Surgy Health
Healthcare Compliance

AI in Healthcare in the UAE and Saudi Arabia: Rules for Hospitals (2026)

How AI in healthcare is regulated in the UAE and Saudi Arabia: data localisation, DoH and DHA policies, SFDA approval, PDPL transfers and a buyer checklist.

Mohammed Jamil Nasir
Mohammed Jamil Nasir
· 10 min read
Modern Gulf hospital at dusk with a digital data network over the skyline

Key takeaways

  • Hosting is the first filter. UAE federal law keeps health data in the country by default; Saudi Arabia's PDPL makes transfers abroad conditional. Ask every vendor where data is stored and processed.
  • Clinical AI is a medical device in both countries. Saudi Arabia's SFDA requires marketing authorisation for AI/ML devices (MDS-G010); the UAE regulates medical software through MOHAP under Federal Decree-Law No. 38 of 2024.
  • Emirate rules add governance duties. Abu Dhabi's DoH and Dubai's DHA expect a governance framework, audits, explainability and staff training for AI in use.
  • National platforms matter. Record-creating systems connect to Malaffi (Abu Dhabi), NABIDH (Dubai) or Riayati; claims software in Saudi Arabia connects to NPHIES.
  • Admin AI is lighter-touch, not untouched. CRM, scheduling, training and analytics tools are not medical devices, but data protection, cybersecurity and hosting rules still apply.

Short answer: In the UAE, health data must be stored and processed in-country unless Ministerial Decision No. 51 of 2021 allows otherwise, and Abu Dhabi's Department of Health and the Dubai Health Authority each require governance, audits and explainability for healthcare AI. In Saudi Arabia, clinical AI needs SFDA marketing authorisation under guidance MDS-G010, and the Personal Data Protection Law limits transfers abroad. Buy AI that can be hosted in-country and connects to Malaffi, NABIDH or NPHIES where it creates records or claims.

Disclosure: Surgy Health sells AI software to hospitals in India and the GCC. This guide applies to any vendor, including us. It summarises published rules and is not legal advice.

Digital health in the UAE and Saudi Arabia: a snapshot

  • Saudi Arabia's Seha Virtual Hospital delivered more than 16 million virtual appointments and medical consultations in 2025 (Saudi Ministry of Health, 27 January 2026).
  • Abu Dhabi's health information exchange, Malaffi, holds 3.5 billion clinical records and 12.7 million unique patient profiles across 3,072 connected facilities (Malaffi, 14 August 2025).

Both systems already run on digital records at national scale. AI that can't connect to them, or that sends data abroad, will struggle to pass procurement. For more figures, see our AI in healthcare statistics.

AI in healthcare in the UAE: the rules

The UAE regulates healthcare AI through federal laws on health data, personal data and medical products, plus emirate-level AI policies from Abu Dhabi and Dubai.

Rule Date What it means for an AI purchase
Federal Law No. 2 of 2019 on the Use of ICT in Health Fields 2019 Health data must be kept confidential and, by default, stored and processed inside the UAE; medical records kept for at least 25 years; applies in free zones too
Ministerial Decision No. 51 of 2021 2021 Sets the limited exceptions that allow health data to leave the UAE
Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law) 2021 Health data is sensitive personal data and needs stronger protection
Federal Decree-Law No. 34 of 2021 (Countering Rumours and Cybercrimes) 2021 Unauthorised use or disclosure of medical records carries prison of at least six months and fines of AED 20,000–100,000
Federal Decree-Law No. 38 of 2024 (Medical Products) In force 2 January 2025 Central approval and oversight of medical products, including medical software; MOHAP registers software as a medical device by risk class
Abu Dhabi DoH Policy on Use of AI in the Healthcare Sector 30 April 2018 Governance structure, regular audits reported to DoH, accuracy feedback loops and safe failure ("graceful degradation")
Abu Dhabi DoH Responsible AI Standard 2025 Updated technical and data-privacy conditions, with fuller transparency and explainability requirements
Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS) Current Mandatory cybersecurity controls for Abu Dhabi providers; AI tools must comply
Dubai DHA Policy for Use of AI in Healthcare (circular CIR-2021-00000141) August 2021 Bias-free design, failures that can be diagnosed and controlled, and users' right to a clear explanation of the AI's role and data
Malaffi (Abu Dhabi), NABIDH (Dubai), Riayati (MOHAP) Live Systems that create clinical records connect to the relevant health information exchange

What to ask a vendor in the UAE: Where exactly is data stored and processed? Which exception under Ministerial Decision 51/2021 do you rely on if any data leaves the UAE? Is any feature registered with MOHAP as a medical device? How do you support our DoH or DHA AI audit and explainability duties? Are you connected to Malaffi or NABIDH in production?

