The DFSA, regulating firms in the Dubai International Financial Centre, has so far chosen expectations over new rules — which makes the UAE one of the more navigable regimes on the map, and also one of the easiest to underestimate.

The DFSA’s position: full accountability

In June 2026 the DFSA issued a “Dear SEO” letter setting out its regulatory expectations on AI risk management in the DIFC: firms remain fully accountable for their use of AI, and senior management are expected to exercise appropriate oversight and ensure AI is operated in a controlled and responsible manner.

The context is rapid adoption. The DFSA’s 2025 AI survey found generative AI use in the DIFC nearly tripling year on year, with governance maturing more slowly than uptake [1]. A letter to every SEO is a regulator’s way of saying the gap has been noticed.

“No bespoke rulebook” therefore means what it means in London: not the absence of obligations, but the application of existing ones. Accountability sits with named senior management; “the vendor’s model got it wrong” is not a defence the DFSA has offered anyone.

The real complexity: your client base

For advisory firms headquartered in the DIFC with clients in Europe and Asia — a common shape among international advisers — the detailed content of governance will usually be set by the stricter regimes their client base drags in:

  • EU-resident clients bring GDPR (processing client data in AI tools needs a lawful basis, processor agreements, and a lawful transfer mechanism if data leaves the EEA) and, from August 2026, the EU AI Act’s transparency obligations for AI-generated content.
  • Cross-border marketing attaches promotion rules where material is received, not where it was generated — one AI-drafted commentary can engage several regimes at once.
  • US-hosted AI vendors pull in transfer rules and the vendor due diligence every serious regulator now spells out.

What this means in practice

Run the converged core from the overview — inventory, named owner, human review, vendor due diligence, records — and set the bar to the strictest regime your clients bring. A baseline built to EU standards, with substantiation for any AI claims in marketing, satisfies the DFSA’s accountability expectations almost by construction; the reverse is not true. The full argument, with the one-page jurisdiction matrix, is in AI governance for cross-border financial advisers.

This article is for informational purposes only and does not constitute regulated financial advice, legal advice, or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.

Sources

[1] Dubai Financial Services Authority, ‘New DFSA AI survey: Generative AI adoption has nearly tripled within the DIFC in last 12 months as governance continues to develop’, 2025. Available at: https://www.dfsa.ae/news/new-dfsa-ai-survey-generative-ai-adoption-has-nearly-tripled-within-difc-last-12-months-governance-continues-develop