Most healthcare operators in the UAE keep a biomedical asset register, and most treat it as an inventory: a list of what equipment exists, where it is, and roughly what condition it is in. The list is good enough for procurement, insurance, and answering "how many do we have". It was never built to be an evidence base, because nothing required it to be one. The late-2025 move of medical-equipment regulation from MOHAP to the Emirates Drug Establishment does not change what equipment an operator owns. It changes what the operator has to be able to prove about it, and an inventory list cannot prove things.
This piece is a perspective on what that regulatory shift actually changes for facility operators. The argument is opinionated. We are not arguing that operators were negligent, or that registers were pointless. We are arguing that the bar has moved from holding an inventory to proving a body of evidence: that each asset was maintained and calibrated to schedule by competent people, that its regulatory classification is known, and that safety notices and recalls were actioned and closed; and that the gap between a list and that evidence base is where regulatory liability now sits. The equipment did not change. What the operator must be able to demonstrate about it did.
The audience for this analysis is operators, biomedical leads, and quality leads of UAE clinics, hospitals, and diagnostic centres who maintain an asset register that has served them adequately until now and who are absorbing what a regulatory move means for that arrangement. The useful diagnostic question is not "do we have an asset register" but "for any device, could we produce, on request, the defensible evidence that it was maintained, calibrated, operated by competent people, and cleared of any recall, as one chain rather than an assembly".
Register Says, Regulation Requires
Below is a comparison, by asset category, of what a typical register holds against what the operator now has to be able to prove, with the gap between them named. The point is not that any register is uniquely deficient; it is that the inventory model and the evidence model are different things, and the regulatory shift is a move from one to the other. Select an asset category to see what the register says, what regulation now requires you to prove, and where the gap sits.
What the register holds versus what the operator now has to prove
Select an asset category to see the two sides and the gap between them
Why a Regulatory Move Changes the Register's Job
The reason a change of regulating body is more than an administrative handover is that the register's job changes with it. Medical-equipment regulation moved from MOHAP to the Emirates Drug Establishment in late 2025, consolidating oversight of the field. A consolidated regulator with a defined remit tends to expect a defined evidence shape: not merely that equipment exists and is serviced, but that the operator can demonstrate, in a defensible and traceable form, the maintenance, calibration, competency, classification, and safety-notice handling for each asset. A list that records existence cannot answer a demonstration request; the question it was built for and the question now being asked are different questions.
The scale of the equipment estate makes the operational stakes concrete. Dubai recorded 5,372 licensed health facilities in 2024, a base that includes a large population of clinical devices across hospitals, polyclinics, diagnostic centres, and specialist settings. Each device carries maintenance, calibration, competency, and classification obligations, and in a multi-site group those obligations are replicated across sites with their own local record-keeping habits. At that scale, the difference between a list and an evidence base is the difference between an operator that can answer a regulator on request and one that has to mount an evidence-reconstruction exercise per site under time pressure.
The regulatory split itself has to be navigated, not assumed away. A consolidated equipment regulator does not absorb every adjacent obligation; clinical operation, facility licensing, and information governance remain with their own authorities. An operator that treats "equipment regulation moved" as a single simple change can misread where a given device or activity now sits. The register has to be able to carry the regulatory classification and the responsible regime per asset, because the operator, not the software, has to know which obligations apply to which device, and the system has to make that knowable rather than obscure it.
The shift in one observation
An inventory answers "what do we have and where is it". A regulatory evidence base answers "prove, for this device, that it was maintained and calibrated to schedule by competent people, that you know its classification, and that every safety notice was closed". The equipment did not change when regulation moved to the Emirates Drug Establishment. The question the operator must be able to answer about it did, and the register was built for the first question, not the second.
Where the Inventory Model Breaks
The inventory-register model breaks in four predictable places once the question becomes proof rather than presence.
Maintenance history that is not evidence
A contract reference is not proof that planned maintenance and calibration were performed to schedule by competent people. When the actual evidence lives with a contractor, in an engineer's notes, or in a local log, the operator cannot produce a defensible record on request. A reference to a service arrangement is not the same as evidence the service happened as required.
