UAE Healthcare AI and Genomics: DoH's AI Standard, Malaffi and Genomes

The UAE is doing something few health systems have managed: connecting a national genome programme, emirate-level health information exchanges and a formal AI standard into one working system. In Abu Dhabi, a doctor can already see a consenting patient's pharmacogenomic report inside Malaffi, the emirate's health information exchange. And since October 2025, every licensed healthcare entity in Abu Dhabi falls under the Department of Health's Responsible AI Standard.

For hospitals, clinics and software vendors serving the UAE, this changes what "compliant" means. It is no longer only about licensing, coding and pushing data to the right exchange. It is about how AI is governed and how genomic insights reach the point of care.

This post explains what is in place in 2026 and what providers and vendors should do. If you are choosing hospital software for the UAE, start with our guide to hospital management systems in the UAE, which covers DHA, DOH, MOHAP and NABIDH basics.

The three exchanges, now connected

The UAE has three health information exchanges, each run by a different authority:

In January 2023 the authorities announced successful integration between Riayati, Malaffi and NABIDH (WAM report), so clinicians in one emirate can access relevant records created in another. Later phases extended that, for example letting Abu Dhabi clinical users see records from facilities in the Northern Emirates through Riayati.

Each exchange still has its own onboarding, profiles and rules. Dubai's DHA, for instance, published version 2 of its standards for interoperability and data exchange in 2025. A provider operating in more than one emirate needs to meet each exchange's requirements, even though the data now flows between them.

The Emirati Genome Programme

The Emirati Genome Programme is a national effort to sequence the genomes of Emirati citizens and use that data for preventive and personalised care. By April 2025, more than 800,000 Emiratis had contributed samples, according to The National, and reporting in 2026 describes sequenced data for more than 800,000 citizens.

Three developments make it relevant to everyday care, not only research:

• Pharmacogenomics at the point of care. In October 2023, DoH and M42 announced a collaboration under which physicians can access pharmacogenomic reports for consenting programme participants through Malaffi (DoH announcement). A prescriber can see whether a patient's genes affect how they metabolise a drug before writing the prescription.
• Linked research. Genetic data linked to health records enables population studies. A study published in February 2026 used programme data to map variation in the risk of inherited vision loss.
• Clinical trials. M42 has launched genomics-based trials, including one focused on Alzheimer's prevention.

AI policy: from the 2018 policy to the 2025 Responsible AI Standard

Abu Dhabi was early. DoH issued a policy on AI in healthcare in 2018, described at the time as the region's first, which set minimum requirements for AI used by licensed providers, including validation and regular audits of AI functionality.

In October 2025, DoH published a new Responsible AI Standard (document DoH/ST/DDGO/RAI/V1/2025), issued by its Data and Digital Governance Office. It applies to DoH and all licensed healthcare entities in Abu Dhabi, including hospitals, clinics, research institutions and their affiliates, and its stated aim is to turn responsible AI principles into operational directives with ongoing evaluation for patient and community safety.

Alongside it, at Abu Dhabi Global Health Week in April 2025, DoH convened international officials to shape a declaration on AI governance principles for healthcare, with emphasis on transparent testing, responsible data access and agile regulation.

We have not seen the full text of the 2025 standard in public summaries, so providers should obtain it directly from DoH. Based on the policy direction, these are the areas to prepare for:

1. Inventory. Knowing every AI system in use, including AI features inside EMR, imaging and revenue cycle products.
2. Validation before use. Evidence that a model performs acceptably on the population you serve.
3. Ongoing monitoring. Tracking performance, drift and incidents after go-live, not only at procurement.
4. Transparency. Clinicians and, where appropriate, patients knowing when AI contributed to a decision.
5. Accountability. A named owner for each AI system and a route to report problems.

