The DFSA, which regulates firms in the Dubai International Financial Centre, has so far chosen expectations over new rules. That makes the UAE one of the simpler regimes on the map, and one of the easiest to underestimate.

What the DFSA expects of firms using AI

Firms are fully accountable for their AI, and senior management must oversee it. In June 2026 the DFSA issued a “Dear SEO” letter setting out its regulatory expectations on AI risk management in the DIFC: firms remain fully accountable for their use of AI, and senior management are expected to exercise appropriate oversight and ensure AI is operated in a controlled and responsible manner.

The context is rapid adoption. The DFSA’s 2025 AI survey found generative AI use in the DIFC nearly tripling year on year, with governance maturing more slowly than uptake [1]. A letter to every SEO is a regulator’s way of saying the gap has been noticed.

No AI rulebook means what it means in London: existing obligations apply instead. Accountability sits with named senior management; “the vendor’s model got it wrong” is not a defence the DFSA has offered anyone.

DIFC Regulation 10: the rule on autonomous systems

Regulation 10 is binding DIFC law on AI that processes personal data, and it gets less attention than it deserves. Since September 2023, the DIFC’s Data Protection Regulations have included Regulation 10 on autonomous and semi-autonomous systems: the first rule of its kind in the region, requiring firms deploying AI that processes personal data to ensure it operates ethically, fairly, transparently and securely, with transparency notices and, for high-risk processing, a designated Autonomous Systems Officer. The 2025 amendments to the DP Law added a private right of action for data subjects and documented adequacy assessments for transfers, and a mid-2026 consultation proposed sharpening Regulation 10 and adding a certification-scheme regime: enactment is the watch item for the next review.

Two claims circulating widely online are, on checking, unsupported by any primary or law-firm source: that a “Dubai AI Act” took effect in March 2026, and that the UAE’s federal data-protection law finally received its executive regulations in 2026. Neither is verified; the federal picture as of September 2026 remains the PDPL awaiting its regulations, a voluntary AI charter, and, since June 2026, a new Federal Authority for Artificial Intelligence and Data consolidating the AI Office and expected to take ownership of exactly that unfinished business.

How your client base changes the rules

Where your clients live usually matters more than where you are licensed. For advisory firms headquartered in the DIFC with clients in Europe and Asia (a common shape among international advisers), the detailed content of governance will usually be set by the stricter regimes their client base drags in:

  • EU-resident clients bring GDPR (processing client data in AI tools needs a lawful basis, processor agreements, and a lawful transfer mechanism if data leaves the EEA) and, since August 2026, the EU AI Act’s live transparency obligations for AI-generated content.
  • Cross-border marketing attaches promotion rules where material is received, not where it was generated; one AI-drafted commentary can engage several regimes at once.
  • US-hosted AI vendors pull in transfer rules and the vendor due diligence every serious regulator now spells out.

What a DIFC firm should do now

Run the core set of controls from the overview (inventory, named owner, human review, vendor due diligence, records) and set the bar to the strictest regime your clients bring. A baseline built to EU standards, with substantiation for any AI claims in marketing, satisfies the DFSA’s accountability expectations almost by construction; the reverse is not true. The full argument, with the one-page jurisdiction matrix, is in AI governance for cross-border financial advisers.

This article is for informational purposes only and does not constitute regulated financial advice, legal advice, or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.

Sources

[1] Dubai Financial Services Authority, ‘New DFSA AI survey: Generative AI adoption has nearly tripled within the DIFC in last 12 months as governance continues to develop’, 2025. Available at: https://www.dfsa.ae/news/new-dfsa-ai-survey-generative-ai-adoption-has-nearly-tripled-within-difc-last-12-months-governance-continues-develop