A clinic group in Dubai wants an assistant on WhatsApp and on its website: booking, rescheduling, opening hours, which insurers are accepted, how to prepare for a scan. A supplier can have the model answering in a fortnight. What actually decides the launch date is whether the clinic can show that the assistant meets the Dubai Health Authority’s policy on artificial intelligence, and that the patient data it touches stays where the law says it must.
None of this is exotic. It is a short list of things to decide, build and write down before the first patient types a question, and almost all of them are cheaper on day one than after a complaint.
What the DHA policy covers, and who it binds
The DHA’s policy on artificial intelligence in healthcare, reference DHA/HISHD/PP-09, applies to every healthcare facility and professional licensed by the authority that uses AI in healthcare services, and to developers who use Dubai patient data to build AI solutions. Bird and Bird’s reading of the DHA circular sets out the same frame: ethics, accountability, transparency, safety and security, and privacy. The policy is binding. It says every stakeholder must comply, and it gives the DHA’s Health Regulation Sector the power to audit, inspect and sanction.
Two lines in it matter most for an assistant. Accountability for outcomes must be agreed between the designer, developer, operator and end users, so your contract with the supplier has to say who answers for what. And the policy lists the federal laws an AI tool must comply with, including the law on information and communication technology in health. That is the law that decides where the data can live.
Decide first whether the assistant is clinical
The most important decision is scope, and it is a business decision before it is a technical one. An assistant that books appointments, explains parking and lists accepted insurers handles personal and health data, but makes no clinical judgement. An assistant that asks about symptoms and suggests whether to come in today is doing triage, and the policy’s requirements on validation, override and reporting then bite much harder. Software that diagnoses or recommends treatment can also be regulated as a medical device under federal law, as the International Bar Association’s review of UAE healthcare AI notes, which brings a registration route of its own.
Write the scope down as two lists: what it may answer, and what it must hand to a person. “Any question about symptoms, results or medication goes to a nurse” is a sentence a clinic can defend. A model that has been told to “be careful with medical questions” is not.
A worked example shows why the lists matter. A parent writes: “My son has had a fever for three days, can I bring him tomorrow at 10?” The booking half is in scope; the fever is not. The right reply offers the 10:00 slot, says a nurse will call about the symptoms, and puts the conversation in the named nurse’s queue. The wrong reply, the one an unconstrained model tends to give, adds advice about medicine and doses. Put this exact shape in the test set: a booking request wrapped around a clinical detail is among the most common messages an assistant like this receives, and the one most likely to go wrong.
The disclosure the patient sees
The policy requires every healthcare AI solution to disclose which functions are AI-enabled, how it was validated, which data it uses, its limitations and the role of the healthcare professional in the final decision. For a patient-facing assistant, part of that belongs in the conversation itself: the first message says it is an automated assistant, what it can help with, and how to reach a person. The rest belongs in a short written page the clinic can hand to the DHA, or to a patient who asks.
The policy also expects built-in ways to challenge significant decisions. In practice that means a visible route to a person on every channel, which also happens to be what patients want.
Where the conversation is stored
A message that says “I need to move my diabetes review” is health information. Under Federal Law No. 2 of 2019 on the use of information and communication technology in health, the default position is that health data is stored and processed inside the UAE, and transfers abroad are allowed only in cases set by ministerial resolution. Al Tamimi’s summary of those exemptions lists ten, including telemedicine and treatment overseas, each with conditions. A model hosted abroad answering booking questions is not one of them on its face.
So the hosting question is answered before the model is chosen. Which region does the model run in, where are the transcripts kept, where do the logs and analytics go, and does any sub-processor copy them elsewhere? The answer has to cover the whole path, not only the main server. The legal reason and the speed reason for hosting in the UAE are separate decisions, and here the legal one wins.
A person who can override it, and a way to switch it off
The policy says AI solutions that may significantly affect people must be able to be overridden, or their decisions reversed, by designated end users. It also asks for graceful degradation: automatic alerts, and the ability to stop in stages when hardware or software fails. For an assistant this is concrete. A named member of staff can take over any conversation. There is an off switch a non-technical manager can reach. When the model or the booking system is down, the assistant says so and gives the clinic’s phone route rather than inventing an appointment.
Test the failure path before launch as carefully as the happy path. An assistant that confirms a booking the system never recorded is the incident most likely to reach a regulator.
Validation you can show, and monitoring after launch
The policy asks for independent validation by a competent third party, auditable validation statements, and monitoring in practice that compares real outcomes with those seen in testing. Facilities using AI must report incidents and safety issues to the Health Regulation Sector, and arrange regular independent audits.
For a booking assistant that means a test set of real questions in Arabic and English with known right answers, a pass mark agreed before testing, a written result, and a monthly sample read by a person after launch. The acceptance test an Arabic assistant has to pass is the same work, aimed at the regulator’s question as well as the patient’s. Keep every version of the results; “it was fine when we launched” is not evidence.
The supplier’s access to patient data
The DHA’s Standards for Health Information Consent and Access Control, in force since April 2025, require contracts with vendors to include security requirements and the rules for access to health information systems, records of external access, monitoring, and revocation when the contract ends. If the assistant reads the booking system or the patient record, the supplier is an external party in exactly that sense.
Put it in the contract: which systems the assistant can read, which it can write to, who at the supplier can see transcripts, how long they are kept, and what happens to them at the end. The security questionnaire a careful buyer sends asks the same things, and the two sets of answers should match.
Frequently asked questions
Does a booking-only assistant need DHA approval before launch?
The policy does not describe a separate licence for an assistant. It sets requirements that a licensed facility must meet and can be audited against. Ask your DHA contact whether your use case needs any notification, and keep the evidence ready either way.
Can we use an international model provider?
Only if the health data stays where the law requires, or a listed exemption applies. Several providers offer hosting in the UAE; confirm the region for the model, the transcripts and the logs in writing before signing.
Who is accountable if the assistant gives a wrong answer?
The policy says accountability must be agreed between designer, developer, operator and end users, so write it into the contract. The facility is still the one the patient and the DHA will look to first.
Does the assistant have to work in Arabic?
The policy does not say so, but many patients in Dubai write in Arabic or mix both languages. If it serves them, test it in both, and route anything it cannot handle well to a person.
What should we keep as evidence?
The scope document, the disclosure text, the hosting map, the test set and its results, the override and shutdown procedure, the supplier contract clauses and the monthly monitoring samples. That pack answers most of what an auditor will ask.
The order I would do it in
Decide the scope and write the hand-off list. Map where every message and log will be stored, and choose the model by that map. Write the disclosure and the route to a person. Agree accountability and data access in the supplier contract. Build the test set, pass it, keep the result. Then launch on one channel, read a sample every week, and report what the policy says must be reported.
Designing an assistant that patients trust and a regulator accepts is the work of a conversational AI consultant, and it starts with the same one-page brief as any other assistant. Tothiq AI Services and Solutions builds custom assistants with UAE hosting and a documented data flow. If you are planning one for a Dubai facility, get in touch here.