UAE Healthcare AI Landing Checklist

Federal data localisation: Law 2/2019 Art. 13 and Resolution 51/2021

This applies everywhere in the UAE. It's the reason patient data can't simply sit in your existing US or EU region.

Federal Law No. 2 of 2019, on the use of ICT in health fields, was issued on 6 Feb 2019 and took effect on 14 May 2019. We found no amendments as of 18 Oct 2026. Official

"It is not permissible to store, process, generate or transform the health data and information outside State, which are related to the health services provided inside State, except in the case where a resolution is issued from the Health Authority in coordination with the Ministry."

Breaching Art. 13 can bring a fine of AED 500,000 to 700,000 (Art. 24). Official

Exceptions. Ministerial Resolution No. 51 of 2021 (in force 16 May 2021) sets out about ten cases where health data may leave the UAE. Each comes with its own conditions, such as patient consent, encryption, anonymisation, or keeping a copy in the UAE. The cases include treatment abroad, testing samples abroad, scientific research approved by the emirate's health authority, insurance claims, pharmacovigilance, telehealth services, patient requests, simple wearables, and other cases a health authority approves. Secondary

• Map every place patient data is stored, processed or generated.Include logs, caches, queues, analytics, backups, DR copies, support tooling and sub-processors.
• Confirm each of those sits in a UAE region or on premises in the UAE.
• For any flow that leaves the UAE, name the specific Resolution 51/2021 exception and meet its conditions.If you can't name one, the flow is a defect.
• Get written hosting-location commitments from every sub-processor that touches health data.

• UAE Legislation: Federal Law No. 2 of 2019 · official
• EHS: English text of the law, Art. 13 · official, alternate translation
• CMS: new data-transfer permissions (Res. 51/2021), Jun 2021 · secondary
• Baker McKenzie / Global Compliance News, Jul 2021 · secondary
• trade.gov: UAE limits cross-border health data flows, Jan 2024 · secondary

Abu Dhabi: DoH Responsible AI Standard (Oct 2025)

If your buyer is licensed by the Department of Health – Abu Dhabi, this standard governs the AI you sell them.

Reference DoH/ST/DDGO/RAI/V1/2025, published and effective in October 2025, with revision due in October 2026. No transition period is stated. Official

Who it binds. It applies to "all licensed healthcare entities within the Emirate of Abu Dhabi that are engaged in the development, procurement, or deployment of artificial intelligence (AI) systems", including systems "sourced from third-party vendors" (clause 1.2). Vendors are covered through the licensed entity that buys from them: the standard places no registration or licensing duty on vendors directly. Expect those obligations to reach you through contracts and procurement. Official

"The compute and storage infrastructure of AI systems for both active and disaster recovery sites must be situated within the UAE. Additionally, remote access for development and support teams should be exclusively from within the UAE."

"Production data shall not be used to train the model."

Risk tiers. Very High risk systems are prohibited from deployment. High risk systems "must undergo conformity assessments both prior to and following deployment", carried out in coordination with DoH's Data and Digital Governance Office (DDGO) (clause 3.3.1.2.2.2). Medium risk brings governance and risk-reporting duties. Low and Very Low risk systems are exempt from formal reporting but are still monitored. Official

Oversight. DoH "will conduct periodic audits and technical assessments of all regulated entities" (clause 5.1). Entities report their compliance status to DoH periodically, and sanctions apply under the Abu Dhabi Healthcare Sector Disciplinary Regulations (clause 6.1). Official

• Inference, storage and DR for the AI system all run in UAE regions.
• Development and support access to production comes only from inside the UAE.For example, through a UAE-hosted bastion or VDI used by UAE-based staff, with every session logged.
• Production data is technically blocked from any training or fine-tuning pipeline, and the contract says so.
• The buyer has classified the system's risk tier, and you agree with the reasoning.
• If the system is High risk: conformity assessment evidence is ready before deployment, with a plan for the post-deployment assessment.
• An auditable validation statement exists for this deployment and this population.

