DIFC Regulation 10 — Dubai's First Binding Rules on Personal Data Processed by Autonomous and AI Systems

Regulation 10 of the DIFC Data Protection Regulations governs personal data processed through autonomous and semi-autonomous systems, including AI, generative AI and machine learning. It was first proposed in April 2023, put to a 30-day public consultation, and took effect on 7 September 2023. The DIFC described it as the first such regulation in the Middle East, Africa and South Asia region.
Deployers and operators must give users notice about the processing technology, whether the system can define its own purposes, and the impact on data-subject rights. Systems must meet audit and certification requirements once the Commissioner sets them, and high-risk processing requires an Autonomous Systems Officer with status and tasks similar to a Data Protection Officer. The Commissioner may investigate misleading notices or misstatements about certification.
DIFC said it planned regulatory-sandbox testing with developers, users, regulators and NGOs. Detailed certification guidance was expected in 2026.
Caveat: this is a regulatory instrument with a small free-zone scope. No published evaluation, enforcement statistics or penalty amounts were found, so effectiveness is unproven.

Read the full analysis: https://www.mayerbrown.com/en/insights/publications/2026/01/ai-regulation-in-the-difc-personal-data-processed-through-autonomous-and-semi-autonomous-systems