DIFC Opens Consultation on Three-Tier Certification Regime for AI Systems
The draft AI Adequacy Protocol would sort systems that process personal data into Standard, Enhanced and Critical tiers, and let companies count EU, ISO and Singapore credentials towards DIFC certification, deepening the financial centre's role as rule-setter for deployed AI in the region.
The Dubai International Financial Centre has opened a public consultation on a draft AI Adequacy Protocol that would impose a three-tier certification regime on artificial intelligence systems that process personal data inside the financial centre. The protocol was drawn up by the Regulation 10 Advisory Committee's sub-group on AI Adequacy, and builds on DIFC Regulation 10, which governs how autonomous and semi-autonomous systems process data and has been enforced in full since January 2026, as well as on the centre's Data Protection Law of 2020.
Under the draft framework, each system would be scored from one to three on four factors: data volume, decision impact, autonomy and data sensitivity. A total below six would classify a system as Standard, six to nine as Enhanced, and ten or above as Critical, with any system making legally significant automated decisions automatically falling into the top tier. Standard systems would self-declare and then be assessed by an accredited certification body, leading to a three-year certification, while operators of Enhanced and Critical systems would be required to appoint an Autonomous Systems Officer. Critical systems would also carry quarterly monitoring metrics and board-level oversight at larger organisations.
The protocol proposes reciprocity for companies already holding credentials such as the EU CE marking, ISO 42001 or Singapore's AI Verify, allowing an accredited certification body to map existing certification against DIFC rules and assess only the centre-specific elements. The DIFC Commissioner would maintain an equivalence registry covering the EU, the UK, Singapore and selected US states. Deployers would bear ultimate accountability for the actions of their systems, and enforcement would run through five levels, from guidance for minor documentation faults to revocation, penalties and prosecution referral, with appeals heard first by an independent panel and ultimately by the DIFC Courts. A Regulation 10 Accelerator is planned to test the new approaches over six, 12 or 18-month cycles.
Email Edition
Receive The Emirates Intelligencer by email
Subscribe for the daily AI investment bulletin when the latest issue is published.