The short version
Dubai International Financial Centre has opened a public consultation on a draft AI Adequacy Protocol that would create three risk tiers for AI systems handling personal data. The protocol would allow firms to reuse certifications from the EU, UK, Singapore or certain US states, lowering compliance costs.
What happened
Middle East AI News reports that the DIFC has begun an informal public consultation on its AI Adequacy Protocol, a draft framework that would place AI systems handling personal data into three risk tiers.
The draft scores systems on data volume, decision impact, autonomy and data sensitivity, assigning them to Standard, Enhanced or Critical categories.
Companies with existing EU CE markings, ISO 42001 or Singapore AI Verify certifications could request reciprocity mapping so that only DIFC‑specific gaps need assessment.
The consultation runs for 30 days and ends on 18 July 2026, as reported by Gulf News.
The background
DIFC Regulation 10, introduced on 1 September 2023, governs how autonomous and semi‑autonomous AI systems process personal data.
Enforcement of those rules began in January 2026, making DIFC one of the first jurisdictions with data‑protection rules written specifically for AI.
The new protocol builds on Regulation 10 and the 2020 DIFC Data Protection Law, aiming for interoperability with international AI laws.
What it means for owners and operators
Owners can expect lower compliance costs if their AI tools already hold recognised certifications, because the protocol would accept those as partial proof of compliance.
Operators of Enhanced or Critical systems will need to appoint an Autonomous Systems Officer, a new role that ensures safety and governance of high‑risk AI.
Critical systems also face quarterly monitoring and board‑level oversight, adding governance overhead but reducing the risk of regulatory penalties.
Firms that do not process personal data with AI may not need to adopt the new framework, limiting the impact to data‑intensive sectors such as finance, healthcare and HR.
The numbers
AI use at DIFC firms is reported at 71%, a figure that has doubled since 2024.
What to do in your business tomorrow
- Audit your AI tools to see if they already hold recognised certifications and document this evidence for future compliance checks.
- Establish a quarterly review cycle for any critical AI systems to monitor performance and regulatory alignment.
- Develop a training plan for staff on the new compliance responsibilities for AI governance.
Related coverage
Sources
- middleeastainews.com: DIFC opens consultation on three-tier AI rules
- Gulf News: DIFC opens 30-day consultation on AI and data protection rule changes