AI in healthcare in Saudi Arabia: the rules

Saudi Arabia has no single AI law. Healthcare AI is governed by the SFDA's medical device rules, the Personal Data Protection Law and SDAIA's AI principles and guidelines.

Rule Date What it means for an AI purchase
SFDA MDS-G010 — Guidance for AI/ML-enabled medical devices 3 January 2023 AI with a medical purpose needs SFDA marketing authorisation (MDMA), with evidence of safety, performance and clinical validation
SFDA MDS-G027; MDS-G37 and MDS-G38 (post- and pre-market cybersecurity) Current Further requirements for digital health products and device cybersecurity
Personal Data Protection Law (PDPL) Effective 14 September 2023; enforceable from 14 September 2024 Transfers abroad need an adequacy decision or one of three safeguards (SDAIA standard contractual clauses, binding corporate rules or a certification), plus a risk assessment; a data protection officer is required where sensitive data processing is a core activity
SDAIA designated as data and AI regulator (Council of Ministers Resolution No. 292) — SDAIA sets data and AI policy, standards and controls and monitors compliance
SDAIA AI Ethics Principles September 2023 Seven principles: fairness; privacy and security; humanity; social and environmental benefit; reliability and safety; transparency and explainability; accountability and responsibility
SDAIA Generative AI Guidelines (public and government) January 2024 Responsible-use guidance for generative AI developers and users
NPHIES (Council of Health Insurance) Live National insurance platform; claims and eligibility software must integrate

What to ask a vendor in Saudi Arabia: Is any feature an AI/ML medical device, and does it hold SFDA marketing authorisation? Where is data hosted, and if any leaves the Kingdom, which PDPL safeguard and risk assessment cover it? How does the product align with SDAIA's AI Ethics Principles? Is your NPHIES integration live, and with which payers?

UAE vs Saudi Arabia at a glance

Question UAE Saudi Arabia
Can health data be hosted abroad? Only under the exceptions in Ministerial Decision 51/2021 Only with adequacy or a PDPL safeguard plus a risk assessment
Who approves clinical AI? MOHAP (Federal Decree-Law 38/2024) SFDA (MDS-G010)
AI governance policy for providers Abu Dhabi DoH policy and Responsible AI Standard; Dubai DHA policy SDAIA AI Ethics Principles and GenAI Guidelines
Health information exchange Malaffi, NABIDH, Riayati NPHIES for insurance
Cybersecurity standard to check ADHICS (Abu Dhabi) SFDA device cybersecurity guidance (MDS-G37/G38)

What this means for each type of hospital AI

AI type UAE Saudi Arabia
Clinical AI (imaging, triage, decision support) MOHAP medical-device registration; DoH/DHA AI policy duties; in-country hosting SFDA marketing authorisation under MDS-G010; PDPL hosting rules
AI medical scribe Health-data hosting rules; DoH/DHA transparency duties; check whether any feature makes clinical suggestions PDPL hosting rules; check whether any feature is a medical device
Hospital CRM, voice agents, patient messaging PDPL and health-data hosting rules; consent for communications PDPL rules, including for sensitive data
Analytics and KPI dashboards Hosting and cybersecurity rules if patient-level data is used PDPL rules if patient-level data is used
Claims and revenue-cycle AI Payer and HIE integration NPHIES integration

GCC buyer checklist for hospital AI

  1. In-country hosting proof: cloud provider, region, and a data-flow diagram showing where every component (including AI models) runs.
  2. Transfer basis: if any data leaves the country, the legal basis (UAE exception or Saudi PDPL safeguard) in writing.
  3. Medical-device status: intended-use statement and MOHAP or SFDA registration for any clinical feature.
  4. Governance support: audit logs, explainability material and performance reports that meet DoH or DHA expectations.
  5. Cybersecurity: mapping to ADHICS (Abu Dhabi) or the relevant national controls.
  6. HIE and payer connections: Malaffi, NABIDH, Riayati or NPHIES — live in production, not on the roadmap.
  7. Arabic performance: results on your Arabic-speaking patients and staff, including dialects and mixed Arabic–English.
  8. Bias testing: performance across nationalities, age groups and sexes in your patient mix.
  9. Incident notice: how fast the vendor tells you about a breach or AI safety issue.
  10. Exit: data export and deletion from in-country systems at the end of the contract.

Use these alongside our healthcare AI RFP template and scorecard and record approved tools in your AI governance policy.

What about Qatar, Kuwait, Bahrain and Oman?