• DoH: Responsible AI Standard V1 (PDF) · official; clauses 1.2, 3.1.4.4.2, 3.1.4.5.1, 3.3.1.2.2.2, 5.1, 6.1

Abu Dhabi: ADHICS v2

The Abu Dhabi Healthcare Information and Cyber Security Standard is the control set a hospital's security team will audit you against.

Reference DOH/SD/ICSO/ADHICS/V2/2024, published in May 2024 and effective from August 2024. It applies to any Abu Dhabi entity handling health information, including technology and service providers. Entities must comply within six months of onboarding or of the standard's release, whichever comes first. Official

"Ensure health information and its copies in any form, whether encrypted, anonymized, deidentified, pseudonymized, etc., are not stored, processed, or transferred outside the UAE."

"Ensure cloud environment is physically hosted within UAE without any of the environments, infrastructures, or systems outside the country including backup and disaster recovery."

Other residency controls Official:

• No remote support from outside the UAE (CS 1.2(3)(c)).
• Support is provided from within the UAE unless DoH grants an exemption (CO 9.2(7)).
• No development lifecycle activity outside the UAE (SA 2.1(8)).
• No sharing of identified or de-identified data with third parties without DoH authorisation (CO 9.2(8)).

• Nothing derived from patient data leaves the UAE, including anonymised or de-identified data, unless DoH has granted a written exemption.
• Every environment, including dev, test, backup and DR, is physically hosted in the UAE.
• The support model works without any offshore access, or a DoH exemption is on file.
• No development lifecycle activity on the system happens outside the UAE.
• Encryption keys are managed outside the cloud provider's control (customer-managed keys or an HSM).
• An ADHICS control mapping for your product is ready to hand to the buyer's CISO.

• DoH: ADHICS v2 standard (PDF) · official; DP 1.3, CS 1.2, CO 9.2, SA 2.1

Dubai: DHA Policy for Use of AI in Healthcare

If your buyer is licensed by the Dubai Health Authority, or you use Dubai patient data, this policy applies.

The DHA policy (ref. DHA/HISHD/PP-09) was issued on 1 Jul 2021 and took effect on 1 Oct 2021. It covers DHA-licensed facilities and professionals that use AI, and developers that use Dubai patient data. Its listed revision date, 1 Jul 2026, has passed, and we found no newer version. Official

"All AI solutions for healthcare must contain disclosure including… b. How AI solution was validated. c. Which data sets were/must be used… e. What the role of the healthcare professional is in making a final decision."

The policy also requires the following. Official

• Independent validation "by a competent third party" (4.3.3).
• AI decisions that designated end users can override or reverse (4.4.2).
• Accountability for outcomes agreed among the designer, researcher, developer, operators or commissioners, and end users (4.2.1), so it doesn't rest on the clinician alone.
• End users to report known or suspected incidents to DHA (4.8.1).
• Compliance with Federal Law No. 2 of 2019 (4.6.2), which is where the data-localisation rule comes from.

• A disclosure document covers how the tool was validated, which datasets were used, and the clinician's role in the final decision.
• Validation was done, or reviewed, by a competent independent third party.
• Designated users can override or reverse every AI output, and overrides are logged.
• Accountability across vendor, facility and clinicians is written into the contract.
• The incident process includes reporting to DHA.

• DHA: Policy for Use of AI in the Healthcare (PDF) · official; 4.2.1, 4.3.2, 4.3.3, 4.4.2, 4.6.2, 4.8.1
• DHA circular CIR-2021-00000141 (22 Aug 2021) announcing the policy · official
• Bird & Bird: Dubai insights on AI and data protection from the DHA circular, Mar 2025 · secondary; gives no circular number

Health information exchanges: NABIDH, Malaffi, Riayati

If your AI reads from or writes to the patient record, expect to touch the emirate's exchange, or at least to sit next to a hospital system that does.

