An AI front desk in a UAE clinic:
what it must say, and what it must hand to a person.

1 · The rules that apply, and what each one asks

Five documents bear on an AI that talks to patients in the UAE, and a sixth on recording calls. None of them mentions a receptionist. Each covers part of the job. The table puts them side by side; the notes below say what we read and how.

The DHA policy

The Dubai Health Authority’s policy Artificial Intelligence in the Healthcare (reference DHA/HISHD/PP-09, version 1, dated 1 July 2021) applies to every healthcare facility and professional licensed by DHA that uses AI in healthcare services, and to developers who use Dubai patient data. Its scope covers all AI solutions related to healthcare services used by those facilities. We read a clinic’s AI front desk as in scope: it is AI used in the course of a healthcare service, and it handles patient data. That is our reading, and the first point to confirm with DHA.

The parts that matter most for a front desk, in our words:

• Disclosure (4.3.2). Every AI solution for healthcare must disclose which functions are AI-enabled, what role the healthcare professional plays in the final decision, and the limits of the data and the algorithm.
• Supervision and override (4.4.1, 4.4.2). The AI must be supervised and monitored by its users. Where it can affect people’s lives significantly, designated users must be able to override it or reverse what it did.
• Challenge (4.2.3). Users must be able to challenge significant decisions through a built-in appeals route.
• Traceability (4.3.1). Failures must be possible to trace, diagnose and control.
• Graceful degradation (4.6.13). When hardware or software fails, the tool must raise alerts and wind down in stages rather than fail all at once.
• Incidents and audits (4.8.1, 4.8.2, 4.8.5). The facility reports known or suspected AI incidents, and anything that could affect patient safety, to DHA’s Health Regulation Sector, and has the AI audited regularly by an independent party.
• Patient data and education (4.8.3, 4.8.4). The facility sets clear rules on who may see and share patient information, and makes sure everyone involved, patients included, understands the AI and its use.
• The health ICT law (4.6.2). The tool must comply with every article of Federal Law No. 2 of 2019.

The PDF on dha.gov.ae is marked “Shared – Confidential”, so we summarise it rather than reproduce it; read the original. Its revision date, 1 July 2026, has passed: check with DHA whether a newer version is in force. Bird & Bird’s March 2025 note on “the DHA circular” on AI describes the same scope, principles and transparency list; we found no separate circular number, and this paper relies on the policy itself.

Dubai’s AI Ethics Guidelines

Smart Dubai published its AI Ethics Principles & Guidelines in January 2019. They are not binding; the document says so. They are still the only UAE text we found that speaks to an AI on a phone call. Guideline 1.3.2 says people should be informed of the extent of their interaction with AI systems. Guideline 1.3.2.2 says that if an AI system can convincingly impersonate a human being, it should do so only after telling the person it is an AI system. The guidelines’ own example is a conversational agent that makes phone calls, programmed to identify itself at the start of every conversation. That is a clinic front desk in all but name.

The same guidelines ask operators to make their AI accessible and usable fairly across user groups (1.1.4), and to give people a way to challenge decisions, with human reviewers who can overturn them (1.2.4). The DHA policy lists Smart Dubai’s AI principles and ethics as the first of its references.

Abu Dhabi: the DoH policy and the Responsible AI Standard

The Department of Health – Abu Dhabi issued its Policy on Use of Artificial Intelligence in the Healthcare Sector in April 2018. Al Tamimi & Company’s summary of it says the policy covers licensed providers, insurers and researchers, and patients; that users other than patients must have clear governance over the use of AI, clear boundaries on access to and sharing of patient information, and audits of the AI’s functioning reported to DoH; and that DoH monitors compliance through audits, inspections and incident reports, with sanctions for breaches.

In October 2025 DoH published a Responsible Artificial Intelligence (AI) Standard (DoH/ST/DDGO/RAI/V1/2025). It applies to all DoH-licensed healthcare entities that develop, procure or deploy AI systems. doh.gov.ae refused our automated requests, so we have not read either document in full, and this section relies on the law-firm summary. An Abu Dhabi clinic should read the Standard before it puts an AI on its phone line.

Federal Law No. 2 of 2019: health data

Federal Law No. 2 of 2019 on the use of information and communication technology in health fields was issued on 6 February 2019 and came into force in May 2019, according to Latham & Watkins’ client alert. It applies to all ICT uses in health fields in the UAE, free zones included. Its implementing regulation is Cabinet Decision No. 32 of 2020. Four articles shape a front desk:

• Article 4. Keep health data confidential and circulate it only in authorised cases; protect it from unauthorised change or deletion; keep it available to those authorised.
• Article 13. Health data about health services provided in the UAE may not be stored, processed, generated or transferred outside the UAE unless the health authority or the Minister has approved it. The fine for breaching this article is AED 500,000 to AED 700,000.
• Article 16. Patient health data may not be used for non-health purposes without the patient’s written consent, with listed exceptions such as insurers verifying benefits and requests from a health authority.
• Article 20. Health data is kept for at least 25 years from the patient’s last health procedure.

