Deploy a patient-facing chatbot in a Dubai or Abu Dhabi clinic and you answer to two different regulators before any federal rule applies. That's AI healthcare regulation in the UAE today: DHA in Dubai, DoH in Abu Dhabi, and a stack of federal Decree-Laws that already bind your system the moment it collects a patient's name. This guide maps who owns your bot, what its speech can legally contain, and where the PDPL, cybercrime and negligence lines run.
Key Takeaways
- Dubai and Abu Dhabi healthcare bots answer to two different regulators — DHA governs Dubai-licensed healthcare, DoH governs Abu Dhabi-licensed healthcare, and no federal healthcare-AI enforcement body unifies them. A clinic group operating in both emirates must satisfy each authority separately, with no single-window approval.
- The PDPL applies the moment your bot collects a patient's data — Federal Decree-Law No. 45 of 2021 requires explicit, informed consent before collection, lawful processing of that data, and technical content filters that block unlawful outputs. A generic cookie banner does not satisfy it.
- Federal cybercrime law bans your bot from spreading false information — Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes requires IT systems, including AI, to prevent false information and carry cybersecurity controls. A hallucinated clinical statement is a regulated output failure, not a UX bug.
- The UAE AI Charter sets ethics, not enforcement — Issued in June 2024 with 12 ethical principles on safety, transparency and human-machine ties, the Charter is non-binding. Enforcement weight sits with the federal Decree-Laws and with DHA or DoH sector guidance.
- No rulebook yet for your use case? An interim licence route exists — Federal Decree-Law No. 25 of 2018 on Projects of Future Nature lets the UAE Cabinet grant interim licences for innovative healthcare AI use cases that outpace current DHA or DoH guidance.
Two Regulators, One Patient: How DHA and DoH Divide UAE Healthcare AI Oversight
Dubai-licensed healthcare answers to the Dubai Health Authority. Abu Dhabi-licensed healthcare answers to the Department of Health. A patient-facing bot serving both emirates satisfies both regulators separately, because no single federal healthcare-AI enforcement instrument yet exists to unify them.
That split matters operationally. If your clinic group runs a facility in each emirate, there is no single-window approval for the same chatbot. Each authority holds primary licensing power over digital health tools inside its own emirate, and each maintains its own current guidance.
Above the emirate layer sits federal policy rather than federal enforcement. The UAE National Strategy for Artificial Intelligence 2031, launched in October 2017, set the direction.
The UAE Charter for the Development and Use of Artificial Intelligence, issued in June 2024, added 12 ethical principles covering safety, algorithmic transparency and human-machine ties. Neither replaces the sector regulator you need to satisfy.
A federal advisory body has existed since February 2018, when the UAE Council for Artificial Intelligence and Blockchain was established to advise on data security and governance standards. It is not an enforcement body. Regulated healthcare operators still go to DHA or DoH.
For the wider map of who regulates what across sectors, see the pillar on UAE sector regulators covering DHA, DoH, CBUAE, RERA, KHDA and TDRA.
Federal Laws That Already Apply Before Your Bot Says a Word
Photo: Burçak Çubukçu on Pexels
Four federal Decree-Laws bind a healthcare bot regardless of emirate, and none require DHA or DoH involvement to activate. They are already in force.
Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (the PDPL) requires the lawful processing of personal data and mandates content filters to prevent unlawful outputs. Any health data your bot collects from a patient falls squarely inside its scope.
Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes requires that IT systems, including AI, prevent the spread of false information and incorporate cybersecurity controls. A healthcare bot that generates inaccurate clinical statements is exposed here directly, not theoretically.
Federal Decree-Law No. 5 of 1985 Concerning the Civil Transactions Law establishes liability for harm caused by negligence. If an AI system's design or oversight is deemed negligent and a patient is harmed by incorrect guidance, this is the door civil claims walk through.
Federal Decree-Law No. 25 of 2018 on the Projects of Future Nature authorises the UAE Cabinet to grant interim licences for innovative AI projects that lack existing regulatory frameworks. For a healthcare pilot where sector-specific rules have not yet caught up, this is a real route.
Each of the four laws activates on a different trigger and imposes a different obligation on the bot.
| Federal Law | Activates When | What It Requires |
|---|---|---|
| PDPL (Decree-Law No. 45 of 2021) | Bot collects patient data | Lawful processing and content filters against unlawful outputs |
| Cybercrimes Law (Decree-Law No. 34 of 2021) | Bot generates inaccurate statements | IT systems must prevent false information, with cybersecurity controls |
| Civil Transactions Law (Decree-Law No. 5 of 1985) | Negligent design or oversight harms a patient | Establishes liability for harm caused by negligence |
| Projects of Future Nature (Decree-Law No. 25 of 2018) | No existing framework covers the use case | Cabinet may grant an interim licence |
What a Patient-Facing Healthcare Bot May and May Not Say
Safer output: appointment booking, symptom-triage prompts, general health education, medication reminders. Higher-risk output: specific diagnosis, treatment prescription, drug-dosage advice. The second category sits in territory DHA and DoH reserve exclusively for licensed clinicians.
The cybercrime law does more work here than most operators realise. Because Federal Decree-Law No. 34 of 2021 requires IT systems to prevent the spread of false information, a hallucinated clinical statement from a patient-facing bot is not a UX bug. It is a regulated output failure.