Competency that is not linked
Regulation increasingly expects that the people maintaining and operating a device were competent to do so. If competency records exist separately from the asset record, the operator cannot show the link between this device, this maintenance event, and this competent person. An unlinked competency file does not answer the question that is actually asked.
Recalls and safety notices not closed in the record
A field safety notice or recall is only handled when it is actioned and closed against the specific affected devices, with evidence. A register that does not track notice-to-device-to-closure leaves the operator unable to prove a recall was dealt with, which is one of the sharpest questions a consolidated regulator can ask.
Classification and regime not carried per asset
When the register does not hold the regulatory classification and responsible regime per device, the operator cannot reliably say which obligations apply to which asset after a regulatory split. The list looks complete while quietly omitting the field that determines what compliance even means for that device.
The Numbers
Two Ways to Hold the Asset Record
The difference between operators who can answer a consolidated regulator on request and those who cannot is whether the asset record is an inventory or an evidence base.
| Dimension | Inventory register | Regulatory evidence base |
|---|---|---|
| Maintenance | A contract reference. Evidence held by whoever did the work. | Schedule-adherence evidence by competent persons, linked to the device. |
| Competency | A separate file, if it exists. Not linked to the asset or the event. | Competency linked to the device and the specific maintenance or operation. |
| Recalls | Notices handled informally. Closure not provable per device. | Notice-to-device-to-closure tracked with evidence. |
| Classification | Not carried. Responsible regime ambiguous after a split. | Classification and responsible regime held per asset. |
| On request | An evidence-reconstruction exercise under time pressure. | One traceable chain produced on request. |
A change of regulator is not an administrative handover from the operator's point of view. It is a change in the question the asset record must answer, from what do we have to prove what was done to it. The operators who absorb it without exposure are the ones whose register was already an evidence base, because a list, however accurate, was never built to prove anything.
What a Regulatory Evidence Base Looks Like
The pattern in operators who can answer a consolidated regulator without a scramble is recognisable. Maintenance and calibration are recorded as schedule-adherence evidence, attributable to competent persons, linked to the specific device rather than to a contract. Competency is linked to the device and the event, so the chain from device to maintenance to competent person exists rather than being asserted. Safety notices and recalls are tracked from notice to affected device to closure, with evidence at each step. The regulatory classification and responsible regime are carried per asset, so the operator can say which obligations apply to which device after a split. And the history is retained through decommissioning and transfer, because the obligation does not end when the asset leaves the operational list.
This does not necessarily mean replacing whatever asset or maintenance system is already in place. In many operations the evidence base can be built around the existing system, provided it can hold the linked evidence and the classification per asset. Replacement becomes the better option mainly where the existing system structurally cannot link competency and evidence to the device, or cannot retain history through decommissioning. Which applies is specific to the systems in place and the device estate, and is established in scoping before any build commitment.
How This Sits Alongside the Operator's Own Responsibilities
The configuration keeps a clear separation. The healthcare operator owns and operates the equipment, holds the relationships with the regulator and with maintenance providers, makes every classification, clinical, and competency determination, and is responsible for its own compliance with the applicable equipment regulation. The software is the instrumentation: the linked evidence, the recall-closure tracking, the classification per asset, and the retained history.
This is the role BY BANKS is positioned for. We are an independent software engineering company based in the UAE. We design and build software and hand it over to the operator who runs it. We build to the published requirements of the relevant regulation; we are not affiliated with, endorsed by, or acting on behalf of the Emirates Drug Establishment, MOHAP, or any authority, we do not classify devices or make regulatory determinations, and we do not assume the operator's compliance responsibility. The operator owns the equipment, the determinations, and its own compliance; we build the system that lets the evidence be held and produced as one chain rather than reconstructed. The accountable party leads and owns the obligations; we build to their direction.
