regulation10.ae
Scope of application

Does Regulation 10 apply to your AI system?

DIFC Reg 10 §10.2.1; Schedule 3 (High-Risk Processing triggers)

What the rule is

DIFC Regulation 10 sets rules for how organisations build and run AI. It applies to AI systems and automated systems that process the personal data of natural persons. A natural person is a living human being, not a company.

Scope is the first question you must answer. If a system is in scope, the rest of the regulation applies to it. If it is out of scope, it does not. So getting scope right is the foundation for everything else.

A system is usually in scope when it does both of these things:

  • It uses AI or automated logic to reach an output.
  • That output involves the personal data of identifiable people.

Some in-scope systems also count as High-Risk Processing. These are systems that make or shape important decisions about people. They carry stronger duties, which are covered in a separate article.

Why it matters

If you treat an in-scope system as out of scope, you skip every control the regulation requires. The DIFC Commissioner can inspect your systems and ask for your records. Missing records during an inspection is a serious gap.

Where an individual is harmed by a system you failed to govern, they may bring a private right of action in the DIFC Courts. The wider your real scope, the more obligations you carry and the more evidence you must keep audit-ready.

How to comply

  1. List every AI or automated system in your business.
  2. For each one, write down whether it processes personal data of natural persons.
  3. Mark each in-scope system clearly and assign an owner.
  4. Flag any in-scope system that may be High-Risk Processing for deeper review.
  5. Record your scope decisions, with reasons, so you can show them later.

How regulation10.ae helps

regulation10.ae walks you through each system and applies the Schedule 3 triggers so your scope call is consistent and documented. Every decision becomes evidence for assessment, not a memory you hope to recall. You start with a clear, defensible list of what is in and what is out.

See where you stand with the free readiness assessment, or compare our plans.

Audit-ready, not certification

This guide helps you produce evidence for assessment. Regulation 10’s certification scheme is not yet live, and only an Accredited Certification Body can certify. Confirm your specific obligations with counsel.

See where you stand

The free readiness assessment scores this obligation against your answers and links every gap back to a guide like this one.

Take the free assessment← All guides