Your system needs cybersecurity controls to block it, a legal obligation, not a design preference.
Disclosure sits at the other end of the same problem. One of the six core principles anchoring UAE AI policy is safety, and it points to the same conclusion the UAE Charter reaches through algorithmic transparency: patients should know they are speaking to an AI before any health information is exchanged. Build disclosure into the first message, not a footer.
An AI Ethics Guide issued by the UAE AI Office in December 2022 sets out fairness, transparency, accountability, privacy and safety as the working principles. Treat that as your practical checklist. It is what a DHA or DoH reviewer is likely to hold your system against when sector-specific rules catch up.
Patient Data: What the PDPL Demands of a Healthcare AI System
Photo: RDNE Stock project on Pexels
Health data is sensitive personal data. Under the PDPL, your bot needs explicit informed consent before collecting it, and it must state the processing purpose clearly. A generic website cookie banner does not satisfy this.
Content filters against unlawful outputs are also a PDPL requirement, not a best-practice suggestion. The system must be technically capable of blocking responses that would breach patient confidentiality, data-processing rules or the cybercrime law. If your vendor's platform cannot demonstrate that control, it is not compliant, whatever the sales deck claims.
For providers operating in DIFC or ADGM, another layer applies. Both free zones run their own data protection regimes on top of the federal PDPL. A healthcare provider serving patients from either zone must reconcile all three layers, and the strictest requirement in the stack governs.
Do this reconciliation before deployment, not during an audit.
The consent and data-handling obligations a healthcare bot faces share legislative DNA with financial services, which matters if your clinic group also offers patient-financing or insurance-linked products. The mapping of CBUAE expectations for customer-facing AI agents covers the parallel obligations and shows where they diverge from the healthcare rules.
First Steps Toward a DHA- or DoH-Compliant Patient-Facing AI
Confirm your governing authority before scoping the system. DHA if the entity is Dubai-licensed, DoH if it is Abu Dhabi-licensed. Pull each body's current digital health and AI guidelines, then map every planned bot function against them before a single prompt is written.
Document how the design satisfies the six principles that anchor UAE AI policy: progress, collaboration, community, ethics, sustainability and safety. That documentation supports any future licence application, and it is easier to build in from the start than retrofit under audit pressure.
If your use case has no clear precedent in the current DHA or DoH guidance, Federal Decree-Law No. 25 of 2018 gives you the interim-licence route while AI healthcare regulation in the UAE matures. Waiting is not the only alternative. Applying is.
The same pattern of federal law plus sectoral oversight runs across regulated UAE sectors. Whether it is real estate under Dubai's RERA marketing rules for property bots or schools under KHDA and ADEK oversight of parent data, the structural approach is consistent. Cross-sector experience transfers, which is why teams that ship one compliant bot ship the next one faster.
If the whole stack is new to you, our Dubai AI starter guide covers the basics before you touch sector-specific rules.
Want an honest read on which regulator applies to your project? Book a free 30-minute consultation and we will tell you which authority owns your bot, what the PDPL requires of your data flows, and whether what you are planning makes sense before you spend on a build.
FAQ
Do DHA and DoH publish separate AI policies for healthcare providers, or is there one unified UAE standard?
They are separate. DHA governs Dubai-licensed healthcare and DoH governs Abu Dhabi-licensed healthcare, each with its own digital health guidance. Federal instruments like the UAE Charter set principles but do not replace the emirate regulator that approves your bot.
Can a patient-facing chatbot in the UAE give a diagnosis or recommend a specific treatment?
No. Diagnosis, treatment prescription and drug-dosage advice sit in territory DHA and DoH reserve for licensed clinicians. A bot can handle triage prompts, education and reminders, but not the clinical decision itself.
What does Federal Decree-Law No. 45 of 2021 require before a healthcare bot collects patient health data?
Explicit, informed consent for the specific processing purpose, stated clearly before collection begins. Health data is sensitive personal data under the PDPL, and the bot must also implement content filters against unlawful outputs as a technical control.
Must a UAE healthcare chatbot disclose to the patient that it is an AI and not a clinician?
Yes. Safety and algorithmic transparency are core to the UAE Charter's ethical principles, and disclosure is the most defensible way to satisfy them. Identify the system as AI at the start of the conversation, before any health data is exchanged.
What legal exposure does a UAE healthcare provider face if its AI bot generates false medical information?
Federal Decree-Law No. 34 of 2021 directly prohibits IT systems from spreading false information, which creates cybercrime exposure. If a patient is harmed acting on incorrect output, negligence liability under Federal Decree-Law No. 5 of 1985 also comes into play.
Is the UAE Charter for the Development and Use of Artificial Intelligence legally binding on healthcare operators?
No. The Charter, issued in June 2024 with 12 ethical principles, is non-binding. Enforcement weight sits with the federal Decree-Laws (PDPL, Cybercrimes, Civil Transactions, Projects of Future Nature) and with DHA or DoH sector guidance.
Can a healthcare provider run an AI pilot in the UAE without full DHA or DoH approval under Federal Decree-Law No. 25 of 2018?
Potentially yes. That law lets the UAE Cabinet grant interim licences and temporary exemptions for innovative projects that lack existing regulatory frameworks. It is designed for exactly the kind of gap novel healthcare AI use cases keep landing in.
