DIFC Regulation 10 on autonomous and semi-autonomous systems

What it is

Regulation 10 of the DIFC Data Protection Regulations governs personal data processed through autonomous and semi-autonomous systems. The Dubai International Financial Centre is a financial free zone in Dubai with its own data protection law, the Data Protection Law, DIFC Law No. 5 of 2020, and its own regulator, the Commissioner of Data Protection. Regulation 10 was enacted in September 2023 as part of amended regulations, and the DIFC describes it as the first enacted regulation in the Middle East, Africa and South Asia region on processing personal data through AI and similar systems.

The regulation defines a system as any machine-based system operating in an autonomous or semi-autonomous manner. The definition draws on the OECD’s work and the EU AI Act. It reaches machine learning, deep learning, neural networks, natural language processing and generative systems, and the Commissioner’s guidance notes that an avatar or virtual persona representing a real person can itself be personal data.

Regulation 10 is outcomes-based. Rather than prescribing one set of AI ethics principles, it sets a small number of mandatory design principles and lets organisations apply reasonably promulgated principles from other organisations or jurisdictions on top. The DIFC calls this a “plug and play” approach to interoperability.

Who it applies to

Regulation 10 applies to organisations subject to the DIFC Data Protection Law that develop, deploy or operate systems processing personal data. It introduces three roles.

• Deployer. The person or entity with authority or direction over a system’s operation, or that benefits from the system or its output. That holds whether or not it operates, supervises or hosts the system, and whether or not it determines the purposes of processing. A Deployer is deemed to act as a controller.
• Operator. A provider that operates or supervises a system on behalf of, and at the direction of, a Deployer. An Operator is treated as a processor.
• Provider. The person that develops a system, or has one developed, to make it available to Operators or Deployers.

The Deployer concept is the important one. An organisation using a vendor’s AI system is accountable for how that system processes personal data, even where nobody inside the organisation strictly controls the processing. The guidance compares a system acting for its Deployer to an employee acting for an employer.

What it requires

Lawful processing. Deployers and Operators must meet the DIFC Data Protection Law’s general requirements for lawful processing in substantially the same way as a controller and processor would.

Notice to users. Where a system processes personal data, the Deployer or Operator must give clear and explicit notice when a user first uses or accesses it. The notice must flag any processing that is not human initiated, controlled or directed, and explain the impact on the person’s ability to request rectification or erasure, or to object. This gives effect to Article 29(1)(h)(ix) of the Data Protection Law.

Human-defined purposes. Processing purposes are either human-defined and hard-coded, or self-defined by the system. Any purpose a system can generate for itself must stay within detailed principles set by humans and hard-coded into the system, which the system cannot change.

Design principles. Regulation 10.3.1 requires every system processing personal data to be designed to meet the principles of fairness, ethical compliance, transparency, security of operation and accountability. The guidance expects Deployers and Operators to procure systems only from developers that can give contractual comfort on these points.

Evidence on request. Regulations 10.2.2(c) to (f) set out circumstances where Deployers and Operators must produce evidence to an affected party on request. The guidance says this can be policies, governance frameworks, principles frameworks and other documentation. The Commissioner’s guidance also refers to keeping a register of AI processing activities as an accountability measure.

High risk processing and certification. A controller must assess whether a system will carry out High Risk Processing Activities, as defined in Schedule 1 of the Data Protection Law, before the system goes live. Under Regulation 10.3.3, no one may use, operate, provide or make available a system for commercial use in High Risk Processing Activities unless it meets the Commissioner’s audit and certification requirements. Those requirements are set out in the Regulation 10 Accreditation and Certification Framework. Accredited certification bodies assess the system itself, not the applicant, and certification lasts up to three years.

Autonomous Systems Officer. Deployers and Operators may need to appoint an Autonomous Systems Officer. The role initially mirrors a Data Protection Officer, covering impact assessments, review of risks and processing with senior management, and recommendations on accountability.

No misleading claims. Regulation 6.2 on unfair or deceptive practices sits beside Regulation 10. Misleading notices, or public claims about certification or adherence to principles, can draw investigation and enforcement by the Commissioner.

Key dates

• September 2023. Regulation 10 enacted in the amended DIFC Data Protection Regulations.
• 27 August 2024. Current revision of the Commissioner’s Regulation 10 guidance and FAQs.
• 18 June to 18 July 2026. Consultation on amendments that would add safety as a design expectation, clarify certification obligations, set detailed ASO obligations, and create a Regulation 11 so the Commissioner can formally recognise accreditation and certification schemes.

How it relates to other frameworks

Regulation 10 borrows its system definition from the OECD and the EU AI Act, and its Deployer concept from the AI Act and China’s generative AI measures. The Commissioner’s FAQs say the certification framework aligns with the AI Act’s provider obligations and conformity assessment criteria, though it does not replace CE marking where the AI Act applies. The FAQs also allow a short-form route where a system already holds certification under another applicable AI law.

Within the UAE, Regulation 10 is binding inside the DIFC, while the UAE Charter for the Development and Use of Artificial Intelligence sets national, non-binding principles. Because Regulation 10 lets organisations apply recognised principles, an AI management system built on ISO/IEC 42001 or the NIST AI RMF can supply much of the documentation and evidence it asks for. Its transparency and objection rights will feel familiar to anyone working under GDPR Article 22.

A note on this page

This is Aicura’s reading of Regulation 10 and the Commissioner’s published guidance. It is not legal advice and it is not the regulation itself. Read the primary sources on the DIFC Commissioner of Data Protection’s site, and take advice on how Regulation 10 applies to your organisation.