Dubai International Financial Centre Data Protection Regulations, Regulation 10 ("Personal data processed through autonomous and semi-autonomous systems")

• Authority: Government of the United Arab Emirates
• Jurisdiction: Other countries
• Collections: Miscellaneous documents
• Most recent activity: Enacted
• Most recent activity date: 2023-09-01

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Compromise of privacy
• AI system security vulnerabilities
• Loss of human agency and autonomy
• Governance failure
• AI pursuing its own goals
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• Overreliance and unsafe use

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on privacy compromise (2.1), AI system security (2.2), unfair discrimination (1.1), lack of transparency (7.4), lack of robustness (7.3), and governance failure (6.5). Coverage is concentrated in privacy/security, discrimination prevention, and AI system safety domains.

Sector coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Finance & Insurance
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This regulation applies broadly to all sectors operating within the Dubai International Financial Centre (DIFC) jurisdiction that deploy AI systems processing personal data. While the DIFC is primarily a financial services hub, the regulation is sector-agnostic and governs AI use across all industries present in the DIFC, with explicit reference to financial services regulatory frameworks.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding regulation with mandatory obligations, enforcement mechanisms, and legal penalties. It uses mandatory language throughout ('must', 'shall') and establishes clear compliance requirements with oversight by the Commissioner.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The regulation is issued by the Government of the United Arab Emirates through the Dubai International Financial Centre authority, with the Commissioner having authority to establish additional requirements.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The regulation explicitly defines and targets three categories of entities: Providers (who develop AI systems), Deployers (who operate systems for their benefit), and Operators (who operate systems on behalf of Deployers). All entities using AI systems to process personal data are subject to these obligations.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Commissioner has explicit enforcement authority including establishing audit and certification requirements, receiving evidence and complaints, and requiring compliance with the regulation.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Commissioner monitors compliance through audit and certification requirements and evidence requests. For high-risk processing, entities must appoint an Autonomous Systems Officer with similar competencies to a Data Protection Officer to provide internal monitoring.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on deployment and operation/monitoring. It addresses design principles, validation requirements, deployment obligations, and ongoing monitoring. The regulation applies to AI systems processing personal data, with specific requirements for high-risk processing activities.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly covers AI systems and autonomous/semi-autonomous systems that process personal data. It does not use terminology like 'AI models', 'frontier AI', 'general purpose AI', or 'foundation models'. The focus is on systems capable of autonomous or semi-autonomous operation regardless of their technical architecture. No compute thresholds or distinctions between open-weight and closed models are mentioned.