Knowledge

Reg 10 and security answers for ASOs

Find the answer, then send it to your CISO, IT or legal team. Every guide names its clause and review date.

Check your readiness, free

41 articles

Security review pack

6 articles in one link: keeping a tamper-evident audit trail, where your ai data is allowed to sit, what sits in the uae north data plane, what an accredited certification body sees in the share room, the principles behind how the platform is built and is the knowledge base legal advice?.

Filters

Who it is for
Topic
Kind

Regulation 10 explained

Does Regulation 10 apply to your AI system?

Regulation 10 covers a wider range of AI and automated systems than most firms assume, which means more obligations.

Reg 10 §10.2.1. Full reference: DIFC Reg 10 §10.2.1; High Risk Processing Activities, Schedule 1, Article 3 of the DPLReviewed 18 Sep 20262 min read

Is the knowledge base legal advice?

No - it's guidance to help produce audit-ready evidence; confirm your specific obligations with counsel.

Editorial policy. Full reference: n/a, editorial policyReviewed 18 Sep 20261 min read

Is the free assessment a Regulation 10 certification?

No. It is guidance to help you produce audit-ready evidence for assessment, not a Regulation 10 certification, and not legal advice.

Reg 10.3.3. Full reference: Reg 10.3.3 (Accredited Certification Body certification)Reviewed 18 Sep 20261 min read

Four things Reg 10 gives you that most AI rules do not

Outcomes over methods, a real certification path, one accountable officer, and work that carries over to other frameworks.

Reg 10.3.3(d). Full reference: Reg 10.3.3(d) (single accountable officer); DIFC Accredited Certification Body framework; interoperability with ISO/IEC 42001, the EU AI Act and the NIST AI RMFReviewed 18 Sep 20261 min read

Clause and scheme reference

What counts as High-Risk Processing

Systematic evaluation, profiling or decisions with legal or similarly significant effects, which trigger stronger controls.

Reg 10 §10.2.2. Full reference: DIFC Reg 10 §10.2.2; High Risk Processing Activities, Schedule 1, Article 3(c) of the DPL (systematic evaluation, profiling, decisions with legal or similarly significant effects)Reviewed 18 Sep 20262 min read

Appointing your Autonomous Systems Officer

One named Autonomous Systems Officer must own AI risk, with the status and duties DPL Articles 17 and 18 give a DPO.

Reg 10 §10.3.3(d). Full reference: DIFC Reg 10 §10.3.3(d) (appointment of an Autonomous Systems Officer, with the competencies, status, role and task of a DPO under DPL Articles 17 and 18)Reviewed 18 Sep 20262 min read

Data Protection Impact Assessments explained

A Data Protection Impact Assessment is mandatory before High-Risk Processing and must stay current, not a one-time filing.

DPL Art 20(1). Full reference: DIFC DPL Article 20(1) (DPIA before High Risk Processing Activities); DIFC Reg 10 §10.3.3Reviewed 18 Sep 20262 min read

Telling people when AI decides about them

A notice explaining an automated decision, shown on first use, with contents Reg 10 fixes in advance.

Reg 10 §10.2.2(a). Full reference: DIFC Reg 10 §10.2.2(a) (notice on first use); §10.2.2(b) (required contents)Reviewed 18 Sep 20262 min read

Keeping an AI System Register

A live inventory of every AI system you use, updated as systems change, and produced to the Commissioner on request.

Reg 10 §10.2.2(g). Full reference: DIFC Reg 10 §10.2.2(g) (register, provided on request)Reviewed 18 Sep 20262 min read

Handling a Substantial Change

A Substantial Change to an AI system must be logged in the register and, where processing changes, notified within thirty days.

Reg 10 §10.2.2(g). Full reference: DIFC Reg 10 §10.2.2(g) (register kept current); DIFC Data Protection Regulations §3.2.1(c) (changed processing, thirty days)Reviewed 18 Sep 20263 min read

Screening for prohibited AI uses

AI uses the EU cross-walk treats as prohibited outright, which you must screen for even though Reg 10 lists none itself.

EU AI Act Art 5. Full reference: EU AI Act Art 5 (reached through the DIFC cross-walk; Regulation 10 has no prohibited-use list)Reviewed 18 Sep 20262 min read

Keeping a tamper-evident audit trail

A sealed, tamper-evident record of AI decisions, kept so they can be inspected long after they are made.

Reg 10 §10.3.3. Full reference: DIFC Reg 10 §10.3.3 (record-keeping); DIFC DPL Art 47 (inspection)Reviewed 18 Sep 20262 min read

How DIFC compares to other AI-governance regimes

A working comparison, not a legal opinion, of how DIFC's regulator, instrument and residency posture line up against four peer regimes.

DPL 2020, Reg 10. Full reference: DIFC DPL 2020 and Regulation 10, compared against EU GDPR/AI Act, UK GDPR, Singapore PDPA, and US federal guidanceReviewed 18 Sep 20262 min read

How Accredited Certification Bodies differ from the Accelerator

The Accredited Certification Body scheme and the Accelerator sandbox are different instruments, and entering the Accelerator needs no certification at all.

Reg 10.3.3. Full reference: DIFC Reg 10.3.3 (Accredited Certification Body certification); DIFC Reg 10 Accelerator Framework, Part 1 and section 2Reviewed 18 Sep 20262 min read

How the platform works

What an Accredited Certification Body sees in the share room

A plain what-this-is line, then the register by system, per-row open and download, the full sha256, and offline seal verification.

