Module 2.1 Bias and FairnessShipped, v2.4
TypeScript-only fairness metrics: the four-fifths rule with standard floors.
The DIFC accelerator route
The Participant pathway, end to end.
The Reg 10 Accelerator is a Participant sandbox, not an Accredited Certification Body scheme. Regulation10 produces the evidence stack the Accelerator Testing Team expects, with sections 1 and 2 covered line by line.
Eligibility and cohort deadlineTo be confirmed
Eligibility criteria
To be confirmed with the Accelerator Testing Team
Next cohort deadline
To be announced
Participant pathway
Four steps from onboarding to Output Report.
The Accelerator Framework treats the Participant as the testee and the Accelerator Testing Team as the reviewer. There are four checkpoints between onboarding and the Output Report, and Regulation10 produces a deterministic artefact at every one of them.
Eligibility and abstractThe onboarding wizard captures entity, system, purpose and processing categories, and the public AI System Register renders the abstract. That alone clears section 1 items G1.2 and G1.5.
Design dossierFour modules generate the redactable design document set G1.3 requires: 1.1 risk classification, 1.1b the Article 5 prohibition screener, 1.2 the DPIA, and 1.3 the transparency notice in English. Every document is citation-pinned, content-hashed and regenerable.
Assessment-model declarationThe DPIA names the lens you assessed against: Open Loop, the OECD AI Principles, EU AI Act Article 27 or ISO/IEC 42001. It also carries the Bespoke-criteria pathway under G1.6.
Output reportThe Module 4.1 evidence pack plus the Module 3.3 sealed, tamper-evident audit trail compose the single signed Output Report the ATT and Commissioner expect under G1.10. Re-runnable in under ten minutes if facts change mid-window.
Coverage matrix
Section 1 governance and section 2 substantive, line by line.
Mapping of the DIFC Reg 10 Accelerator Framework requirements to the surface that satisfies each one. Source of truth: the internal coverage-verification annex dated 12 May 2026.
Section 1, governance procedures
| Ref | Requirement | Artefact that satisfies it | Verdict |
|---|---|---|---|
| G1.1 | NDA between Commissioner / Participant / ATT | Out of platform scope. This is a transactional legal document. | Not applicable |
| G1.2 | Abstract: entity, system and purpose | A five-step onboarding wizard captures the system name, workspace, purpose and processing categories. The public AI System Register renders the descriptor. | Meets |
| G1.3 | Design document (redactable for IP / restricted law) | Modules 1.1 risk classification, 1.2 DPIA and 1.3 transparency notice plus the AI System Register entry compose a complete, redactable design dossier with citation pinning and content hashes. | Exceeds |
| G1.4 | Demonstration materials | A workspace dashboard generates the DPIA and the notice in one click. It ships with a reproducible ICP smoke run and a walkthrough script that runs in under eight minutes. | Exceeds |
| G1.5 | Participant eligibility (DIFC / non-DIFC with DIFC ops / other with justification) | Separate workspaces from day one. The wizard supports all three categories and captures eligibility explicitly. | Meets |
| G1.6 | Assessment-model declaration (Open Loop / OECD / Humane Intelligence / Bespoke) | DPIA authority block names OECD AI Principles, EU AI Act Art. 27, ISO/IEC 42001; Bespoke pathway captured via the authority extension. | Meets |
| G1.7 | Acceptance criteria: use case, testing criteria, bespoke criteria | Onboarding wizard, Module 1.1 risk-classification report and DPIA together compose the acceptance dossier; the evidence-pack manifest indexes them. | Meets |
| G1.8 | Accelerator testing period (long-form up to four weeks; sprint up to one day) | Full evidence pack regenerable in under ten minutes; sprint-format compatible. | Exceeds |
| G1.9 | Accelerator Testing Team qualification (CVs, NDAs, abbreviated Accredited Certification Body criteria) | ATT-side concern, not Participant-side. Out of platform scope. | Not applicable |
