From 1 January 2027 no critical health system in Abu Dhabi may rely on a single cloud provider. A target that consolidated onto one hyperscaler now has a second build and an on-site backup to finish in just over three months.

The circular goes to all licensed healthcare facilities and providers in the emirate, and to all service providers in the emirate that generate, access, store, use, process or transmit health information. Its operative sentence then requires healthcare providers, payers and service providers to plan, implement and sustain multi-cloud and on-premise strategies, including on-site physical backups.

That reaches third-party administrators, revenue-cycle companies, laboratory and imaging systems, telehealth platforms and electronic record vendors. The circular does not say whether a vendor serving Abu Dhabi clients from outside the emirate is itself an addressee. The facility using it is, so the requirement arrives at the vendor through the customer contract either way.

The instruction has two parts, and the second is easy to miss. Multi-cloud alone could be met by replicating to a second provider. The circular also requires on-site physical backups and on-premise strategies. A group that shut its server room when it consolidated onto one hyperscaler now needs a second provider, replication between the two, local backup hardware and the people to test restores.

The circular sets no architecture, names no acceptable providers and fixes no recovery standard, so the cost depends on how the business chooses to comply. For a buyer that is a 2027 capital and operating line the seller's forecast may not carry.

Nothing in Circular 191/2026 says which systems are critical, and it cites no earlier instrument. DoH has, however, already made facilities classify their own. Its Policy on Risk Management and Business Continuity for the Health Sector, effective March 2026, requires licensed facilities, ambulance providers and supporting services, a category that includes IT, to run a business impact analysis that identifies critical functions and sets maximum tolerable downtime and recovery time and recovery point objectives for each, and to maintain redundancy for critical systems including electronic medical records (DoH/POL/CEPAR/PRMBCHS/V1/2026).

That analysis goes to DoH annually or on request. On our reading, a facility that has named a system critical in its own filing will find it hard to argue the same system falls outside the cloud rule.

From the circular's date to 1 January 2027 is 98 days on our count. The circular gives no transition period, no phasing by facility size and no exemption process. Enquiries go to DoH's AAMEN and security operations teams. A hospital group with its own infrastructure team can start on its core systems now. A single-site clinic running a vendor's cloud-hosted record system has no infrastructure of its own to change, and depends on the vendor.

A transaction signed between now and year end closes into the effective date or shortly after it. A target running its record, claims or laboratory systems on one provider carries a known gap, a build cost and a regulatory exposure, and none of that shows in trailing accounts. For a software or revenue-cycle target the issue is larger: its Abu Dhabi customers cannot meet their own obligation unless it complies, and a vendor that cannot show compliance by January has revenue at risk.