protocol, with acceptance thresholds set before testing starts
  • An accuracy study on Arabic and English UAE clinical text or audio, using synthetic data plus consented samples processed in the UAE
  • Subgroup and error analysis by language, dialect and setting
  • An auditable validation statement, with the evidence behind it
4–8 weeks

Fixed price, scoped in a call

Integrate

AI vendors with a hospital deal

Connect to the hospital's EMR and to the emirate's health information exchange.

  • Integration design, worked out with the hospital's IT team and EMR
  • Connectors built and tested in the hospital's environment
  • NABIDH, Malaffi or Riayati touchpoints, where your workflow needs them
  • A go-live runbook, monitoring and handover
4–10 weeks

Fixed price, scoped in a call

For hospitals and clinic groups

Govern

Hospitals and clinic groups

Bring AI you've already bought into line with the DoH Responsible AI Standard.

  • An AI inventory, with a risk classification for every tool in production
  • Vendor questionnaires covering hosting, access, training data and validation
  • Preparation and evidence packs for conformity assessments of high-risk systems
  • Optional retainer: quarterly monitoring reviews and re-validation triggers
4–6 weeks, then an optional retainer

Fixed price, scoped in a call

Bars show the typical duration on a 0 to 10 week scale.

How an engagement runs

  1. Scoping call

    30 minutes on your product, your buyer, the emirate and your deadline.

  2. Written scope

    A fixed price, the deliverables, a timeline, and what we need from you.

  3. Delivery in the UAE

    Patient data stays in the UAE, and any work that touches it is done from inside the country.

  4. Evidence handover

    Documents, code, and an evidence index your buyer, auditor or regulator can follow.

Free references

Straight answers

Are you a law firm?

No. We're a technical and compliance consultancy, licensed in Dubai for management and IT consulting. We do the architecture, validation, integration and evidence work, and we work alongside your legal counsel. Nothing we publish is legal advice.

Do you host our product?

No. We design and deploy it in a UAE region of a cloud that you or your buyer choose, under your own accounts. You keep control of your infrastructure and your data.

Will you need our patient data?

Only for validation, only with consent or approval, and only inside the UAE. Wherever we can, we start with synthetic data.

Which emirates do you cover?

Abu Dhabi (DoH), Dubai (DHA), and facilities under the federal Ministry of Health and Prevention (MOHAP) and Emirates Health Services (EHS). The rules differ by emirate, and the checklist shows where.

Why fixed prices?

Because you need a number you can take to your board. We scope the work in a call, then put the price, deliverables and timeline in writing.

Landing in the UAE?

Tell us your product, your buyer and your deadline. We'll reply with the questions that matter and an outline scope.

hello@bruxford.com