DIFC opens consultation on three-tier AI rules

Draft AI Adequacy Protocol would recognise EU, ISO and Singapore certification

Nov 10, 2026

#UAE #regulation - Dubai International Financial Centre (DIFC) has opened a public consultation to secure industry feedback on its new AI Adequacy Protocol. If adopted, the new protocol would categorise AI systems that process personal data into three risk tiers, each with its own certification rules. The draft also sets out how to compare DIFC rules with those of the EU, UK, Singapore and selected US states.

SO WHAT? - Companies building AI for several markets or regulatory juristictions face a patchwork of rules, certifications and compliance requirements. Via the new AI Adequacy Protocol, DIFC now proposes to let existing credentials from other jurisdictions count towards its own, so firms don’t need to start from scratch in each jurisdiction. The document is still a draft, and the public consultation is the chance for stakeholders to influence and change how the proposed rules are applied.

KEY POINTS:

Dubai International Financial Centre (DIFC) has opened a public consultation for its new AI Adequacy Protocol. If adopted, the proposed framework would overn developing, deploying, procuring and using AI systems that process personal data within the financial centre. The online survey takes about 10 minutes.
The draft protocol document was developed by the Regulation 10 Advisory Committee’s sub-group on AI Adequacy. The new framework builds on DIFC Regulation 10, which governs how autonomous and semi-autonomous AI systems process data, and on the DIFC Data Protection Law of 2020.
The new protocol would score systems on a scale from 1 to 3, for each of four factors: data volume, decision impact, autonomy and data sensitivity. A score below 6 is Standard, 6 to 9 is Enhanced, and 10 or more is Critical. Any system making legally significant automated decisions would also be classified as Critical.
Standard systems self-declare, then an accredited certification body assesses them, leading to a three-year certification. Under the protocol, companies running systems classified as Enhanced or Critical will need to appoint an Autonomous Systems Officer. Critical systems also require quarterly monitoring metrics, plus board-level oversight for larger organisations.
Companies that already hold an EU CE marking, ISO 42001 or Singapore AI Verify can request reciprocity mapping with DIFC regulations. The DIFC accredited certification body would identify gaps, and a streamlined assessment would then only cover the DIFC-specific elements.
Specific sectors, such as financial services, healthcare and human resources, may have special requirements added under the AI Adequacy Protocol. Examples include model risk management and fair lending analysis for finance, clinical validation for healthcare, and human review of rejections in recruitment.
The protocol also defines the duties that providers, operators and deployers need to be responsible for. Deployers bear ultimate accountability, and a deeming provision attributes system actions to them. Deployers must also keep visibility of their supply chain and hold model cards for third-party components.
The DIFC Commissioner would keep an equivalence registry covering the EU, UK, Singapore and selected US states. Assessments under the new protocol use eight criteria and rate each jurisdiction’s compatibility with DIFC rules as high, moderate or low.
Enforcement defined by the AI Adequacy Protocol runs through five levels, beginning with guidance for minor documentation faults, through to revocation, penalties and prosecution referral for harm or persistent violations. Appeals go to an independent panel first, then eventually to the DIFC Courts. A Regulation 10 Accelerator is planned to test the new approaches over 6, 12 or 18 months.

ZOOM OUT - The consultation builds on DIFC Regulation 10, which governs how personal data is processed by autonomous and semi-autonomous systems, including AI and machine learning. DIFC’s Commissioner of Data Protection enacted it on 1 September 2023 as part of updated data protection regulations. Enforcement began in full in January 2026. It is among the first data protection rules written specifically for AI and automated decision-making. DIFC says it aims to make its rules interoperable with the growing body of international AI laws. Related documents include an accreditation and certification framework and an Accelerator framework.

[Written and edited with the assistance of AI]

Source: DIFC