Each has its own personal data law and health regulator, and most treat health data as sensitive. Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016), Bahrain's Personal Data Protection Law (Law No. 30 of 2018), Oman's Personal Data Protection Law (Royal Decree No. 6 of 2022) and Kuwait's Data Privacy Protection Regulation issued by CITRA all apply to patient data. Use the same checklist above, and confirm hosting and medical-device rules with the local regulator.

Where Surgy Health fits

Surgy Health builds AI-first software for hospitals in India and the GCC, with live deployments in Kuwait and Bahrain — including Apollo Clinic Kuwait (SurgyScribe) and Al Salam Hospitals in Kuwait and Bahrain (SurgyLearn).

  • Hosting: default hosting is AWS in Mumbai, India. In-country or regional AWS hosting in the GCC is available for hospitals that need it, at additional cost.
  • Arabic: SurgyScribe handles mixed-language consultations including Arabic and produces notes in clinical English; SurgyInsights answers questions in English, Hindi and Arabic.
  • Integrations: SurgyOne's integration list includes national platforms such as NPHIES; ask us which connections are live for your region.
  • Data protection: every product runs on tenant-isolated data, encrypted in transit and at rest, with role- and branch-level permissions and a full audit trail. Hospitals remain the data controller; Surgy Health processes data on the hospital's instructions.

Talk to us about a GCC deployment →

FAQ

Frequently asked questions

Is AI in healthcare regulated in the UAE?

Yes. Federal laws govern health data (Federal Law No. 2 of 2019), personal data (Federal Decree-Law No. 45 of 2021) and medical products including software (Federal Decree-Law No. 38 of 2024). Abu Dhabi's DoH and the Dubai Health Authority also have AI policies requiring governance, audits and explainability.

Can patient data be stored outside the UAE?

Only in the limited cases allowed by Ministerial Decision No. 51 of 2021. By default, Federal Law No. 2 of 2019 requires health data to be stored and processed inside the UAE, including in free zones, so hospitals should prefer AI vendors that host in-country.

What is the DHA AI policy?

The Dubai Health Authority's Policy for Use of Artificial Intelligence in Healthcare, issued in August 2021 (circular CIR-2021-00000141). It requires AI to be designed free of bias, with failures that can be diagnosed and controlled, and gives users the right to a clear explanation of the AI's role and the data it uses.

What does the Abu Dhabi DoH require from AI vendors?

DoH's AI policy (2018) and its Responsible AI Standard (2025) expect a governance framework, regular audits reported to DoH, accuracy feedback, transparency and explainability, and compliance with the ADHICS cybersecurity standard. Hospitals pass many of these duties to vendors through contracts and audit rights.

Does clinical AI need SFDA approval in Saudi Arabia?

Yes. AI or machine-learning software with a medical purpose is a medical device in Saudi Arabia and needs SFDA marketing authorisation. SFDA's guidance MDS-G010 (January 2023) sets out the requirements for AI/ML-enabled medical devices.

Can a Saudi hospital use cloud AI hosted abroad?

Only if the transfer meets the PDPL: an adequacy decision for the destination country or one of three safeguards — SDAIA's standard contractual clauses, binding corporate rules or a certification — plus a risk assessment. Most hospitals choose in-Kingdom hosting to avoid this.

What is NPHIES, and does AI software need to connect to it?

NPHIES is Saudi Arabia's national health insurance platform, run by the Council of Health Insurance. Software that handles eligibility, pre-authorisation or claims must integrate with it. Clinical or admin AI that doesn't touch insurance doesn't need a direct NPHIES connection.

Do AI tools need Arabic language validation?

No rule names Arabic validation specifically, but DoH, DHA and SDAIA all require AI to be fair and reliable for the people it serves. Ask vendors for results on Arabic and mixed Arabic–English speakers before you buy.

Which AI tools need no medical-device approval?

Tools without a medical purpose — CRM, scheduling and voice booking, staff training, operational analytics and billing support — are not medical devices. They still have to meet data protection, hosting and cybersecurity rules.

Sources

This guide summarises published rules for hospital buyers. It is not legal advice; confirm hosting, licensing and data-transfer questions with qualified counsel in each country.

Portrait of Mohammed Jamil Nasir

Written by

Mohammed Jamil Nasir

Founder – Product & Technology, Surgy Health

14+ years in Product, Design & Tech · PGC AI/ML, IIT-Guwahati · Global MBA, SP Jain · BE-CSE

Mohammed Jamil Nasir leads product and technology at Surgy Innovation Labs Private Limited, building AI-first, seamless healthcare products for hospitals and healthcare networks across India and the GCC. He writes about healthcare AI, accreditation, and clinical operations.

Connect on LinkedIn

Keep reading

More on Healthcare Compliance

Hand-picked next reads that build on this article, so you can go deeper before you decide.

Browse all Healthcare Compliance articles
View all articles →