DHA AI policy: what a clinic must do first

· Firas Ajjour

A doctor at a desk reading and signing a document next to a computer

The DHA AI policy (Dubai Health Authority, ref. DHA/HISHD/PP-09) applies to every DHA-licensed clinic that uses AI in its services. Before you switch on any AI tool, know which features are AI, who is accountable, how a person overrides it, and how incidents reach DHA. This is a summary, not legal advice.

Does the DHA AI policy apply to my clinic?

Almost certainly, if you are DHA-licensed and an AI tool touches your services. The policy defines an AI solution widely: any product or service whose operation or outcome is materially influenced by AI. A chat assistant for patients, a tool that drafts notes, or software that flags who may miss an appointment can all count. The published version lists a revision date of 1 July 2026, so ask DHA whether a newer version applies.

What does the policy ask of a clinic?

  • Disclose which features are AI-enabled, how they were validated, and their limits (4.3.2).
  • Keep a person in charge: designated users can override or reverse the tool, and accountability is agreed with the vendor (4.4.2, 4.2.1).
  • Have the AI audited regularly by an independent third party (4.8.5).
  • Report AI incidents and patient-safety issues to DHA's Health Regulation Sector (4.8.1, 4.8.2).
  • Set who can access patient data, and train staff and patients on the tool (4.8.3, 4.8.4).

In practice these become ordinary design choices. In an example scenario, a WhatsApp patient assistant says it is an AI, answers only from replies the clinic approved, and hands any clinical question to a named staff member. In another, an AI reads the clinic's own booking and billing exports to find empty hours, and a person checks every finding before the owner sees it. The policy calls this supportive technology: it helps people decide and does not decide for them.

5 questions to ask any AI vendor before you sign

Use this list this week, whether or not you ever work with us. Keep the written answers on file.

  1. Which features are AI, and how were they validated? (4.3.2, 4.3.3)
  2. How does a named person in my clinic override or reverse what it does? (4.4.2)
  3. Who is accountable when an outcome is wrong, and is that in the contract? (4.2.1)
  4. Where is patient data stored, and which UAE and Dubai laws does that meet? (4.5, 4.6.1)
  5. What happens when it fails, and will you help us report an incident to DHA? (4.6.13, 4.8.1)
Ask these questions before you sign, not after, and you never pay for an AI tool you later have to switch off.

Generic AI tools leave the DHA rules to you. When software is built around how your clinic already works, the disclosure, the hand-over to staff and the override button are part of the design. You get only the features you need, paid once and yours, with the work fitted to your size and needs, and no competitor can copy how it is set up for you. Willow is led by a health-tech CTO with 19+ years in software and e-health, and sometimes the honest advice is an off-the-shelf product. Not happy after the first month? We refund everything you paid us.

Have an AI tool on the table, or one running that nobody has checked against the policy? Message us on WhatsApp with what it does, and we will tell you which of the five questions it already answers.

Rules summary, last checked 17 October 2026. Summary, not legal advice: read the official policy and take legal advice for your own case.

Could this work for your clinic?

Tell us on WhatsApp how your clinic works today. We will tell you plainly whether this fits, and what the first step would be.

Ask us on WhatsApp

Not happy after the first month? We refund everything you paid us.