AI Regulation Tracker / Public consultation

DIFC Proposes Regulation 11 and Tighter AI Rules in Data Protection Overhaul

Regulatory summary: The Dubai International Financial Centre published Consultation Paper No. 3 of 2026 on June 18, 2026, proposing amendments to its Data Protection Regulations: a refined Regulation 10 for autonomous systems, a new Regulation 11 letting the Commissioner recognize certification schemes, and clarified ASO duties. Comments close July 18, 2026.

The Gulf's first purpose-built AI-data regime moves to add a certification-recognition power and sharpen its autonomous-systems safety duties.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

DIFC Proposes Regulation 11 and Tighter AI Rules in Data Protection Overhaul regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The DIFC Commissioner of Data Protection proposes to refine Regulation 10 (safe, ethical, privacy-by-design duties for autonomous systems), add a new Regulation 11 giving the Commissioner power to recognize accreditation and certification schemes, and clarify Autonomous Systems Officer certification requirements. Nothing is in force yet.
DIFC-registered financial and non-financial firms, general counsel and DIFC-based legal teams, Data Protection Officers, newly named Autonomous Systems Officers, fintech and AI compliance leads, and vendors offering AI governance certification
Status: Consultation open.
Read the full Consultation Paper No. 3 of 2026 and submit comments to the Commissioner of Data Protection by July 18, 2026.

Regulatory Briefing

Bindingness: Draft consultation (proposed amendment to DIFC regulations)
Scope: DIFC-registered entities processing personal data; controllers and processors deploying autonomous systems; Autonomous Systems Officers and their certification duties
What Changed: The DIFC Commissioner of Data Protection proposes to refine Regulation 10 (safe, ethical, privacy-by-design duties for autonomous systems), add a new Regulation 11 giving the Commissioner power to recognize accreditation and certification schemes, and clarify Autonomous Systems Officer certification requirements. Nothing is in force yet.
Who This Affects: DIFC-registered financial and non-financial firms, general counsel and DIFC-based legal teams, Data Protection Officers, newly named Autonomous Systems Officers, fintech and AI compliance leads, and vendors offering AI governance certification
Current Status: Consultation open; comment deadline July 18, 2026
Effective Date: Not yet in force (draft)
Primary Source: https://www.difc.com/whats-on/news/difc-consultation-amended-data-protection-regulations
Secondary Analysis: DIFC's 2023 introduction of Regulation 10 and the Autonomous Systems Officer role was widely reported as the first dedicated autonomous-systems data-protection regime in the region; this consultation extends that framework. Confirm any firm-specific reading against the full Consultation Paper No. 3 of 2026.
Workflow Impact: DIFC entities should map current autonomous-system processing against the proposed Regulation 10 language, identify whether an ASO is designated and certified, and assess which external certification schemes might be recognized under a new Regulation 11.
Operational Next Step: Read the full Consultation Paper No. 3 of 2026 and submit comments to the Commissioner of Data Protection by July 18, 2026.
Last Verified: July 9, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	United Arab Emirates	The DIFC Commissioner of Data Protection proposes to refine Regulation 10 (safe, ethical, privacy-by-design duties for autonomous systems), add a new Regulation 11 giving the Commissioner power to recognize accreditation and certification schemes, and clarify Autonomous Systems Officer certification requirements. Nothing is in force yet.	DIFC-registered financial and non-financial firms, general counsel and DIFC-based legal teams, Data Protection Officers, newly named Autonomous Systems Officers, fintech and AI compliance leads, and vendors offering AI governance certification	Consultation open; comment deadline July 18, 2026

Frequently Asked Questions

Is Consultation Paper No. 3 of 2026 now law in the DIFC?

No. It is a draft consultation published June 18, 2026, with comments open until July 18, 2026. Current DIFC Data Protection Law and Regulations remain in force unchanged until any amendment is finalized and enacted.

Does this apply to companies under UAE federal law or in the ADGM?

No. The DIFC is a separate financial free zone with its own data-protection regime. These proposed amendments apply to DIFC-registered entities, not to firms governed by UAE federal data protection law or by the Abu Dhabi Global Market.

What is the difference between the ASO and the DPO?

The Data Protection Officer oversees general data-protection compliance. The Autonomous Systems Officer is the DIFC's dedicated accountability role for autonomous and AI systems processing personal data. The consultation proposes to clarify the ASO's certification requirements and role.

What would a new Regulation 11 actually let the Commissioner do?

It would give the Commissioner formal power to recognize accreditation and certification frameworks tied to data protection governance. It creates the recognition mechanism; it does not yet publish a list of approved schemes.

What is the single most important next step?

Read the full Consultation Paper No. 3 of 2026 and submit comments to the DIFC Commissioner of Data Protection by July 18, 2026, focusing on the refined Regulation 10, the new Regulation 11, and ASO certification duties.