DIFC Data Protection Regulation 10 has covered AI systems that process personal data since 1 September 2023. Roles, notices, high-risk certification and the 2026 consultation.
Updated 13 Oct 2026. General information, not legal advice.
It is part of the DIFC Data Protection Regulations, in force since 1 September 2023. It governs personal data processed through autonomous and semi-autonomous systems, meaning AI.
Deployers, Operators and Providers of such systems that process personal data in the DIFC. A Deployer or Operator must give clear notice when an application or website uses a system to process personal data, and must be able to evidence it on request.
No one may use or offer a system for High Risk Processing Activities commercially unless the audit and certification requirements set by the Commissioner are met. The framework also refers to an Autonomous Systems Officer.
We could not find that date in the Regulations or the Commissioner's guidance. The obligations have applied since September 2023. The DIFC consulted on amendments from 18 June to 18 July 2026, so check the DIFC page for the final text.
Get a free Regulation 10 AI-system inventory draft for one system
Team Unadhi