Buyer's guide · Healthcare AI
AI and health data in the UAE: what Article 13 means for hospitals and clinics
Hospitals and clinics in the UAE want AI for clinical documentation, patient communication and research, but health data comes with a clear residency rule. This guide explains what the law says, which questions to ask before adopting an AI tool, and how on-premise AI fits.
Tiada Solutions · Updated
What the law says
Federal Law No. 2 of 2019 concerning the use of information and communications technology in health fields came into effect on 14 May 2019. Article 13 states that it is not permissible to store, process, generate or transfer health data and information outside the State when it relates to health services provided inside the UAE, except where a resolution is issued by the health authority in coordination with the Ministry.
The law sets a fine of AED 500,000 to 700,000 for violating Article 13. Separately, health authorities can apply disciplinary sanctions to establishments that break the law, from written notices to fines and suspension of access to the central health system.
The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, does not apply to personal health data that has its own legislation, so health providers follow the health law and their health authority's rules. Free zones such as Dubai Healthcare City, DIFC and ADGM have their own data protection regimes as well.
This is general information, not legal advice. Confirm how the law and your health authority's rules apply to your organisation with your legal and compliance team.
Why this matters for AI tools
Many AI services send text, audio or documents to models hosted in other countries. For a hospital, a prompt that includes a patient's history, a dictated clinical note or a recorded consultation can be health data. If the AI service processes it outside the UAE without an approved exception, that use may conflict with Article 13.
The rule applies to processing and generation, not only storage. An AI tool that stores records in the UAE but sends them abroad to be summarised still processes them outside the State.
Questions to ask any healthcare AI vendor
Before a pilot, get written answers to these questions:
- Where exactly are prompts, audio, documents and outputs processed, including by any sub-processor or model provider?
- Where are logs, backups and disaster recovery copies stored?
- Is any data used to train or improve the vendor's models?
- Can the service run entirely inside our facility or a UAE data centre we choose?
- Which UAE health authority approvals or resolutions does the vendor rely on, if any?
- How are access, audit trails and deletion handled?
Running AI models on premise
The most direct way to keep AI processing inside the UAE is to run the models on hardware in your own facility. Open-weight language models can summarise notes, answer questions over internal documents and draft letters without any data leaving your network, and they can run fully offline.
A turnkey system arrives with the AI platform pre-installed: GPU scheduling so several departments can share the hardware, an OpenAI-compatible API so approved applications can connect, single sign-on, project isolation, audit logs and guardrails such as PII masking that run locally. Departments can start with a deskside NVIDIA DGX Station on standard office power and move to 8-GPU servers for hospital-wide services.
Voice agents for appointments
AI voice agents can answer calls, book appointments and pass callers to staff. Calls to a clinic can include health information, so ask the same residency questions about where call audio, transcripts and recordings are processed and stored before connecting a voice agent to patient lines.
A practical path for hospitals and clinics
Most healthcare organisations move in four steps:
- Map the AI use cases you want and the data each one touches.
- Confirm residency requirements with compliance and your health authority.
- Pilot one use case on premise, such as summarising non-identifiable documents, then expand to clinical data once controls are approved.
- Size shared hardware for the departments that will use it, with one support contract for hardware and software.
Frequently asked questions
Related solution brief
Clastiq Orchestrator
Turnkey AI platform: Kubernetes, storage, VMs, fractional GPU sharing and an OpenAI-compatible inference gateway on NVIDIA GB300, H200 and B200.
View solution brief detailsSources
Book a consultation call
Tell us about your workloads, users and facility. We will recommend the right NVIDIA hardware and solution, and prepare a quote.
More buyer's guides
Buyer's guide · Private AI
Private LLM on premise: a buyer's guide for UAE, GCC and MENA enterprises
What stays inside your perimeter, which UAE data rules to check, how to size GPU memory and power, and what to ask any vendor.
Read the guideBuyer's guide · NVIDIA hardware
NVIDIA H200 vs B200 vs B300 vs DGX Station: which on-premise AI system fits?
GPU memory, storage, networking and power side by side, with the workloads each NVIDIA system suits best.
Read the guideBuyer's guide · Voice AI
AI voice agents for UAE businesses: keep your number and connect your lines
Connect a mobile SIM, an etisalat by e& or du SIP trunk, or analog lines to an AI voice agent, and understand call capacity.
Read the guideBuyer's guide · Air-gapped AI
Air-gapped AI: how to run AI models with no internet connection
What changes when an AI system never touches the internet, how updates and models arrive offline, and what to plan before buying.
Read the guide