Is Your Health App a Medical Device in the UAE? EDE Registration Rules, Costs and Timelines for 2026

Your health app is a regulated medical device in the UAE the moment its software — on its own, without a hardware instrument — is intended to diagnose, screen, monitor, predict, treat or triage a patient. If it only logs, educates, books or reminds, it is a wellness product and needs no device registration. Since 2 January 2026, that judgement is made by the Emirates Drug Establishment (EDE) under Federal Decree-Law No. 38 of 2024, not by MOHAP. The only binding answer is an EDE classification letter, and it costs AED 500.

Most Dubai founders discover this in the wrong order: they build the app, win a clinic pilot, then find out at contract stage that a feature they shipped in week three made the whole product a registrable device. This guide gives you the test, the fees, the timelines and the Dubai-specific layer on top.

The regulatory ground moved under you in 2026

Three things changed at once, and none of them were announced to app developers:

New primary law. Federal Decree-Law No. 38 of 2024, governing medical products, the pharmacy profession and pharmaceutical establishments, was issued on 1 October 2024 and came into force on 2 January 2025, superseding Federal Law No. 8 of 2019. It gave affected entities a one-year grace period to comply — which expired on 2 January 2026.
New regulator. The Emirates Drug Establishment is now the federal authority for medical products. By early 2026 the EDE had absorbed the medical-device services previously run by MOHAP: product classification, issuing and renewing marketing authorisations, import permits, advertising licence approval and renewal, post-market vigilance reporting, and manufacturer registration and renewal. Submissions go through the EDE portal with UAE PASS authentication — not MOHAP.
New Dubai standard. The Dubai Health Authority issued Telehealth Standard DHA/HRS/HPSD/ST-14 version 4 on 26 September 2025, effective 26 November 2025. It regulates the platform, not just the doctor.

The market that these rules land on is not small. Dubai had 5,931 licensed health facilities in the first half of 2026, up 7% from 5,541 a year earlier, and 70,566 licensed health professionals, up 6.5% from 66,277. In the same period, DHA inspection and monitoring visits rose 36.3% year on year. More buyers, and more enforcement, at the same time.

If your pitch deck says "clinical decision support", you have already told the regulator your software is a medical device. The phrase is a classification trigger, not a marketing adjective.

The intended-use test: what actually makes software a device

The UAE follows the international definition used by the IMDRF: software as a medical device (SaMD) is software intended for one or more medical purposes that performs those purposes without being part of a hardware medical device. Two consequences people miss:

Intended use beats architecture. A plain web form becomes a device if you tell users it tells them whether a mole is suspicious. A sophisticated AI pipeline stays out of scope if it only summarises notes for a clinician to write up.
Your own marketing copy is evidence. Classification is driven by claims. App Store descriptions, landing-page headlines and sales decks are all read as statements of intended use.

Here is how the test usually lands for the product types we are asked to build in Dubai. Treat it as a planning guide, not a ruling — the classification letter is the only binding answer.

What the app does	Likely status	Why
Appointment booking, reminders, patient portal, invoices	Not a device	Administrative purpose, no clinical claim
Step, sleep, calorie and habit tracking marketed as general wellness	Not a device	Lifestyle claim, no diagnosis or treatment intent
Teleconsultation video, chat and e-prescription routing	Not a device, but DHA-regulated	Clinician decides; the platform still needs DHA approval under ST-14
Symptom checker that outputs a possible condition or urgency level	Device	Diagnostic and triage intent, performed by the software
Algorithm that flags findings on an image, ECG or lab result	Device, higher risk class	Drives a diagnostic decision; harm if wrong
Insulin, oncology or anticoagulant dose calculator	Device, higher risk class	Treatment intent with direct patient harm potential
Chronic-disease app that adjusts a care plan automatically	Device	Software, not the clinician, is making the call

Risk class matters because it sets the dossier depth and the review queue. The EDE uses four risk classes, and the guidance circulating in the market writes them inconsistently — some documents use A to D, others I to IV, and separate IVD rules apply to diagnostic assays. That inconsistency is exactly why the AED 500 classification request exists. Pay it before you write the clinical copy, not after.

What registration actually involves

If your software is in scope, the route is the standard medical-device pathway. There is no lighter SaMD track in the UAE.

Appoint a Local Authorized Representative (LAR). A UAE-licensed entity holding an EDE pharmaceutical-establishment licence — warehouse, medical store or marketing office. The LAR files on your behalf, holds the marketing authorisation certificate, and owns vigilance reporting and recalls. Foreign developers cannot self-file.
Register the manufacturing site. For software, that is your development organisation. Expect to produce an ISO 13485 quality management system certificate.
Confirm classification with the official EDE letter.
Build the dossier. Administrative, technical and quality documents. For software this centres on IEC 62304 software life-cycle evidence — development planning, requirements traceability, architecture, verification, configuration management, problem resolution — plus risk management to ISO 14971. This is the part that cannot be retrofitted in a sprint: IEC 62304 wants records created while you built, not reconstructed afterwards.
Submit via the EDE portal using UAE PASS.
Technical committee review. Published service time is 45 working days. In practice, market advisers report 2–3 months for the lowest risk class and 5–8 months for the highest.
Receive the registration certificate, valid five years from committee approval.

EDE government fees, 2026

Service	Government fee (AED)
Product classification letter	500
Marketing-authorisation application fee	100
Medical device registration	5,000
Manufacturer (site) registration, incl. application fee	10,100
Renewal application fee	100
Registration renewal (per 5-year cycle)	2,500
First-time total, single product	about 15,700

Those are government fees only. They exclude LAR service retainers, ISO 13485 certification, technical writing and the engineering cost of producing IEC 62304 evidence — which, on a product built without it, is usually the largest line item by a wide margin.

