What Abu Dhabi's AI Rules Mean When You Buy Clinic Software

Most clinic owners buying messaging software are not thinking about regulation. It is an inbox tool. It answers questions about whitening prices.

The regulator sees it differently, and in Abu Dhabi the rules are more specific than most vendors will volunteer.

This is not legal advice and we are not a law firm. It is the set of questions we think a clinic should ask any vendor, including us.

The DoH Responsible AI Standard

Abu Dhabi's Department of Health published a Responsible AI Standard in October 2025. It applies to licensed healthcare entities deploying AI, and its scope explicitly covers administrative and operational tools sourced from third-party vendors — not only clinical decision systems.

Three requirements matter for a messaging tool.

Human oversight. There must be a human in or on the loop. A system that books, replies and closes conversations with no route to a person does not meet this.

Disclosure. Patients must be told when AI is involved, and informed of their right to opt out. If a vendor's demo shows a bot indistinguishable from a receptionist and never says otherwise, that is a problem you inherit.

Infrastructure location. The standard states that compute and storage for AI systems should sit within the UAE. This is the requirement most vendors are quietest about.

ADHICS Applies More Broadly Than People Assume

ADHICS is Abu Dhabi's healthcare information security standard. The common assumption is that it is a hospital problem.

It is not. DoH's own guidance is explicit that a single-doctor clinic is in scope, at the Basic control tier. And the newer revision added third-party risk management, which means a vendor handling patient data on your behalf becomes part of your compliance position, not a separate matter.

Practically: if your messaging vendor has no answer on ADHICS, the gap shows up in your audit, not theirs.

Where the Data Physically Sits

UAE federal law restricts storing or transferring health data related to services provided in the country onto servers outside it, absent specific approval. Combined with the DoH standard above, in-country hosting is the direction of travel and in some readings already the requirement.

So ask two separate questions, because vendors often answer only the first.

What data do you store? And in which country does it physically live?

A vendor storing full clinical records offshore is in a very different position from one holding a phone number and an appointment time. Both should be able to answer precisely and immediately.

Our own answer, since we are asking you to demand it from others: Tahsin.ai holds a phone number, appointment details and conversation history. No medical records, no diagnoses, no access to your practice management system. Our database currently runs on encrypted, certified infrastructure in the EU rather than the UAE, and moving to in-country residency is the infrastructure work we are prioritising. If in-country hosting is a hard requirement for you today, tell us and we will say plainly where we stand rather than manage the question.

The Clinical Boundary

The line worth holding is between administrative and clinical. Booking an appointment, quoting a published price, confirming opening hours — administrative. Interpreting a symptom, advising on medication, suggesting what a swelling might be — clinical, and not something a messaging tool should do at any price.

Ask what happens when a patient describes pain or a symptom. The right answer is that the system stops and gets a human, immediately. Anything that sounds like triage should worry you.

Five Questions for Any Vendor

Where is patient data stored, in which country? What exactly do you retain, and for how long? How does the system disclose it is AI? What happens when a patient describes a medical symptom? What is your position on ADHICS?

A vendor that answers all five without hedging has thought about operating here. One that treats them as unusual questions has not.

The Bottom Line

Regulation in Abu Dhabi healthcare AI is moving toward human oversight, clear disclosure, and in-country data. None of that is unreasonable, and none of it is hard for a vendor that built for this market.

Ask the questions early. It is considerably cheaper than discovering the answers during an audit.