The PDPL: personal data

Federal Decree-Law No. 45 of 2021, the PDPL, came into force on 2 January 2022. K&L Gates’ summary notes three points that matter here. Health data that has its own legislation is outside the PDPL, as are entities in free zones with their own data-protection law, currently DIFC and ADGM. Health data is otherwise “sensitive personal data”, and consent must be clear, unambiguous and withdrawable. People may object to decisions made by automated processing that have legal consequences for them. A clinic inside DIFC answers to the DIFC’s own data-protection rules instead; Bird & Bird notes that the DIFC rule on autonomous and semi-autonomous systems requires a clear and explicit notice when the system is first used.

2 · Say it is AI, at the start, every time

The disclosure is the cheapest control on this list, and the one patients notice first. The DHA policy requires the AI functions to be disclosed. Dubai’s guidelines say an AI that could pass for a person should say so first, and they give a phone agent as the example. A clinic that wants one rule for every emirate can simply say it every time.

• First sentence, before anything else. Before the AI asks for a name, a date of birth or a reason for calling.
• Every conversation. Not only the first call. A returning patient may not remember, and may be a different family member.
• Every channel. Voice, WhatsApp, SMS, web chat and email. On text channels, in the first message and in the display name.
• A name is not a disclosure. “Sam” sounds like a person. The name and the words “AI assistant” always go together.
• Never deny it. If a caller asks “am I talking to a real person?”, the answer is no, followed by the way to reach one.
• Say how to reach a person. In the same breath as the disclosure.
• Say when a person takes over. “You’re now speaking with Aisha from the front desk.” The patient should always know which one they are talking to.

A sample opening line, in both languages:

“Corniche Physio, this is Sam, the clinic’s AI assistant. This call is recorded. A person is one step away. How can I help?”

“عيادة كورنيش للعلاج الطبيعي، معك سام، مساعد العيادة بالذكاء الاصطناعي. هذه المكالمة مسجلة، ويمكنك التحدث إلى أحد الموظفين في أي وقت. كيف يمكنني مساعدتك؟”

Corniche Physio is a fictional clinic. Have a native speaker on your own staff approve the Arabic wording for your clinic.

3 · Nothing clinical: no advice, no triage

A front desk handles bookings, questions about the clinic, reminders and paperwork. The moment it tells a patient whether a symptom matters, whether to come in, whether an exercise is safe or what a result means, it is doing clinical work.

The DHA policy’s heavier duties are written for AI that takes part in care: the role of the professional in the final decision (4.3.2), override for AI that can affect lives significantly (4.4.2), and independent validation by a competent third party (4.3.3). It also points to the medical-liability and medical-device rules (4.6.3, 4.6.5). Our reading is that a front desk which never advises or triages keeps clinical judgement where the licence is, with the clinician. That is the simplest line to defend, and it is the line we draw.

• It may: book, move and cancel appointments; answer from the clinic’s own approved list (hours, location, parking, services, the price list, which insurers the clinic accepts); send reminders and intake forms; take a message.
• It may not: comment on symptoms, suggest whether to come in or go elsewhere, rank who is more urgent, discuss medication or results, or reassure a patient about their condition.
• When a clinical question comes up: it says plainly that it cannot advise, passes the conversation to the duty clinician, and tells the patient when to expect a call back.
• When it sounds like an emergency: it does not assess. It tells the caller to call 998 for an ambulance, the number the UAE government lists, and alerts staff at once. The clinic’s clinical lead writes the list of words and situations that trigger this, and reviews it.

Booking against a clinician’s list is not triage. Deciding that one caller’s pain can wait until Thursday is.

4 · What goes to a person, and how fast

No UAE document we found sets hand-off times for an AI front desk. The DHA policy asks for supervision, override and a way to challenge; Dubai’s guidelines ask for human reviewers. The times below are the defaults we would start from. Each clinic sets its own, writes them down, and checks them in the log.

The hand-off carries the whole story: who called, what they asked, what the AI already did, and why it is handing over. The patient should never have to repeat themselves, and the reason for every hand-off goes on the record.

5 · Consent and recording

Recording private conversations without consent can be an offence in the UAE. A law-firm summary (AMSA&LC, May 2025) points to Article 431 of Federal Decree-Law No. 31 of 2021 and Article 44 of Federal Decree-Law No. 34 of 2021. So the AI says the call is recorded at the start, alongside the AI disclosure, and offers a person to a caller who would rather not be recorded.

