There is a 12-page document on the Department of Health Abu Dhabi website, reference DoH/ST/DDGO/RAI/V1/2025, published in October 2025 and effective the same month.
It is the most detailed AI rulebook any UAE regulator has published for any sector. It is free. Its revision date is October 2026, which means it is about to be updated.
Very few of the vendors currently selling AI into Abu Dhabi hospitals have read it.
What the Standard actually covers
It applies to the Department of Health and to all licensed healthcare entities in the Emirate of Abu Dhabi that develop, procure or deploy AI systems. It covers AI-enabled tools, devices, datasets, agents and platforms used for clinical, financial and administrative functions. It covers systems built internally, bought from vendors, or produced through research collaborations. It covers the whole lifecycle, from inception to decommissioning.
That scope wording matters. A hospital that thinks the Standard is about diagnostic imaging is reading it too narrowly. The revenue cycle model and the rostering tool are inside it.
The five requirements that change a procurement decision
Infrastructure inside the UAE. The compute and storage for AI systems, for both active and disaster recovery sites, must be situated within the UAE. Remote access for development and support teams should be exclusively from within the UAE. That single clause removes a large part of the global AI vendor market from consideration unless the vendor has local hosting and a local support model.
This sits on top of Federal Law No. 2 of 2019, which requires health data generated in the UAE to be stored and processed here, with exceptions under Ministerial Decision No. 51 of 2021, and which applies across all UAE jurisdictions including the free zones.
No production data in training. The Standard states that production data shall not be used to train the model. Many vendor default configurations do exactly that.
Risk tiers with a hard ceiling. After controls are applied, residual risk is rated. Very high risk systems must be prohibited from deployment. High risk systems must undergo conformity assessments both before and after deployment, coordinated with the DoH Data and Digital Governance Office. Medium risk systems carry governance and reporting obligations. Low and very low risk systems are exempt from formal risk reporting but stay under monitoring.
Named accountability. AI systems must have designated owners. Specific individuals or teams must be assigned to monitor outputs and exceptions, review flagged cases and override events, and report adverse outcomes or ethical concerns to governance bodies. Every decision, change, update and intervention must be logged and traceable to a responsible party.
Patient opt-out. Patients must be informed of their right to opt out of AI-driven services where applicable, with clear consent mechanisms in place.
What Dubai requires
The Dubai Health Authority published its Policy for the Use of Artificial Intelligence in Healthcare in the Emirate of Dubai in August 2021. It applies to AI used by healthcare facilities and professionals, pharmaceutical manufacturers, health insurers, public health centres and researchers within DHA jurisdiction, on principles of ethics, accountability, transparency, safety and security, and privacy.
Both the DHA and DoH policies require graceful degradation: automatic alerts and a controlled reduction of function when hardware or software fails, rather than a silent wrong answer.
Interoperability runs through Malaffi in Abu Dhabi and NABIDH in Dubai. Any AI system that touches the clinical record has to work with the relevant exchange.
The federal layer above both
Federal Decree-Law No. 38 of 2024 on medical products, pharmacy practice and pharmaceutical establishments took effect on 2 January 2025 and brings software as a medical device into a centralised approval and classification regime under MOHAP.
Health data is sensitive personal data under Federal Decree-Law No. 45 of 2021. Federal Decree-Law No. 34 of 2021 carries penalties for health data breaches, with a minimum of six months imprisonment and fines from AED 20,000 to AED 100,000.
Records must be retained for a minimum of 25 years.
What the buyer side looks like
Abu Dhabi is not slowing down while it writes rules. The Department of Health, with Microsoft, unveiled a Population Health Intelligence platform at GITEX Global 2025, described as an emirate-scale digital twin of the healthcare ecosystem built from clinical, lifestyle and environmental data. The DoH has signed agreements with Capgemini, Statista and Mohamed bin Zayed University of Artificial Intelligence to extend AI and data analytics across the ecosystem.
The direction is set. The condition attached to it is documentation.
The seat, in healthcare
The Standard describes the job in its own text. Designated system owners. Assigned monitoring and override review. Adverse outcome reporting into governance bodies. A risk register with named risk owners. Role-tailored AI literacy for clinicians, data scientists and administrators, including case studies of AI failures. Literacy metrics tracked on a dashboard.
In a hospital group that runs eleven AI-touching systems across three sites, that is a job. It is not a job that a Chief Medical Information Officer with a full clinical estate can absorb as a fifth duty, and it is not a job that a vendor can hold on the provider's behalf.
For most providers here the first version of the seat is two or three days a week, held by someone who has taken a clinical AI system through validation and monitoring somewhere real, and it lasts until the conformity assessment cycle is running by itself.
Nothing on this page is legal or clinical regulatory advice. Confirm every requirement with the DoH, the DHA or MOHAP in writing.
Where to go next
For the full regulatory stack, read the map of UAE AI regulation. For what the seat holds, read the Chief AI Officer job description.
If you have run clinical AI under a UAE health regulator, claim a page. If your conformity assessment is due and there is no name against it, read the register.