Where This Analysis Is Useful
The conversations where this perspective is most useful tend to be at three moments: an operator absorbing the regulatory move and realising its register cannot produce defensible evidence on request; a group that has found its equipment record-keeping varies by site and cannot answer a group-level question consistently; or a biomedical or quality lead who recognises that a contract reference is not proof and that the evidence currently lives in places they do not control. The honest answer is usually the same: the equipment did not change, the question did, and a list that records existence cannot do the job an evidence base that records proof can.
For broader related work, see our perspective on the cost of running a Dubai clinic group on single-site systems and our perspective on why JAWDA quarterly reporting stops scaling on spreadsheets. The applied work sits across our medical equipment tracking software and diagnostic centre software capabilities, within the broader healthcare software practice and our operational platforms work. Get in touch if a 45-minute conversation about a specific equipment estate would be useful.
Frequently Asked Questions
No. We are an independent software engineering company based in the UAE. We build software to the published requirements of the relevant regulation, but we are not affiliated with, endorsed by, or acting on behalf of the Emirates Drug Establishment, MOHAP, or any authority, and we do not classify devices or make regulatory determinations. References to the regulatory move in our work are descriptive of publicly known frameworks. The operator remains responsible for its own equipment-regulation compliance; we build the system to their direction.
No, and it should not. Device classification and regulatory determinations are the operator's, made against the applicable rules and with qualified input where needed. What the software does is carry the classification the operator assigns per asset, hold the linked evidence, and make the responsible regime knowable, so the operator can act on its own determinations consistently. The system records and applies the operator's determinations; it does not make the regulatory judgement.
Often not. In many operations the evidence base can be built around the existing asset or maintenance system, provided that system can hold competency and maintenance evidence linked to the device and carry classification per asset. Replacement becomes the better option mainly where the existing system structurally cannot link evidence to the device or cannot retain history through decommissioning. Which applies is specific to the systems in place and is established in scoping before any build commitment.
A register passing inspection in the past reflects the questions asked then. A consolidated regulator with a defined remit tends to ask for defensible, traceable evidence rather than presence, and the gap only becomes visible when that question is asked. The argument is not that the register was wrong before; it is that the question is changing, and an inventory that satisfied the old question may not satisfy the new one. Whether your specific register does is something only your own assessment against the current requirements can establish.
It is sequenced and does not require pausing operations. The usual starting point is the highest-criticality and highest-volume device classes, where the consequence of an evidence gap is largest, linking maintenance, calibration, and competency evidence to those devices first and tracking recall closure against them. Coverage extends across the estate from there, with classification carried per asset as records are brought in. The order is driven by where the evidence gap carries the most regulatory and patient-safety consequence, which scoping establishes for the specific estate.
The move of medical-equipment regulation to the Emirates Drug Establishment is widely read as an administrative handover and is, from the operator's side, a change in the question the asset record must answer: from what do we have to prove what was done to it, by whom, and when. An inventory list cannot answer the second question however accurate it is at the first. The operators who absorb the shift without exposure are the ones whose register had already become an evidence base, with maintenance, competency, recall closure, and classification linked to each device and retained through its life. The build is software work; the equipment, the classification and regulatory determinations, and compliance with the applicable regulation remain entirely the operator's, and the system simply lets the evidence be held and produced as one chain rather than reconstructed under pressure.
References to the Emirates Drug Establishment, MOHAP, and the 2025 transfer of medical-equipment regulation are descriptive of publicly known frameworks. The facility figure cited (5,372 licensed Dubai health facilities in 2024) is drawn from public sources listed on our Sources and Data page; the category comparisons and other patterns in this article are observational generalisations rather than measured statistics, and represent no specific operator, device, or determination. BY BANKS is an independent software engineering company; we are not affiliated with, endorsed by, or acting on behalf of any authority, we do not classify devices or make regulatory determinations, and we are not a regulated healthcare entity. On any healthcare engagement, the operator owns the equipment, the classification and regulatory determinations, and responsibility for its own compliance with the applicable equipment regulation. This article is not regulatory or legal advice; operators should obtain qualified advice for their specific obligations. Public sources used in this piece are listed on our Sources and Data page.
Ready to Build Something?
If this resonated, let's talk about how we can apply these ideas to your business.
Start a Conversation