• Collect what the task needs. A booking needs a name, a number and a time. It does not need a history of the complaint.
• Keep health purposes separate. Appointment reminders are part of the service. Using what patients said for marketing is a non-health purpose, and Article 16 of the health ICT law requires the patient’s written consent for it.
• Make consent clear and withdrawable. Where the PDPL applies, consent must be clear and unambiguous and can be withdrawn. A patient who says “stop messaging me” is withdrawing it, and the AI records that and stops.
• Keep it in the UAE. Article 13 of the health ICT law keeps health data in the UAE unless approved. That includes the AI model: a transcript sent to a model hosted abroad is processed abroad. Ask any vendor where each part runs, the model included.

6 · Arabic and English, served equally

An AI front desk in the UAE has to work in Arabic and English, with the same rules in both: the same disclosure, the same hand-offs, the same limits. The DHA policy requires AI for healthcare to be fair and free of bias (4.1.2); Dubai’s guidelines ask that it be usable fairly across user groups (1.1.4).

• Switching is normal. Callers move between Arabic and English mid-sentence. The AI follows them.
• Dialects vary. If the AI cannot understand a caller reliably, it hands over rather than guesses.
• Other languages. Many clinics also serve patients in Hindi, Urdu, Tagalog or Russian. If the AI does not speak the caller’s language, it says so and offers a person.
• Messages follow the conversation. Confirmations and reminders go out in the language the patient used.
• Measure it by language. Compare hand-off rates, repeat calls and complaints for Arabic and English callers. A gap between them is a fairness problem to fix, not a statistic.

7 · What to log, so the clinic can show a regulator

The DHA policy asks for failures that can be traced (4.3.1), incident reports (4.8.1) and independent audits (4.8.5). The health ICT law asks that health data be protected from unauthorised change (Article 4) and kept for 25 years (Article 20). All of that comes down to one log the clinic owns, in the UAE, that nobody can quietly edit:

Where a transcript holds health information, we would treat it as part of the health record and keep it for the same period. That is our reading; confirm it with your regulator.

8 · Assist before autonomy

The DHA policy defines supportive technology as technology that helps a person make the final decision without replacing them, with the person responsible for what it does. “Assist before autonomy” turns that into a working rule.

• Every action starts in Assist. The AI prepares the work; a person approves it.
• Promote one action at a time. An action runs on its own only when its record is good and the person who owns the role signs off. Reminders and rebooking a missed visit are typical first candidates.
• Demote on evidence. After an error, a complaint or a dip in its numbers, the action goes back to Assist.
• Some actions never leave Assist. Anything clinical. Anything that commits money, such as a refund or a write-off.

This also answers the policy’s supervision duty (4.4.1) in the work itself: staff supervise every action as it happens, rather than reviewing a sample at month end.

9 · Where Sam fits

Sam is Xamun’s AI worker. Every Xami worker is called Sam; the role is what changes. On a clinic front desk Sam works inside ClinicOS. It answers calls and messages day and night, books, moves and cancels sessions, answers questions from the clinic’s own list (hours, parking, prices, cover) and sends reminders. Sam introduces itself as an AI assistant at the start of every call and message. Anything clinical, and any caller who asks for a person, goes to a person with the full story. Sam starts in Assist; actions are promoted one at a time by the role owner, and anything clinical stays in Assist always. It speaks English and Arabic, and every action lands in records the clinic owns.

Sam is in early access. Nothing in this paper says Sam meets a regulator’s requirements; that is for the clinic and its regulator to judge. The rules above apply to any AI front desk, ours or anyone else’s.

10 · Questions to confirm with your regulator

These points are open to reading. Settle them with DHA, DoH or MOHAP, as relevant, before building a process around one interpretation:

• Scope. Does DHA treat an administrative front-desk AI, with no clinical function, as an AI solution for healthcare under PP-09? If so, does the independent third-party validation in 4.3.3 apply to it?
• The current version. Has PP-09 been revised since its 1 July 2026 revision date?
• Abu Dhabi. What does the DoH Responsible AI Standard of October 2025 require of a conversational AI, and does it require notice or registration before use?
• Transcripts. Are call recordings and chat transcripts health data under Federal Law No. 2 of 2019, to be kept for 25 years and stored in the UAE?
• The model. If any part of the AI runs outside the UAE, what approval under Article 13 would cover it?
• Incidents. Which front-desk incidents should be reported to DHA’s Health Regulation Sector?

11 · Where to start

Most of the work is writing down rules a good front-desk lead already follows. In order:

• Write the role. The queue the AI owns, the actions it may take, the mode of each, and who it hands over to.
• Write the opening line. In Arabic and English, approved by the clinic, with the AI disclosure, the recording notice and the way to reach a person.
• Write the hand-off table. Situations, owners and times, with the emergency list written by the clinical lead.
• Decide where the log lives. In the UAE, owned by the clinic, kept for as long as the health record.
• Start in Assist. Promote nothing until the log shows it is ready.

Then confirm the open points with your regulator, a lawyer or your insurer before go-live.