The Dubai layer: DHA ST-14 version 4

EDE registration is the federal question. In Dubai there is a second, separate gate that catches products the EDE would wave through — including ordinary teleconsultation apps.

Under Telehealth Standard ST-14 version 4, effective 26 November 2025:

Only a DHA-licensed facility can deliver telehealth. A platform licence is technology only — it does not let you provide care.
Platforms must be assessed and approved by DHA through health facility licensing before use (section 7.6.2), whether the platform is for internal or commercial use.
Legal representation in Dubai with a relevant commercial or trade licence (section 7.6.3), and a named Business Technical Director as technical owner (section 7.6.4).
Accreditation within 24 months of initial licensing or renewal (section 5.2), through bodies such as QAI, EIAC, JCI, URAC or NCQA.
Technical baseline: encryption in transit and at rest, multi-factor authentication, ISO 27001 or equivalent security certification, servers located inside the UAE, Arabic and English interfaces, and integration with the health information exchange — NABIDH in Dubai.
Out of scope for telehealth: emergency cases, and prescribing narcotic or controlled medication.

On AI specifically, the UAE position is consistent across regulators: AI may provide clinical decision support, symptom assessment and documentation assistance, but it cannot replace physician judgement or independently diagnose a patient. Design the human-in-the-loop step as a product requirement, not a disclaimer. If you are scoping a build, our guide to healthcare app development in Dubai covers the DHA and NABIDH workflow end to end, and NABIDH integration for clinic EMR systems covers the certification path for clinical data.

Health data cannot leave the country — and this one has a number attached

Federal Law No. 2 of 2019 on the use of information and communication technology in health fields, Article 13, prohibits storing, processing, generating or transferring health information relating to health services provided in the UAE outside the country, unless a health authority approves it. Violating Article 13 carries a fine of not less than AED 500,000 and not more than AED 700,000. Limited exemptions exist under MOHAP Resolution No. 51 of 2021 — patients treated abroad, overseas laboratories, research and consented insurance claims among them.

Two practical consequences for a 2026 build: health records must be retained for a minimum of 25 years from the patient's last procedure, which is an architecture and cost decision rather than a policy line; and a default deployment on a US or EU cloud region, or a third-party analytics SDK quietly shipping event payloads offshore, is the single most common way a well-built Dubai health app becomes non-compliant. See UAE hosting and data residency for region and certification options, and the UAE PDPL compliance checklist for the consent and data-subject obligations that sit alongside the health rules.

What this costs to get right, and what it costs to get wrong

Budget the compliance layer separately from the app itself. Dubai market figures for the pieces a clinical product needs:

Line item	Typical Dubai range	Basis
NABIDH-certified EMR licence	AED 12,000 – 40,000	One-time
Connector and integration work	AED 8,000 – 25,000	One-time
UAE-region cloud hosting	AED 500 – 3,000	Per month
EDE government fees, first product	about AED 15,700	One-time, 5-year certificate
EDE renewal	AED 2,600	Every 5 years

Against that, the cost of getting it wrong is concrete: an AED 500,000 to 700,000 exposure on a single data-residency breach, a platform that cannot legally go live in Dubai until DHA has assessed it, and clinical data that cannot flow into NABIDH without certification — which in practice means your pilot clinic cannot use the product in production at all.

How Aquarius handles it

We scope the regulatory question in week one, before any clinical feature is designed. That means an intended-use statement written to survive classification, a claim review across the app copy and the marketing site, an architecture pinned to a UAE region with 25-year retention designed in, and — where the product is in scope — IEC 62304 and ISO 14971 records produced as the build happens rather than reconstructed under deadline. Where a feature would push an otherwise unregulated product into device territory for marginal value, we say so and show you the cheaper version of the same outcome. See our pricing for engagement ranges, or tell us what your app claims to do and we will tell you which side of the line it sits on.

FAQ

Does a wellness or fitness app need EDE registration in the UAE?

No, provided it makes only general wellness claims — activity, sleep, hydration, habit tracking — and does not claim to diagnose, screen, monitor or treat a condition. The risk is claim drift: adding a feature that interprets a reading for the user can move the product into scope without any change to the business model.

Who decides whether my software is a medical device?

The EDE, via a product classification letter costing AED 500. Opinions from a developer, a lawyer or an overseas regulator are useful for planning but are not binding in the UAE. Request the letter before launch.

My app already has FDA clearance or a CE mark. Is that enough?

No. Approvals from reference regulators strengthen the dossier and the UAE classification approach follows the same international principles, but the UAE still requires its own registration, filed by a UAE-licensed Local Authorized Representative. There is no automatic recognition route.

How long does EDE registration take?

The published technical committee service time is 45 working days. Market advisers report a realistic 2–3 months for the lowest risk class and 5–8 months for the highest, driven mostly by dossier completeness. Certificates run five years from approval.

Can I host a Dubai health app on a US or EU cloud region?

Not for UAE health data. Article 13 of Federal Law No. 2 of 2019 requires it to stay in the country absent health-authority approval, with a fine of AED 500,000 to 700,000 for breach, and DHA ST-14 version 4 separately requires UAE-located servers for telehealth platforms. Plan a UAE region from day one — and audit every third-party SDK, because analytics and crash reporting tools are the usual leak.

Is an AI symptom checker allowed in the UAE at all?

Yes, within limits. AI may support clinical decisions, assess symptoms and assist documentation, but it cannot independently diagnose or replace physician judgement. A symptom checker that outputs a possible condition or an urgency level is very likely a medical device and should be classified before launch.