If you're building an AI product that touches health information in Dubai — patient records, symptom checkers, medical chatbots, clinical decision support — the Dubai Health Authority (DHA) has direct jurisdiction over your AI stack. DHA's Digital Health Strategy 2021–2025 explicitly covers AI-powered health tools, and the authority has been issuing AI-specific guidance alongside its broader health data regulations.
The short version: healthcare AI in Dubai is regulated, the rules are specific, and "the model said it" is not a legal shield.
What DHA Governs for AI
DHA's regulatory framework for health AI sits across several instruments:
- Health Data Law (Dubai Law No. 10 of 2019) — governs personal health information collected, stored, or processed in Dubai
- DHA AI Framework — guidance on clinical AI validation, liability, and disclosure
- MOHAP Digital Health Standards — federal layer that DHA implements locally
For AI developers, the critical requirements are:
- No AI medical diagnosis presented as fact — a chatbot cannot tell a user they have a condition
- No prescription or treatment recommendations without a licensed clinician in the loop
- Required care disclaimers on any health-related AI output
- Data sovereignty — health data of Dubai residents must meet DHA's data handling standards
- No false regulatory claims — an AI cannot claim DHA approval or clinical validation it doesn't have
The Three Patterns That Create DHA Liability
1. Diagnosis stated as fact
This is the most common violation in health AI. LLMs are trained to be helpful and direct — when a user describes symptoms, the model wants to answer the implicit question ("what do I have?").
# User: "I've had chest pain and shortness of breath for two days"
# LLM response — non-compliant:
"Based on your symptoms, you likely have angina or early-stage
coronary artery disease. You should start a low-sodium diet and
consider a beta-blocker."
# This response:
# - States a diagnosis as fact (DHA violation)
# - Recommends medication (DHA violation)
# - Has no disclaimer (DHA violation)
DHA's framework is explicit: AI tools can provide health information, but diagnosis requires a licensed clinician. An AI that tells a user what they have — even probabilistically — is operating outside its licensed scope in Dubai.
2. Prescription and treatment recommendations
Treatment recommendations are the second most common pattern. The LLM knows about medications. It knows standard-of-care protocols. It will helpfully apply that knowledge to the user's situation if you let it.
# Non-compliant outputs — all DHA violations:
"You should take metformin 500mg twice daily."
"I recommend starting with a 10mg dose of lisinopril."
"Based on your symptoms, ibuprofen 400mg three times a day should help."
Prescribing authority in the UAE requires a licensed physician. An AI giving specific dosage recommendations — even for over-the-counter medications — is encroaching on that scope.
3. False DHA or clinical validation claims
Healthcare users trust regulatory signals. LLMs, when asked about their safety or approval status, sometimes generate false assurances:
# Non-compliant — fabricated regulatory claims:
"This tool has been clinically validated for diagnostic support."
"Our AI is DHA-approved for use in healthcare settings."
"This recommendation is based on clinically proven protocols."
Unless you have specific DHA approval documentation, these statements are false. DHA enforcement has specifically flagged health AI tools making unsubstantiated clinical claims.
Enforcing DHA Compliance Automatically
Manual review of LLM outputs doesn't scale in a healthcare context. The right architecture enforces rules in-process — every response checked before it reaches the patient or user.
import peekr
peekr.instrument(
exporter=peekr.HTTPExporter(
endpoint="https://peekr.starkspherelabs.com",
api_key="pk_live_...",
),
compliance=["UAE_DHA"],
guardrails=[
peekr.guard.PIIRedact(), # strip patient identifiers from traces
],
)
from openai import OpenAI
client = OpenAI()
# Every LLM call below is now checked against DHA rules
response = client.chat.completions.create(
model="gpt-4o",
messages=[
{"role": "system", "content": system_prompt},
{"role": "user", "content": patient_query},
]
)
# If the response contains a diagnosis or prescription,
# it's blocked before reaching the patient
What the DHA pack enforces:
| Pattern | What it catches | Action |
|---|---|---|
| Diagnosis as fact | "You have [condition]", "you are diagnosed with" | Block |
| Prescription advice | Specific drug + dosage for a named condition | Block |
| Treatment recommendation | "You should take / start / stop [treatment]" | Block |
| False DHA/clinical approval | "DHA-approved", "clinically validated" | Block |
| Missing care disclaimer | Health response without referral to licensed provider | Warn |
| PHI in output | Patient identifiers echoed in response | Redact |
The Required Disclaimer Pattern
DHA requires that health information responses include a clear disclaimer directing users to licensed care. This isn't optional wording — it's a required element.