• You know which exchange your buyer connects to, and whether your workflow needs to read from it, write to it, or neither.
• Your integration speaks HL7 v2 (required in practice) and FHIR where the hospital's EMR supports it.
• Integration goes through the hospital's EMR or integration engine, not directly to the exchange, unless the authority has approved otherwise.
• It's agreed whether AI-generated content (notes, codes) can reach the exchange, and only after clinician sign-off.

• DHA circular CIR-2025-00000101 (archived copy, 12 Jun 2026; the live link currently returns 404) · official, via archive
• DHA: NABIDH interoperability and data exchange standards (DHA/HISHD/ST-02) · official
• DoH circular 10/2026 (19 Jan 2026): Malaffi connection · official
• DoH circular 30/2026 (19 Feb 2026) · official
• DoH circular 144/2026 (28 Jul 2026) · official
• MOHAP: health authorities consolidate data in Riayati, 7 Dec 2021 · official
• DoH: Riayati, Malaffi and NABIDH integration, 31 Jan 2023 · official

Medical-device status: Emirates Drug Establishment and SaMD

Is your AI a medical device in the UAE? You need a reasoned answer before procurement asks for one.

Federal Decree-Law No. 28 of 2023 created the Emirates Drug Establishment (EDE), which now issues marketing authorisations for medical devices, taking over that work from MOHAP. Federal Decree-Law No. 38 of 2024 defines medical equipment to include its "operating software" and "products based on AI technology". Official

EDE's marketing-authorisation service asks for a reference conformity certificate or marketing authorisation, "such as EC, 510 (K), PMA as per the classification of the equipment, i.e. Class I, II, III, IV". It lists a 45-working-day timeline and a five-year certificate. Official

• You have a written position on whether the product is a medical device in the UAE, with your reasoning.
• If it is a device: your reference approvals (CE / 510(k) / PMA) and class are documented, and the EDE route is planned.
• Your marketing and intended-use claims match that position. Scribe or admin claims that drift into diagnosis change the answer.
• If classification is unclear, you've asked EDE, not assumed.

• UAE Legislation: Federal Decree-Law No. 38 of 2024 (medical products) · official
• EDE: issuance of marketing authorisation for a medical device · official
• MOHAP: services transferred to EDE (updated 30 Dec 2025) · official

UAE cloud regions

Where you can actually run it. Each option has trade-offs, and the 2026 conflict made regional resilience a real design input.

• The buyer has confirmed which provider and region they will accept.Many have existing agreements with one provider.
• The DR target is also in the UAE (ADHICS CS 1.2(2)), and a failover has actually been tested.
• GPU and model availability in the chosen UAE region is confirmed for your workload.Many hosted model APIs aren't offered in UAE regions, so check before you commit.

• Microsoft Learn: Azure regions list (updated 13 Oct 2026) · official
• Core42: Sovereign Public Cloud brochure (Apr 2026) · official
• Oracle: OCI regions · official
• Google Cloud: regions and zones (updated 15 Oct 2026) · official
• AWS News Blog: UAE region launch, 29 Aug 2022 · official
• The Stack: AWS me-central-1 status, 2 Mar 2026 · secondary, quotes the AWS status page
• Gulf Daily News (Reuters): AWS facilities struck · secondary
• InfoQ: AWS Middle East data loss, 21 Sep 2026 · secondary, quotes AWS
• Khaleej Times (Reuters): AWS unable to restore UAE zone data, 16 Sep 2026 · secondary
• WAM: Alibaba Cloud second Dubai data centre · secondary
• Khazna: e& and G42 form Khazna Data Centers · company

The evidence pack buyers ask for

Our judgement, not a regulatory list: these are the documents that shorten procurement when they're ready on day one.

• A data-boundary diagram, plus a sub-processor list with hosting locations
• An access model: who can reach production, from where, and how it's logged
• A validation statement covering UAE languages and population
• An ADHICS v2 control mapping, plus your most recent independent security test
• An incident process with named roles, a kill switch and notification timelines
• A written commitment that production data is never used for training (DoH RAI 3.1.4.4.2)
• A position on medical-device status, with the reasoning and any registrations