Most AI regulation discussions in the Gulf focus on the federal UAE Personal Data Protection Law, which I cover in UAE PDPL and AI architecture. Firms in the Dubai International Financial Centre operate under their own data protection regime, and since 2023 that regime has included a regulation written specifically for AI and other autonomous systems.
This is an architect's reading, not legal advice. Confirm the current text and its application with DIFC counsel.
What Regulation 10 covers
Regulation 10 sets a framework for processing personal data through autonomous and semi-autonomous systems, and supplements the DIFC Data Protection Law12. Its definition of a system is broad: a machine-based system operating autonomously or semi-autonomously that processes personal data for human-defined purposes, or for purposes it defines within human-set parameters, and generates outputs3. Chatbots, scoring models, document-processing agents and recommendation engines can all fall within it.
Rather than regulating AI content directly, it sets boundaries for the organisations that deploy and operate these systems when personal data is involved3.
The key concepts
| Concept | What commentary describes | Architecture implication |
|---|---|---|
| Deployer | The party under whose authority the system runs or who benefits from its output; treated as the controller3 | Accountability sits with the business using the AI, even when a vendor built it |
| Design principles | Systems should be designed to be ethical, fair, transparent, secure and accountable3 | You need evidence of how each principle is met, not just a policy |
| High-risk processing | Commercial use restricted to cases meeting audit and certification requirements, human-defined or human-approved purposes, and an appointed Autonomous Systems Officer13 | Purpose controls and human oversight must be enforced in the system, not only documented |
| Notices and certifications | Misleading notices or misstatements about certifications may trigger enforcement3 | What you tell users about the AI must match what the system actually does |
What is still moving
Two things are worth watching. First, commentary in January 2026 described the certification requirements for high-risk processing as expected in future guidance3. Second, in June 2026 the DIFC issued Consultation Paper No. 3 of 2026, proposing amendments to the Data Protection Regulations, including updates to Regulation 10 on embedding safety into systems and clarifications on certification and the Autonomous Systems Officer role4.
Don't wait for the final certification scheme. The engineering it will almost certainly rely on (purpose limits, oversight, logging, evidence) takes months to build and is useful regardless of the final wording.
How I design for it
- A register of systems and purposes. Every AI system that touches personal data, its Deployer, its human-approved purposes and its data sources. This becomes the Autonomous Systems Officer's working tool.
- Purpose enforcement in code. An AI gateway that ties each call to a registered purpose and blocks uses outside it, building on the gateway pattern in securing MCP servers.
- Human approval for consequential actions, with the approval recorded, especially where outputs affect individuals.
- Traceability by default. Inputs, retrieved context, model versions and outputs logged with metadata, as in LLM observability, so any decision can be explained.
- Fairness and quality evaluation before release and on a schedule, with the results kept as evidence.
- Accurate notices generated from the register, so what users are told stays in step with what systems actually do.
Firms operating across the DIFC, onshore UAE and the EU can build one control set to cover all three, mapping it to Regulation 10, the UAE PDPL and the EU AI Act rather than running three programmes.
How I can help
I design AI platforms for financial services and other regulated firms in the UAE, with governance built into the architecture. See my UAE practice, or analyse your challenge and bring the result to a call.
- 1DIFC enacts landmark regulation for autonomous and semi-autonomous systemsClyde & Co · Sep 2023
- 2
- 3AI regulation in the DIFC: personal data processed through autonomous and semi-autonomous systemsMayer Brown · 19 Jan 2026
- 4Regulatory update June 2026: ME regionWaystone Compliance · Jun 2026