AI already running on Malaffi data

DoH has also been using AI at system level. Reports in 2025 described a patient risk profiling capability rolled out across Abu Dhabi hospitals and clinics, built on Malaffi data, and a health-focused large language model, Med42, developed in Abu Dhabi to help clinicians work with medical information.

For providers, the implication is that the regulator is also a sophisticated AI user. Expect questions about data quality in what you submit to Malaffi, because downstream models depend on it.

What this means for providers

The last row deserves emphasis. The UAE's federal health data law restricts storing or processing health data outside the country except in permitted cases. Any AI tool that sends patient data to a model hosted abroad needs careful review. We cover this in detail in our guide to health data residency in India and the UAE.

What this means for software vendors

If you build or sell clinical software in the UAE, three capabilities are becoming baseline:

• Exchange-native integration with Malaffi, NABIDH and Riayati, with clean coding and complete encounter data, not a once-a-day batch upload.
• Ability to surface external clinical data, such as pharmacogenomic results, at the moment of prescribing or ordering.
• AI governance features: a way to switch AI functions on or off per facility, log AI-generated content, show clinicians what was AI-assisted, and export evidence for audits.

At Algon, we build hospital systems for UAE providers with in-country hosting, exchange integration through our healthcare integration layer, and AI features designed for clinician review and logging, as described on our clinical documentation AI page.

How to start in the next 90 days

1. List every AI system in your facility, including features inside larger products, and record where each processes data.
2. Get the DoH Responsible AI Standard (Abu Dhabi) and map each requirement to an owner.
3. Review your Malaffi or NABIDH submissions for completeness and coding errors.
4. Brief prescribers on accessing pharmacogenomic reports where relevant.
5. Update vendor contracts to cover AI disclosure, in-country processing and incident reporting.

Worked example: a pharmacogenomic prescribing alert

Consider a 150-bed private hospital in Abu Dhabi with its own EMR, connected to Malaffi. A clinician is about to prescribe a drug whose effect is known to vary with a patient's genotype. Today, the clinician would have to remember to open Malaffi, find the pharmacogenomic report and read it. Most will not, especially in a busy OPD.

A better design, where the EMR and exchange integration allow it:

1. When a patient is registered, the EMR checks whether Malaffi holds a pharmacogenomic report for them, respecting consent status.
2. If one exists, the EMR stores a reference and a short structured summary of the relevant gene-drug findings.
3. When a clinician orders a drug on the hospital's gene-drug watch list, the EMR shows a short alert with the relevant finding and a link to the full report.
4. The clinician's decision, to proceed, change dose or switch drug, is recorded.

The clinical content of the watch list must come from the hospital's pharmacy and therapeutics committee, using recognised pharmacogenomic guidance, not from the software vendor. The software's job is to make the right information appear at the right moment and to log what happened. Keep alerts few and specific; an EMR that fires generic warnings on every prescription trains clinicians to ignore all of them.

Common mistakes providers make

• Treating the exchanges as a reporting obligation. Sending data late or poorly coded makes the shared record less useful for everyone, including your own clinicians when patients return.
• Assuming AI rules apply only to "AI products". AI features embedded in imaging, dictation or revenue cycle tools are in scope too.
• Ignoring consent nuances. Genomic data carries heightened sensitivity. Access should follow programme consent exactly, and staff training should say so.
• Building separate integrations per emirate from scratch. The exchanges differ, but a shared integration layer with emirate-specific adapters is cheaper to maintain.

Conclusion

The UAE, and Abu Dhabi in particular, is moving from digitising records to using them: genomic insights in the exchange, AI risk models on top of it, and a formal Responsible AI Standard governing how providers use AI. The exchanges are connected, the genome programme is past 800,000 participants, and expectations of providers are rising.

For hospitals and vendors, the work is concrete: govern AI with an inventory and owners, keep data in-country, submit clean data to the exchanges, and make sure clinicians can act on genomic information. If you are building or replacing clinical software for the UAE, talk to us about doing it with these requirements designed in from the start.