Using AI in a Dubai clinic: what DHA rules allow, and what they require

Posted on Oct 28 • Originally published at azrty.com

Clinic owners in Dubai ask us the same question every month: can we use AI for bookings, reminders, insurance pre-authorisation and doctors' notes without falling foul of the Dubai Health Authority (DHA)? The answer is yes, and the rules that shape the project are clearer than most people expect. Four requirements do most of the work: Arabic for anything the patient sees, a licensed clinician's signature on anything clinical, health data that stays inside the UAE, and audit logs you can produce when an inspector asks. This piece sets out what the documents actually say, picks the three uses worth starting with, and lists the questions to put to any vendor.

There is no single "DHA AI licence" for private clinics. What exists is a small stack of documents that, read together, tell you exactly where the lines are. DHA takes AI seriously on its own side of the fence: it has a Chief Artificial Intelligence Officer, Fatima Al Khaja, and during Dubai AI Week in April 2025 it launched an AI training programme covering everything from an executive diploma with ESCP Business School to prompt-engineering training, while encouraging private healthcare facilities to participate. A month later it put AI-driven privacy monitoring, Imprivata's Patient Privacy Intelligence, inside the NABIDH platform itself, to detect unauthorised access to patient records in real time.

Here is the stack, and what each layer means for your project:

A note on scope, because it matters: the DHA AI Policy formally governs how DHA itself and its vendors use AI, not a licensing regime for private clinics. But it is the regulator's own standard, it is unusually specific, and it is what any vendor building for you will be measured against the day a private-sector equivalent is formalised. Treat it as your design brief.

The DHA AI Policy, Article 8.3, requires patient-facing AI interfaces to display information in Arabic, with support for text recognition and cultural context alignment. The Telehealth Standards go further for anything remotely clinical: physician credentials must be available in both Arabic and English (Appendix 5.2.5), and any information a patient needs before a virtual consultation must be provided in both languages (Appendix 5.2.6).

What this means in practice: your WhatsApp booking agent defaults to the patient's language, with proper Arabic (right-to-left rendering, formal register, correct transliteration of clinic names) as a first-class output, not a machine-translated afterthought. Test it with Arabic-speaking front-desk staff before any patient sees it. A 2026 Dubai practitioner guide makes the same point bluntly: patient-facing AI in Dubai requires Arabic support, and generic translation is where most implementations fail.

Article 8.4 of the DHA AI Policy is unambiguous: any AI-generated clinical content must be clearly labelled, and reviewed and verified by a qualified licensed healthcare professional. Article 3.1 reinforces the point: AI is a supportive tool, and liability does not transfer to it.

This is the rule that makes the "AI doctor's notes" project safe if you design it correctly. The note the model drafts is a draft. It sits in a pending_signoff state, with the model name, prompt version and reviewer recorded. It does not sync to NABIDH, does not go to an insurer, and does not appear in the patient's file until a licensed clinician has opened it, corrected it and signed it. That workflow is not a burden; it is the regulatory argument for the use case.

Two layers here. Article 8.7 of the DHA AI Policy requires that all AI inputs and outputs, including patient data, be stored and processed exclusively within UAE data centres. Above that sits Federal Law No. 2 of 2019: Article 13 bars health data related to services provided inside the UAE from being stored, processed, generated or transferred outside the country except by resolution of the health authority in coordination with the Ministry. Article 24 sets the penalty for breaching Article 13 at AED 500,000 to 700,000, and Article 20 sets minimum record retention at 25 years. The Telehealth Standards add the Dubai-specific layer: the telehealth platform must be capable of storing all patient records on Dubai-based servers (Appendix 7.1.6).

The practical consequence for your architecture: nothing carrying a patient name, Emirates ID, diagnosis or lab result goes to a hosted model endpoint outside the UAE. Not in the prompt, not in the logs, not in the vendor's training pipeline. Ask for region pinning at the API level, and ask what happens to prompts after processing.

The NABIDH Audit Policy requires audit logs to be retained for 3 years and reviewed at least quarterly to detect improper use of patient information, with external audits at least annually. The log must be able to answer specific questions: which users accessed a given patient's record, which patients' data a given user accessed, every break-glass event, and every access to data marked sensitive. DHA audits the NABIDH platform and its vendors annually, and since April 2025 the platform itself watches for anomalous access patterns with AI.

Not every AI use case carries the same regulatory weight. Here are the three that pay for themselves fastest under these rules, in the order we recommend:

Start with reminders: lowest risk, and the numbers move immediately. Pre-authorisation is the strongest first pilot for a clinic with meaningful insurance volume: document-heavy, high-volume, financially significant, and it still allows human review before anything is submitted, which is how one Dubai healthcare vendor frames it in its published guidance on agentic AI for Dubai hospitals and clinics. Notes come third, once the audit trail and sign-off workflow are proven on lower-stakes work.

Take a typical outpatient clinic: two GPs, two specialists, roughly 1,100 consultations a month. About 60 per cent of visits are insurance-covered, and on a typical outpatient mix (imaging, minor procedures, some referrals) around 160 cases a month need pre-authorisation.

The agent never decides clinical necessity, never invents justification, and never submits anything. It gathers, sorts and checks; a human submits. That is what keeps it on the right side of Article 8.4.

Two technical decisions carry most of the compliance load: where the model runs, and what you log.

Routing. Put a gateway in front of your models so that patient-identifiable traffic is pinned to UAE-hosted infrastructure and nothing else. Our FastLLM Proxy does exactly this: an OpenAI-compatible gateway with routing, budgets and access control in one place. The configuration principle, whatever gateway you use:

# Illustrative gateway policy: patient data never leaves the UAE zone routes: - id: preauth-drafting match: header: x-data-class: phi # set by the integration layer providers: - name: uae-selfhosted-llm endpoint: https://llm.clinic.internal/v1 model: qwen2.5-14b-instruct # UAE data centre, self-hosted fallback: reject # no external fallback for patient data, ever log: full # prompt + completion retained 3 years budget: monthly_usd: 400 - id: marketing-copy match: header: x-data-class: public providers: - name: hosted-llm # fine: no patient data on this route fallback: reject log: minimal Enter fullscreen mode Exit fullscreen mode Audit records. Every AI generation tied to a patient case should produce a record an inspector can read:

Print this section and take it to your next vendor meeting:

If a vendor cannot answer 1, 4 or 8 without checking with someone, they are not ready for a Dubai clinic.

This is work we do with clinics in the UAE from our base in Dubai: our own team handles the consulting, the deployment and the support. If you want the architecture and the agents built on your infrastructure with these controls from day one, that is our AI engineering service. Start with one workflow, prove it, and let the audit trail you build there carry the next three.