Notifying a Substantial Change

What the rule is

A Substantial Change is a meaningful change to an in-scope AI system. It is the kind of change that could affect risk to people or how the system behaves.

Examples include retraining a model on new data, changing what a system decides, or adding a new use. A small bug fix usually is not a Substantial Change. A shift in purpose or risk usually is.

When a Substantial Change happens, you must notify the DIFC Commissioner within 14 days. The notification must follow a documented process and include the required content, such as what changed, why, and the impact on risk.

The process needs a named owner. One person should be responsible for spotting changes, judging whether they are substantial, and filing the notice on time. Without an owner, the 14-day clock is easy to miss.

Why it matters

The 14-day window is short. A late or missing notification is a clear, dated breach that is easy for an inspector to spot.

The DIFC Commissioner relies on these notices to keep an accurate view of the AI in the centre. If you change a high-risk system and stay silent, you break that trust. Where the change harms people and you failed to notify, that gap can support a private right of action in the DIFC Courts. A tidy notification process protects you on both fronts.

How to comply

1. Define what counts as a Substantial Change for your systems.
2. Name one owner for spotting and reporting changes.
3. Assess each change against the definition, with the ASO involved.
4. File the notice to the DIFC Commissioner within 14 days.
5. Update the AI System Register and DPIA to match.

How regulation10.ae helps

regulation10.ae helps you define Substantial Change, assign an owner, and track the 14-day deadline so notices go out on time. Each notification is captured as evidence for assessment and linked to the system it affects. You get a documented, repeatable process instead of a scramble.

Test your process with the free readiness assessment, or see our plans.