| G1.10 | Output reporting and review (Report to Participant and Commissioner; permitted-third-party access) | Module 4.1 Evidence Pack ZIP plus Manifest.json plus Module 3.3 audit trail produce a single signed bundle with content-hash anchoring. | Exceeds |
| G1.11 | Auditability and monitoring (in-life monitoring to fill gaps, ad-hoc submissions) | Module 3.3 audit trail (CSV plus JSON, sealed and tamper-evident, UAE-North residency held by the deployment region pin, resolved by a runtime residency check and stamped on every audit row). Continuous drift monitoring (Module 3.1) is on the roadmap. Meets MVP today. Module 3.1 drift monitoring is gated until the first paid workspace. | Meets MVP |
| G1.12 | Enforcement / enforcement amnesty (3- and 6-month windows) | Out of platform scope. This is a Commissioner-side process. | Not applicable |
Section 2, substantive evaluation (Q1 to Q7)
| Ref | Requirement | Artefact that satisfies it | Verdict |
|---|---|---|---|
| Q1 | Evidence on request of system compliance with audit / certification requirements (Reg 10.2.2(c)) | Module 4.1 evidence pack, Module 3.3 audit trail, sealed and tamper-evident (SHA-256 content hashes), ASO appointment letter and AI System Register entry. All four are automated, hash-verifiable and regenerable in under ten minutes. | Exceeds |
| Q2 | Algorithm for human intervention where processing may be unfair / discriminatory, plus risk and impact assessment (Reg 10.2.2(d)) | The Module 1.2 DPIA human-in-the-loop section, plus the ten-row risk taxonomy covering biased output, unfair impact and loss of human review. Module 1.1 flags high-risk processing. Module 1.1b screens prohibited Article 5 categories. Quantitative bias metrics (Module 2.1) ship as a TypeScript-only engine: the four-fifths rule with standard fairness floors, and no Python or Fairlearn dependency. | Meets |
| Q3 | Algorithm for human intervention on law-enforcement access, plus risk assessment (Reg 10.2.2(e)) | DPIA §1.2 cross-border block, plus the §3 risk row 'use of data spreads beyond first purpose'. The human-in-the-loop section captures the algorithm description. The audit trail flags any law-enforcement-access event. | Meets |
| Q4 | Algorithm for human intervention on potential Regulation 9 non-compliance, plus risk assessment (Reg 10.2.2(f)) | The DPIA risk taxonomy lists data-subject-rights risks explicitly, and §2.4 is the information-rights block. The citation-required compliance agent enforces Reg 9 citations on every generated artefact. | Meets |
| Q5 | System designed for Ethical / Fair / Transparent / Secure / Accountable concepts (Reg 10.3.1) | DPIA §1 description, §3 risk, §4 mitigations and §5 FRIA overlay cover all five concepts. The Module 1.3 transparency notice addresses 'Transparent'. The banned-token list and the Article 5 screener address 'Ethical'. Sealed, tamper-evident records and SHA-256 hashing address 'Accountable', and citation pinning is a further Accountable control. | Exceeds |
| Q6 | Processing only for human-defined / approved purposes, and compliance with 10.3.1 plus audit / certification (Reg 10.3.2) | The onboarding wizard captures the purpose. Module 1.1 verifies that stated purpose against rules and citations. The Article 5 screener flags any subliminal or manipulation use case where the system defines its own purpose. The evidence pack carries audit-ready proof. | Meets |
| Q7 | ASO appointed with DPO-equivalent competencies (Articles 17 / 18 of DPL 2020; Reg 10.3.3(d)) | The ASO appointment-letter generator produces the signed-letter instrument itself, mapped to DPL Articles 17 and 18. It is not merely a written attestation. | Exceeds |
Frame
No Accredited Certification Body certification is needed to enter.
The Accredited Certification Body scheme and the Accelerator are different instruments
Bespoke-criteria readiness, v2.4, 24 May 2026
Modules 2.1 (Bias) and 2.2 (Threat Model) shipped in v2.4.
Accelerator Framework section 2 reserves the right of the Accelerator Testing Team or Commissioner to impose Bespoke criteria. Both modules shipped in v2.4, so the section 2 floor is exceeded out of the box, not built on request.
Module 2.2 Threat ModelShipped, v2.4
A deterministic engine mapping system facts to STRIDE rows.