regulation10.ae
High-Risk Processing classification

What counts as High-Risk Processing

DIFC Reg 10 §10.2.2; Schedule 3 items 1–4 (automated decision-making, profiling)

What the rule is

High-Risk Processing is a label for AI systems that make, or strongly shape, decisions about people. The decision must matter to the person affected.

Common examples include:

  • Credit scoring that decides who gets a loan.
  • Fraud detection that blocks an account.
  • Hiring tools that screen or rank job applicants.
  • Health tools that flag or triage patients.

These systems often use automated decision-making or profiling. Profiling means using data to predict things about a person, such as their behaviour or risk.

When a system fits the triggers, you must record a classification. A classification is a written decision that says "this system is High-Risk Processing, and here is why." That label then unlocks stronger controls, such as a deeper risk assessment and sign-off by your Autonomous Systems Officer (ASO).

Why it matters

A wrong call here is costly. If you classify a high-risk system as low-risk, you skip the controls that protect people from unfair or harmful outcomes.

The DIFC Commissioner can review your classifications during an inspection. Weak or missing reasoning is a clear red flag. Where a flawed decision harms someone, that person may bring a private right of action in the DIFC Courts. A solid, honest classification is your first line of defence.

How to comply

  1. Check each in-scope system against the Schedule 3 triggers.
  2. Decide if it makes or significantly influences decisions about people.
  3. Write a short classification with your reasons.
  4. Apply the stronger controls to every High-Risk Processing system.
  5. Review the classification after any Substantial Change to the system.

How regulation10.ae helps

regulation10.ae guides you through the Schedule 3 triggers and produces a written classification for each system, ready for assessment. It links that classification to your AI System Register so the label stays current. You get a consistent, evidence-backed view of where your real risk sits.

Find your high-risk systems with the free readiness assessment, or explore our plans.

Audit-ready, not certification

This guide helps you produce evidence for assessment. Regulation 10’s certification scheme is not yet live, and only an Accredited Certification Body can certify. Confirm your specific obligations with counsel.

See where you stand

The free readiness assessment scores this obligation against your answers and links every gap back to a guide like this one.

Take the free assessment← All guides