DIFC Regulation 10 Explained: AI Compliance for Autonomous Systems
Last updated: 23 October 2026
- DIFC has had a binding rule on AI and personal data since September 2023: Regulation 10 of the DIFC Data Protection Regulations.
- It applies only when an AI system processes personal data. A firm that buys an AI tool and uses it with its clients is the deployer and carries the controller’s obligations.
- When a person first uses the system, the deployer must explain its purposes, output, design principles, safeguards and certifications. A generic line about AI in a privacy notice is not enough.
- High-risk processing requires certification under the Commissioner’s requirements and an Autonomous Systems Officer (ASO).
- Since 15 July 2025, individuals can claim compensation directly before the DIFC Courts.
While most countries are still debating how to regulate AI, the Dubai International Financial Centre (DIFC) has had a binding rule since September 2023. When DIFC adopted it, it called it the first enacted regulation in the Middle East, Africa and South Asia on personal data processed through autonomous and semi-autonomous systems, such as AI. Yet many DIFC firms that use chatbots, screening tools or AI assistants have never read it. The reason is simple: it is not a separate “AI law”. It is Regulation 10, tucked inside the DIFC Data Protection Regulations.
What Regulation 10 covers
Regulation 10 sits in the DIFC Data Protection Regulations, made under the DIFC Data Protection Law (DIFC Law No. 5 of 2020). Because it is a data protection rule, it applies only when an AI system processes personal data. A model that forecasts market prices from anonymous data falls outside it. A chatbot that talks to clients, a tool that screens CVs or a system that checks onboarding files falls squarely inside.
The definition of a “System” is deliberately broad: any machine-based system operating in an autonomous or semi-autonomous manner that processes personal data for purposes defined by humans or by the system itself, and produces an output. Regulation 10 then assigns three roles. The provider develops the system. The deployer is the person under whose authority the system runs or who benefits from it. The operator runs or supervises the system on the deployer’s behalf. Most importantly, the deployer is treated as the controller and the operator as the processor.
In practice, this means that a DIFC firm that buys an AI tool from a vendor and uses it with its clients is the deployer. It carries the controller’s obligations even if it has never seen a line of the vendor’s code.
What you must tell people
The most concrete part of Regulation 10 is the notice. When a person first uses or accesses the system, the deployer must explain, in clear and explicit terms:
- the purposes defined by humans, and the principles and limits within which the system operates;
- what output the system produces;
- the design principles and the safeguards built into the system;
- the codes, certifications or principles on which the system is designed or developed.
A generic line such as “we may use AI to improve our services” does not meet this standard. The same provision goes further than an ordinary privacy notice. It requires evidence of compliance with audit and certification requirements, which any affected person may request, a risk and impact assessment for situations where processing could be unfair or discriminatory, and a register of the system’s use cases, legal bases, third parties and locations. The register must also say whether the system is used solely to make automated decisions. For most firms, this register is the biggest gap: AI tools are adopted team by team, and nobody keeps a single list.
How the system must be built
Regulation 10 sets five design principles: the system must be ethical, fair, transparent, secure and accountable. It must also be able to process personal data only for purposes that humans have defined or approved. The second requirement is the more practical one. A system that decides on its own what to do with personal data does not comply, however good its other safeguards are.
High-risk processing: certification and an Autonomous Systems Officer
The real dividing line is high-risk processing, as defined in the DIFC Data Protection Law. A system may be used for it only if four conditions are met together: the Commissioner of Data Protection has set audit and certification requirements, the system complies with them, it processes data only for human-defined or human-approved purposes, and the deployer or operator has appointed an Autonomous Systems Officer (ASO). According to the Commissioner’s guidance, the ASO will initially perform a role similar to that of a data protection officer.
