ASO appointment · DIFC Reg 10 §10.3.3(d) (appointment of an Autonomous Systems Officer, with the competencies, status, role and task of a DPO under DPL Articles 17 and 18)
Reviewed 18 Sep 2026
Regulation 10 says you must appoint one accountable person to oversee your AI. This person is the Autonomous Systems Officer (ASO).
The ASO is a single, named individual. They are not a committee and not a job title shared across a team. Their role is to hold the line on AI risk and to make clear decisions when it matters.
The ASO has real power. They can approve High-Risk Processing before it goes live. They can also suspend it if something goes wrong. With that power comes duty: the ASO must understand the systems, the risks, and the regulation.
The appointment must be documented. That means a signed appointment letter that names the person, sets out their duties, and gives them the authority to act. A verbal nod is not enough.
Without a clear ASO, no one truly owns AI risk. Decisions slip through gaps and accountability blurs.
The DIFC Commissioner will look for a named ASO and a signed appointment during an inspection. If you cannot show one, you have a basic compliance gap. If a system harms someone and no one had the authority to stop it, that failure of oversight can support a private right of action in the DIFC Courts. A documented ASO shows you took accountability seriously.
regulation10.ae gives you an appointment-letter template aligned to the ASO duties, and a place to store the signed copy as evidence for assessment. It links the ASO to each system in your AI System Register, so approvals and suspensions leave a clear trail. Your accountability is documented, not assumed.
Check your readiness with the free readiness assessment, or see our plans.
AI-assisted. Answers are generated from the published knowledge base and are not legal advice.