Using AI in a Dubai clinic, and what the DHA policy expects

The DHA's policy on artificial intelligence in healthcare expects AI used in a Dubai clinic to follow UAE and Dubai law on privacy and ethics, to be safe and secure, and to be supervised by the professionals who use it. It also asks clinics to report AI incidents to the DHA, educate staff and patients, and arrange regular independent audits.

Who the policy covers

The policy applies to every DHA licensed facility and professional that uses AI in healthcare services, to developers that use Dubai patient data to build AI, and to insurers, pharmaceutical companies and researchers that use AI in the emirate.¹ It was first issued in 2021 and lists 1 July 2026 as its revision date, so a clinic adopting AI this year should work from the current version on the DHA site.¹

It defines AI broadly, as technology that mimics human cognition in analysing, presenting and understanding complex medical and healthcare data.¹ An ambient scribe, an AI receptionist and a triage tool would all fall inside that definition. With about 5,800 licensed health facilities in Dubai in 2025, the policy reaches a large and growing market.²

AI already drafts the words patients read. In a study in JAMA Internal Medicine, clinicians preferred chatbot answers to patient questions over physician answers in 78.6% of evaluations, and the authors proposed the drafts be edited by clinicians before use.³ The DHA policy is written for tools of that kind.

The five principles

Ethics. AI must respect human values, patient autonomy and people's rights, and must be fair and avoid bias.¹
Accountability. Responsibility for outcomes is agreed between designer, developer, operator and end user, and AI must include a way for users to challenge significant decisions.¹
Transparency. Each solution must disclose which functions are AI enabled, how it was validated, which data sets were used, its limitations and the professional's role in the final decision, and must be independently validated by a competent third party.¹
Safety and security. AI must be safe, secure and supervised by its users, and tools that can significantly affect lives must allow designated users to override or reverse their decisions.¹
Privacy. AI must follow UAE and Dubai law on data governance and the protection of personal information.¹

What a clinic has to do

Section 4.8 sets out the duties of end users, which include the clinic and its professionals.¹

Report to the DHA all known or suspected incidents or deficiencies involving AI used in the facility, and any issue that could affect patient safety.
Set clear rules on who may access and share patient information.
Educate everyone involved, including patients, on AI and its effective use.
Arrange regular audits of AI functionality by an independent third party, reporting to the DHA as needed.
Send user feedback to the DHA and to the manufacturer.

The policy adds that every user must understand the strengths and limitations of the specific tool, and that adverse events should be reported promptly to the relevant oversight bodies.¹

Keep a simple register of every AI tool in use, with its purpose, the vendor's answers, the staff trained on it and every incident reported. The policy does not name such a register. Each of the duties above is easier to meet with one.

What to ask a vendor

The minimum requirements in section 4.6 describe what the tool itself must do, so they work well as a vendor questionnaire.¹

Which functions are AI enabled, how the tool was validated and on which data, and what its limitations are.
Whether it has been independently validated, and a copy of its auditable validation statement.
How it monitors performance in practice against the results seen in validation.
What happens when hardware or software fails. The policy calls this graceful degradation and expects automatic alerts.
Which data and interoperability standards it uses to work with UAE national systems.
Where patient data is hosted, and its NABIDH status, both in writing.

What developers must show

Section 4.7 places duties on the developers and commissioners of AI solutions. They must set out a clear value proposition, list technical specifications, possible side effects and hazards, define the measures by which the product should improve care, and document its risks and benefits so those risks can be monitored.¹ A clinic can ask for each of these before it signs.

How the DHA enforces it

The policy says the DHA's Health Regulation Sector must monitor compliance through audit, inspection and the reports it receives from end users, and must impose sanctions for breaches through its complaints, investigations and sanctions process.¹ Breaches are referred to a specialised committee with expertise across several disciplines.¹

Health data law

The policy requires AI tools to comply with Federal Law No. 2 of 2019 on the use of information and communication technology in health.¹ That law requires health data to be kept confidential and protected from unauthorised change, says health data about care given in the UAE may not be stored, processed or transferred outside the country unless a health authority decision allows it, and sets a minimum retention period of 25 years.⁴ wai hosts your clinic's records in the UAE, under the UAE's rules. We set this up with your clinic.

The evidence on accuracy

Supervision is in the policy because the tools still make mistakes. In a randomised trial of ambient scribes at UCLA Health, published in NEJM AI, clinicians reported that clinically significant inaccuracies occurred occasionally, and the authors called for ongoing vigilance.⁵ The same trial found improvements in burnout and task load scores for doctors using either scribe.⁵

Where wai fits

wai Clinicians drafts the note while the doctor talks and the letter before the patient leaves, and sends nothing until the doctor has signed it, so every output passes through the doctor before it leaves the clinic. The doctor keeps the final word and finishes clinic with the notes done.

Questions

Is there a regulation on AI in healthcare in Dubai?

The DHA's policy on artificial intelligence in healthcare applies to every DHA licensed facility and professional that uses AI. It sits alongside Federal Law No. 2 of 2019, which governs health data across the UAE.

Do Dubai clinics have to report AI incidents?

Yes. The DHA policy asks end users to report known or suspected AI incidents and deficiencies, and any issue that could affect patient safety, to the DHA's Health Regulation Sector.

Does an AI tool need independent validation in Dubai?

The policy says AI solutions for healthcare must go through independent validation by a competent third party. Ask each vendor for its validation statement in writing.

Can AI make clinical decisions in a Dubai clinic?

The policy expects AI to be supervised by its users, and tools that can significantly affect lives must let designated users override or reverse their decisions. The professional remains responsible for the final decision.

Sources

Written and reviewed by the clinical team at wai. Last reviewed 17 September 2026.