Dubai International Financial Centre (DIFC) has opened a public consultation on a proposed AI Adequacy Protocol for systems that process personal data.
If adopted, the framework would classify AI systems into Standard, Enhanced and Critical tiers, based on data volume, decision impact, autonomy and data sensitivity. Systems scoring below 6 would be Standard, those scoring 6 to 9 Enhanced, and those scoring 10 or higher Critical. AI systems making legally significant automated decisions would automatically fall into the Critical category.
Standard systems would be able to self-declare before assessment by an accredited certification body, with certification lasting three years. Enhanced and Critical systems would require an Autonomous Systems Officer, while Critical systems would also face quarterly monitoring and board-level oversight at larger organisations.
The draft proposes allowing companies with credentials such as EU CE marking, ISO 42001 or Singapore AI Verify to seek reciprocity mapping with DIFC rules. Any follow-up assessment would focus on DIFC-specific requirements.
The protocol also sets responsibilities for AI providers, operators and deployers, with deployers carrying ultimate accountability. Additional requirements could apply in sectors including financial services, healthcare and human resources.
The consultation follows DIFC Regulation 10, which governs personal data processing by autonomous and semi-autonomous systems. The DIFC said the consultation is intended to gather industry feedback before the proposed framework is finalised.
Source: Middle East AI News