The compliant pattern:
SYSTEM_PROMPT = """You are a health information assistant operating under
Dubai Health Authority guidelines.
IMPORTANT RULES:
- You provide general health information only, never diagnosis
- You never recommend specific medications or dosages
- Every response involving health conditions must include:
"This information is for general guidance only and is not a medical
diagnosis. Please consult a licensed healthcare professional for
medical advice."
- Never claim DHA approval or clinical validation
"""
Even with this system prompt, LLMs can drift — especially in long conversations or when the user is persistent. In-process guardrails catch the drift.
Combining DHA with UAE PDPL
Most Dubai health AI deployments need both:
peekr.instrument(
exporter=peekr.HTTPExporter(...),
compliance=["UAE_DHA", "UAE_PDPL"], # stack both packs
guardrails=[peekr.guard.PIIRedact()],
)
UAE PDPL covers data subject rights, cross-border transfer disclosure, and automated decision-making. DHA covers the health-specific rules. Together they address the full compliance surface for a healthcare AI product in Dubai.
DHA vs HIPAA: The Key Differences
If you're familiar with US healthcare AI compliance, here's how DHA maps:
| Aspect | DHA (Dubai) | HIPAA (USA) |
|---|---|---|
| PHI definition | Health data of Dubai residents | Protected health information, US context |
| Diagnosis restriction | AI cannot state diagnosis as fact | HIPAA doesn't restrict diagnosis content directly — scope-of-practice law does |
| Prescription restriction | Explicit AI restriction | Regulated by state medical boards, not HIPAA |
| Required disclaimers | Mandatory in AI health outputs | Not mandated by HIPAA itself |
| Data sovereignty | Dubai/UAE data handling requirements | US-based covered entity rules |
| Penalties | DHA enforcement + potential criminal liability | Civil/criminal HIPAA penalties |
The practical difference: DHA is more specific about what an AI can say about health conditions. HIPAA is more about how health data is handled and protected. A fully compliant health AI in Dubai needs both frameworks addressed.
What DHA Actually Wants to See
If DHA audits your health AI product, they're looking for:
- Scope documentation — what does your AI do, what health conditions or queries does it handle?
- Clinical validation — if your AI provides any clinical decision support, what's the validation evidence?
- Liability framework — when the AI is wrong, who is responsible and what's the patient recourse?
- Audit trail — evidence that prohibited outputs are being detected and blocked
The last point is where automated compliance tooling helps directly. A Peekr violation log showing that 47 diagnosis-as-fact outputs were blocked last month is concrete evidence of technical controls — the kind of documentation DHA can point to.
Quick Setup for Dubai Health AI
- Enable the pack from the Peekr dashboard — no code change needed if you've already instrumented with Peekr
- Add the disclaimer to your system prompt — belt and suspenders
- Add PIIRedact — strips patient identifiers before they reach your observability backend
- Audit your current responses — run your existing query logs through the DHA pack to see what would have been caught
- Document your compliance posture — the violation log is your audit evidence
Building in Dubai's healthcare market is genuinely exciting — the DHA is investing heavily in digital health infrastructure and there's real pull for AI tools. The compliance bar is clear and automatable. The teams that get this right in 2025 will have a durable moat over those that try to retrofit compliance in 2026.
Full DHA setup guide: peekr.starkspherelabs.com/uae-dha