Product documentation. Full reference: n/a, product documentationReviewed 18 Sep 20261 min read

What each demo module actually walks through

What each of the five module walkthroughs actually runs, step by step, before it reaches the output the interactive demo shows.

Product documentation. Full reference: n/a, product documentationReviewed 18 Sep 20262 min read

What Modules 2.1 and 2.2 actually build

Both Bespoke-criteria modules run as deterministic TypeScript engines with no external Python dependency, shipped in v2.4.

Accelerator, section 2. Full reference: DIFC Reg 10 Accelerator Framework section 2 (Bespoke criteria); EU AI Act Annex III; DPL Article 9; ISO/IEC 27001; NIST AI RMF; MITRE ATLASReviewed 18 Sep 20262 min read

How an audit-readiness review actually runs, step by step

Register the system, run a guided module, approve and lock it, watch readiness move, build the evidence pack, then mint a share link.

Product documentation. Full reference: n/a, product documentationReviewed 18 Sep 20261 min read

The principles behind how the platform is built

Four rules every build decision is tested against - evidence over assertion, sovereign by default, human in the loop, interoperability over lock-in.

Product documentation. Full reference: n/a, product documentationReviewed 18 Sep 20262 min read

What each Regulation10 module actually does

What each of the eight core Regulation10 modules is for and exactly what it produces, clause by clause.

Product documentation. Full reference: n/a, product documentationReviewed 18 Sep 20262 min read

Billing, invoices, and changing your plan

Billing lives on the Billing page, which only the workspace Owner can see.

billing. Full reference: Product guidance, billingReviewed 29 Sep 20263 min read

Onboarding and choosing your subscription tier

To onboard, create your account, verify your email, then complete the onboarding wizard: name your organisation, set your residency region, and flow takes a

onboarding. Full reference: Product guidance, onboardingReviewed 29 Sep 20263 min read

Running a compliance module and getting a report

To run a compliance module, open a registered AI system, pick a module from the module list, and start a run.

modules. Full reference: Product guidance, modulesReviewed 29 Sep 20263 min read

Managing team members and in-app roles

To manage your team, open Team (or Members) in settings.

team. Full reference: Product guidance, teamReviewed 29 Sep 20263 min read

Two-factor authentication and account security

To set up two-factor authentication (2FA), go to Account, then Security, and enrol an authenticator app.

account. Full reference: Product guidance, accountReviewed 29 Sep 20263 min read

Data, hosting and security

Where your AI data is allowed to sit

AI data should stay in the DIFC or an adequate jurisdiction; elsewhere needs SCCs and a transfer impact assessment.

DPL Art 24. Full reference: DIFC DPL Art 24 (international transfers); DIFC Adequacy ListReviewed 18 Sep 20262 min read

Data residency within the UAE

Customer data at rest is stored in Azure UAE North; some processing runs outside the UAE, and this page says exactly which.

Articles 26 to 28. Full reference: DIFC Data Protection Law No. 5 of 2020, Articles 26 to 28 (transfer)Reviewed 29 Sep 20264 min read

Trust and evidence, what we can actually show you

What regulation10.ae can evidence, and the difference between a readiness crosswalk and a certification.

Regulation 10. Full reference: DIFC Regulation 10 of the DIFC Data Protection RegulationsReviewed 29 Sep 20263 min read

What sits in the UAE North data plane

UAE-resident storage, a sealed and tamper-evident audit trail, and DIFC SCCs plus a Transfer Impact Assessment for cross-border access.

DPL Art 24. Full reference: DIFC DPL Art 24 (international transfers)Reviewed 18 Sep 20261 min read

Where Exec X AI Ltd is registered

Exec X AI Ltd, DIFC licence 10474, registered at the Dubai International Financial Centre, Dubai, UAE.

Corporate registration. Full reference: n/a, corporate registrationReviewed 18 Sep 20261 min read

How this website itself handles your data

This marketing site collects no regulated personal data; operational product data lives only inside the authenticated platform, hosted in UAE North.

Site operations. Full reference: n/a, site operationsReviewed 18 Sep 20261 min read

Commercial and programmes

How Regulation10 pricing tiers work

Moving tiers changes reach (systems, seats, the runtime gateway); it never changes the DPIA, notice or seal quality you get.

Commercial documentation. Full reference: n/a, commercial documentationReviewed 18 Sep 20261 min read

Add-on services available on any tier

Managed audit, ASO-as-a-service, a premium AI tier and a red-team sprint are all available on any tier, quoted per engagement.

Commercial documentation. Full reference: n/a, commercial documentationReviewed 18 Sep 20261 min read

Pricing questions, answered honestly

Covers why prices aren't shown yet, per-tenant billing, currency, what an implementation involves, and buying help.

Commercial documentation. Full reference: n/a, commercial documentationReviewed 18 Sep 20261 min read

Glossary

Who the DIFC Commissioner is

The DIFC's data protection regulator, who inspects, reviews classifications and notifications, and receives register requests.

DPL, Reg 10. Full reference: DIFC Data Protection Law (DPL); DIFC Regulation 10Reviewed 18 Sep 20261 min read

Guidance, not certification or legal advice. Is the knowledge base legal advice?

Still missing an answer? Ask the ASO.

Check your readiness, freeTalk to the ASO
Reg 10 Knowledge Base, regulation10.ae