1 Purpose and limits of use
This policy governs approval, use and monitoring of AI, automation and digital platforms. Assistance with drafting, analysis and research is allowed within an approved purpose, with a human responsible for the output. Systems do not automatically approve beneficiary eligibility, disbursement, diagnosis, treatment, disciplinary action or committee decisions.(1)
2 Assessment before approval
The applicant records purpose, data, users, provider, processing location, risks and a manual alternative. Technology reviews security, integration and recovery; privacy reviews legal basis, transfers and retention; the business owner checks accuracy. The authorised decision-maker approves use within limits. Uses with high impact on rights or health require documented assessment and appropriate legal or medical review before operation.
3 Protecting inputs
Identity, health or financial information, secrets and login data must not be entered into an unapproved public service. Testing uses synthetic or anonymised data, assessing re-identification risks. Provider contracts are reviewed for training on data, deletion, subcontractors, hosting and audit rights. A “no training” statement alone is insufficient assurance.(2)
4 Human review and evidence
A qualified user verifies legal texts, figures, references, names and accounts before using outputs; a plausible-looking citation is not enough. Conclusions are linked to evidence, and missing information and uncertainty disclosed where material to a decision. Dates, minutes, approvals and signatures must not be invented to evidence work that did not occur.
5 Operation and change
Proposal permissions are separated from execution. Tools connected to email, files and systems receive least-privilege access. Sending, material changes and disbursements require appropriate human approval. Instructions inside external documents are treated as data, not trusted commands. Updates, bias and errors are tested in the audience’s language before rollout; configuration versions, change records and rollback are retained.
6 Incidents and suspension
Use can be stopped and access revoked for leakage, material misinformation or unauthorised execution. Evidence is preserved and incident and privacy routes followed. Affected decisions are corrected after human review. Performance and providers are reassessed periodically; tools that cannot be controlled or return Association data are withdrawn.
8 Roles and responsibilities
The policy owner approves the framework, provides resources and authorises exceptions. The technology officer is responsible for security, integration and access management; the privacy officer for the basis of processing, transfer and retention; and the business owner for output accuracy and fitness for purpose. The authorised decision-maker approves use within the limits, and users remain responsible for every output attributed to them. Each role's decisions must be documented in the register.
9 Disclosure and transparency
Beneficiaries or relevant bodies must be informed when an AI tool materially affects a service or decision concerning them, with an opportunity to request human review. Automated output must not be presented as human opinion. Tool limitations and sources must be explained on request. The reason for use and its effects must be retained in the register.
10 Intellectual property and third-party rights
Outputs created for Association purposes belong to the Association unless the contract provides otherwise. Users must check that outputs do not infringe copyright, trademarks or other third-party rights and must not include protected content without a basis. Data and model rights must be preserved under the supplier contract; outputs must not be used outside the approved purpose.
11 Training and awareness
Access to an approved tool requires prior training on this policy, usage limits and data protection. Training must be renewed when tools or legislation change, with attendance recorded. Accessible materials in users' language and channels for questions and reporting must be provided.
12 Breaches and sanctions
Use outside approved limits, entry of prohibited data, concealment of an incident or presentation of unverified automated output constitutes a breach. Action follows Association regulations and the impact and may include access suspension and accountability, with referral to competent authorities where appropriate. Sanctions do not replace correcting affected decisions.
References in the approved document
-
The Association’s approved 2026 Articles of Association, authority, confidentiality and oversight controls; Federal Decree-Law No. 45 of 2021 and Federal Law No. 2 of 2019 according to data scope. This document establishes internal implementation controls without changing higher legal powers or requirements.
-
Dubai Health Authority AI policy HISHD/PP-09 where applicable to a licensed health service. This policy grants neither a medical licence nor permission to transfer data. This document establishes internal implementation controls without changing higher legal powers or requirements.