AI Regulation Tracker  /  Supervisory report

Dubai's DFSA will inspect how auditors use AI in 2026, its 9th Audit Monitoring Report says

The financial regulator for the DIFC has named AI use in audit an examinable area for its 2026 inspection cycle, and auditors will have to show their work.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 11, 2026  ·  Last updated July 11, 2026

What did the DFSA actually say?

On 9 July 2026 the Dubai Financial Services Authority released its 9th Audit Monitoring Report, titled "Setting the Standard in Audit Quality within Dubai International Financial Centre." The report gathers what the regulator found on its monitoring visits to Registered Auditors in the DIFC between 1 January 2024 and 31 December 2025. Across that period the DFSA ran 26 inspections and looked at 93 engagement files. More of those engagements were rated satisfactory than in earlier cycles, and fewer came back unsatisfactory.

Buried in the forward look is the line that matters for anyone relying on a DIFC audit. The DFSA said its 2026 inspection programme will cover three areas: Systems of Quality Management, revenue recognition, and the use of artificial intelligence in audit. A thematic review on governance and culture is planned for 2026-27.

This is not a new binding rule. Registered Auditors already carry quality management obligations under the DFSA Rulebook. What changed is supervisory attention. AI in audit has moved from something a regulator might ask about to something it has told the profession, in writing, that it will examine.

Why has AI become an inspection focus now?

The DFSA pointed to its own data. Its AI Survey 2025 found that 52% of DIFC firms were using AI, up from 33% the year before. When adoption jumps that fast inside a single supervised population, a regulator either watches or falls behind.

The concern is straightforward. Audit is a judgment profession built on evidence, documentation, and a clear chain of human responsibility. Drop a generative model into that workflow and questions follow. Who checked the output? Was the tool fit for the task? Does the engagement file still show a human reasoning through the conclusion, or does it show a machine's answer copied forward? The DFSA is signalling that it wants to see those answers on the file, not hear them described after the fact.

Chief Executive Mark Steward framed the regulator's stance as "firm but fair, collaborative but uncompromising on high quality." Read against the AI focus, that is a warning wrapped in a courtesy. The DFSA is willing to work with auditors on how they adopt these tools. It is not willing to accept undocumented adoption as an excuse.

Who is on the hook, and why should a US firm care?

DIFC Registered Auditors include the Dubai member firms of the Big Four and other international networks. Many of those networks are US-parented or run significant US operations, and the audit methodologies, technology platforms, and AI tools deployed in Dubai often come straight from the global firm. A US-based company with a DIFC subsidiary, or a US investor relying on DIFC-audited financials, is now depending on an auditor whose regulator treats AI in the audit as an examinable area.

There is a second-order effect too. When an inspector probes how an auditor used AI, the questions do not stop at the audit firm. An auditor testing a client's revenue recognition may lean on the client's own AI-driven systems for evidence. That pulls the audited firm's AI governance into view. A DIFC company that cannot explain how its automated processes work may find its auditor asking harder questions this cycle than last.

What will inspectors expect to see?

The report frames the expectation around four verbs: selection, review, governance, and supervision. In practice, an inspection team is likely to want:

• A record of which AI tools were used on the engagement, and why each was judged appropriate for the task.
• Evidence that a qualified human reviewed and challenged the AI output before it became audit evidence.
• Proof that AI use sits inside the firm's Systems of Quality Management, not outside it as an informal shortcut.
• A clear line of supervision showing who was accountable for the tool's role in the conclusion.

None of this asks auditors to stop using AI. It asks them to treat an AI tool the way they already treat a junior associate or an external expert: chosen for a reason, reviewed by someone senior, and documented so a third party can follow the logic. The firms that will struggle are the ones where AI crept into the workflow through individual initiative and never made it into the methodology.

What does this signal beyond Dubai?

Financial-audit supervisors around the world are circling the same question, and few have committed to a concrete answer. The DFSA has now put one on paper. It did not ban the tools, and it did not defer the question. It set a supervisory priority and attached an inspection cycle to it. That makes the 9th Audit Monitoring Report an early, usable template for how an audit regulator operationalises AI oversight. A partner in New York or London watching for where this is heading has a live example in Dubai, and a short runway before the same expectations land closer to home.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.