Appointing your Autonomous Systems Officer

What the rule is

Regulation 10 says you must appoint one accountable person to oversee your AI. This person is the Autonomous Systems Officer (ASO).

The ASO is a single, named individual. They are not a committee and not a job title shared across a team. Their role is to hold the line on AI risk and to make clear decisions when it matters.

The ASO has real power. They can approve High-Risk Processing before it goes live. They can also suspend it if something goes wrong. With that power comes duty: the ASO must understand the systems, the risks, and the regulation.

The appointment must be documented. That means a signed appointment letter that names the person, sets out their duties, and gives them the authority to act. A verbal nod is not enough.

Why it matters

Without a clear ASO, no one truly owns AI risk. Decisions slip through gaps and accountability blurs.

The DIFC Commissioner will look for a named ASO and a signed appointment during an inspection. If you cannot show one, you have a basic compliance gap. If a system harms someone and no one had the authority to stop it, that failure of oversight can support a private right of action in the DIFC Courts. A documented ASO shows you took accountability seriously.

How to comply

1. Choose one person with the seniority and knowledge to act.
2. Write an appointment letter that names them and lists their duties.
3. Give them clear power to approve and suspend High-Risk Processing.
4. Have both the person and the business sign and date the letter.
5. Store the signed letter where you can produce it on request.

How regulation10.ae helps

regulation10.ae gives you an appointment-letter template aligned to the ASO duties, and a place to store the signed copy as evidence for assessment. It links the ASO to each system in your AI System Register, so approvals and suspensions leave a clear trail. Your accountability is documented, not assumed.

Check your readiness with the free readiness assessment, or see our plans.