Does DIFC Regulation 10 apply to a company that uses an LLM on personal data?

Usually yes. Regulation 10 covers any machine based system that operates autonomously or semi autonomously, processes personal data and generates output. DIFC guidance says purely deterministic automated systems are not Systems, while LLM based processing is.

Do I need an Autonomous Systems Officer in the DIFC?

An ASO is one of four conditions for using a System for High Risk Processing Activities under Regulation 10.3.3. The other three are Commissioner audit or certification requirements, compliance with them, and processing only for human defined or human approved purposes. The ASO has the same or substantially similar competencies, status, role and tasks as a DPO under Articles 17 and 18 of the Law.

Can a DIFC company use an AI system for high risk processing today?

Regulation 10.3.3 allows it only where the Commissioner has established audit or certification requirements for such Systems and the System complies with them. DIFC guidance states the intent that no System be used for High Risk Processing Activities until the Commissioner has promulgated those requirements.

Has Regulation 10 changed in 2026?

DIFCA published a consultation in June 2026 that proposes changes to Regulation 10, more detail on the ASO role and a new Regulation 11 on recognised certification schemes. The consultation says the proposals are draft only and should not be acted on until they are enacted. The regulations in force remain the version in force from 1 September 2023.

DIFC Regulation 10: AI Systems, Personal Data and the Autonomous Systems Officer

DIFC Data Protection Regulation 10 sets the rules for personal data processed by autonomous and semi autonomous systems, such as AI. It is part of the DIFC Data Protection Regulations, which implement the Data Protection Law, DIFC Law No. 5 of 2020. This guide reads from the consolidated regulations in force from 1 September 2023. Proposed 2026 changes are marked as proposed.

Is my product a "System"?

Regulation 10.1 defines a System as any machine based system that operates in an autonomous or semi autonomous manner and can:

process personal data for purposes that humans define, that the system defines, or both; and
generate output from that processing.

DIFC guidance says purely deterministic automated systems are not Systems. LLM based processing is.

Regulation 10 also names three roles:

Deployer: the person under whose authority, or for whose benefit, the System runs. Where it is hosted does not matter. Under 10.3.4 the deployer is treated as a controller.
Operator: a provider that operates or supervises the System for a deployer. Under 10.3.4 the operator is treated as a processor.
Provider: the developer or the party that commercialises the System.

What you must do when a System touches personal data

Follow the Article 9 principles (10.2.1). Deployers and operators must follow the general processing principles in Article 9 of the Law. This applies to processing in a System and to processing that trains one.

Give a clear notice at first use (10.2.2(a) and (b)). When a user first uses or accesses the System, tell them about the underlying technology and any processing that humans do not start, control or direct. The notice must describe:

the human defined purposes;
the limits within which the System may set further purposes;
the output and how you use it;
the design principles and safeguards;
the codes, certifications or principles the System follows (the regulation gives the OECD, UNESCO and the NIST AI framework as examples).

Keep evidence ready (10.2.2(c) to (f)). On request, show:

compliance with any Commissioner audit or certification requirements;
the algorithms that call for human intervention when processing may be unfair or discriminatory, with a risk and impact assessment;
human intervention when a government or law enforcement body seeks access, with an assessment;
human intervention when processing could breach Regulation 9, with an assessment.

You may redact this evidence only as far as you must to protect intellectual property or to comply with law. The Commissioner can ask for the full text (10.2.2(h)).

Keep a register (10.2.2(g)). On request, give a register that lists:

use cases, with their necessity and proportionality;
how data subjects use their rights under Articles 32 to 40;
whether the System makes decisions solely by automated means;
the third parties that receive data;
the lawful basis;
the contract terms with joint controllers, processors and sub processors;
where the third parties are, and the safeguards for transfers.

Design rules for commercial use (10.3.1 and 10.3.2)

A System that may affect a data subject must be designed to be:

ethical: decisions without bias, with data lineage;
fair: equal treatment, with bias reduced;
transparent: processing that you can explain to data subjects in non technical terms, with evidence;
secure: confidentiality and protection against breaches;
accountable: governance, monitoring and audits.

No person may use, operate or offer a System for commercial use, or take the benefit of its output, unless the System:

processes personal data only for purposes that humans define or approve; and
follows these design rules and any Commissioner certification requirements.

High risk processing and the Autonomous Systems Officer (10.3.3)

A System may be used for High Risk Processing Activities only when all four conditions are true:

the Commissioner has set audit or certification requirements for such Systems;
the System complies with them;
the System processes personal data only for purposes that humans define or approve;
the deployer or operator has appointed an Autonomous Systems Officer (ASO).

The ASO has the same or substantially similar competencies, status, role and tasks as a Data Protection Officer under Articles 17 and 18 of the Law.

DIFC guidance states the intent that no System be used for High Risk Processing Activities until the Commissioner has promulgated those audit and certification requirements. If your roadmap includes high risk processing with AI, plan the ASO role and the evidence now. Do not start that processing until the requirements exist and you meet them.

Article 16 of the Law also requires a DPO where an entity performs High Risk Processing Activities on a systematic or regular basis.

Challenges to AI outcomes (10.3.5)

Data subjects may complain to challenge the outcome of processing by a System, under Parts 9 and 10 of the Law. A deployer needs a way to receive these complaints and act on them.

Proposed changes in 2026 (not in force)

In June 2026 DIFCA published a consultation paper, "Updated Data Protection Regulations". It proposes to:

add "Safety" as a base concept for System design (proposed 10.3.1(f));
refer to "policy frameworks" in place of "principles" in the notice (10.2.2(b));
set out privacy by design and default measures for AI native Systems;
give detailed ASO obligations and skills in 10.3.3, with an ASO certification to be developed separately;
add a new Regulation 11, which lets the Commissioner recognise accreditation and certification schemes by publication.

Comments closed on 18 July 2026. The paper says the proposals are draft only and should not be acted on until they are enacted. DIFC will post a notice on its website when that happens. We will update this guide when it does.

Where Dembri fits

Dembri Privacy Records checks a company's public website and the documents it shares against DIFC, ADGM and UAE PDPL rules, including Regulation 10. It drafts findings, an AI systems register and a DPIA. A named data protection professional reviews each finding before the report is final. Each review step goes into an audit log. To ask for a scan, email asif.n@dembri.com.

See all compliance guides · Read the UAE PDPL Compliance Guide

Sources

DIFC Legal Database: Data Protection Regulations
DIFC Commissioner of Data Protection: Guidance
DIFC: DIFC Enacts Amended Data Protection Regulations (7 September 2023)
DIFCA Consultation Paper, "Updated Data Protection Regulations" (June 2026)

Last verified: 18 October 2026 against the DIFC Data Protection Regulations (consolidated version in force from 1 September 2023). This guide is informational, not legal advice.