United Arab Emirates
Device law, data privacy, and hosting tier for United Arab Emirates, on one page.
Device law
Full sectionReliance-based. Federal Decree-Law 38 of 2024 took effect 2 January 2025 and consolidated regulation under the Emirates Drug Establishment, which by early 2026 absorbed the medical-device functions previously held by MOHAP. The UAE uses GHTF-style classification and relies primarily on approvals from reference regulators such as EU CE marking or US FDA clearance. The Abu Dhabi DOH and Dubai DHA each publish AI healthcare policies that sit inside the broader federal and emirate framework, including data protection.
Non-clinical education, intake, routing. Same green zone.
Reliance imports the EU and FDA strict line by reference, so there is no softer back door for triage-capable software.
A prior EU or FDA status would smooth entry if registration were ever needed, but the non-clinical design avoids that. The binding constraint in the UAE is data residency, not device classification. See Hosting.
Data privacy
Full sectionThis is the strictest residency market of the six. The federal PDPL sets general data-protection duties, but the decisive instrument is Federal Law 2 of 2019 on the use of ICT in health fields, which mandates that health data stay confidential and, in effect, requires it to be stored and processed inside the UAE, with transfer outside subject to regulator approval. The financial free zones, DIFC and ADGM, run their own GDPR-style regimes.
Health data localisation is effectively mandatory. Any identifiable patient processing must run in-country. This makes self-hosted or in-UAE managed inference a precondition, not an optimisation. See Tier 1 in Hosting.
Hosting tier
Full sectionLocalisation effectively mandatory. UAE
Health data cannot leave the country. Run any identifiable patient inference on a self-hosted model in-country, or on in-UAE managed infrastructure. Global external APIs are acceptable only for fully de-identified or non-patient content, for example generating generic education copy offline.