The certification scheme is no longer theoretical. The Commissioner runs a certification portal, has accredited certification bodies and offers an online assessment tool. Certification is valid for up to three years. The portal fee is USD 100 for DIFC entities and USD 200 for others, and the fees of certification bodies are capped at USD 5,000. There is no fixed deadline: the framework leaves the timeline to the Commissioner.1
One detail is worth knowing. The framework describes certification as a precondition for using such systems commercially, while the Data Protection Law itself says that certification schemes are voluntary. In our reading, certification is mandatory for high-risk processing and strongly advisable for other systems, because it is the easiest way to produce the evidence that Regulation 10 asks for.
Why the stakes went up in 2025
Since 15 July 2025, individuals can bring claims for compensation directly before the DIFC Courts, including for distress, in addition to the Commissioner’s own enforcement powers. A firm whose AI tool treats a client unfairly now faces not only a regulator but also the client.
What is changing
In June 2026, DIFC consulted on amendments to the Regulations. The draft adds “safety” as a sixth design principle, sets out detailed duties and skills for the ASO and introduces a new Regulation 11 that would allow the Commissioner to recognise other certification frameworks. As of October 2026, these amendments are still a draft, but they show where supervision is heading.
What we recommend
- List every tool that uses AI and personal data, including tools bought from vendors, and decide for each whether you are the provider, deployer or operator.
- Rewrite your notices so that they cover every item that Regulation 10 lists.
- Start the register of use cases now. It is required anyway, and it is the first document a certification body or the Commissioner will ask for.
- If any use may count as high-risk processing, appoint an ASO and plan certification before you launch it.
The bottom line
Regulation 10 does not ban AI. It asks DIFC firms to explain how their AI uses personal data and to be able to prove it. Firms that have the register, the notices and the assessments in place will find certification a formality; those that do not will find it a project. AMLzone can help you map your AI systems, update your notices and prepare for certification.
Sources
1. DIFC, “DIFC Enacts Amended Data Protection Regulations”, 7 September 2023. https://www.difc.com/whats-on/news/difc-enacts-amended-data-protection-regulations
2. DIFC Data Protection Regulations (Consolidated Version No. 2), Regulation 10, made under the DIFC Data Protection Law, DIFC Law No. 5 of 2020. https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-regulation.pdf
3. DIFC Data Protection Regulations, Regulations 10.1.1 and 10.3.4. https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-regulation.pdf
4. DIFC Data Protection Regulations, Regulation 10.2.2(a)–(b). https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-regulation.pdf
5. DIFC Data Protection Regulations, Regulation 10.2.2(c)–(h). https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-regulation.pdf
6. DIFC Data Protection Regulations, Regulations 10.3.1 and 10.3.2. https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-regulation.pdf
7. DIFC Data Protection Regulations, Regulation 10.3.3. https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-regulation.pdf
8. DIFC Commissioner of Data Protection, Guidance on Regulation 10 (DIFC-DP-GL-23 Rev.03), 27 August 2024. https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/guidance-and-handbooks/lawful-processing/dp_regulation_10.pdf
9. DIFC Commissioner of Data Protection, Regulation 10 page and Regulation 10 Certification Guidance (DIFC-DPC-GL-31 Rev.01), August 2026. https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10
10. DIFC Commissioner of Data Protection, Regulation 10 Accreditation and Certification Framework; DIFC Data Protection Law, Art. 50(1). https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/regulation-10/difc-reg-10-accreditation-and-certification-framework.pdf
11. DIFC Commissioner of Data Protection, Regulation 10 Accreditation and Certification Framework; DIFC Data Protection Law, Art. 50(1). https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/registrars-and-commissioners/regulation-10/difc-reg-10-accreditation-and-certification-framework.pdf
12. DIFC, “DIFC Announces Enactment of Amendments to Select DIFC Legislation”, July 2025; DIFC Data Protection Law, Art. 64A. https://www.difc.com/whats-on/news/difc-announces-enactment-of-amendments-to-select-difc-legislation-through-difc-law-amendment-law
13. DIFC, Consultation Paper No. 3 of 2026 on proposed amendments to the Data Protection Regulations, 18 June 2026. https://www.difc.com/whats-on/news/difc-consultation-amended-data-protection-regulations
26.10.2026
