Handling a Substantial Change

What the rule is

A Substantial Change is a meaningful change to an in-scope AI system. It is the kind of change that could affect risk to people or how the system behaves.

Examples include retraining a model on new data, changing what a system decides, or adding a new use. A small bug fix usually is not a Substantial Change. A shift in purpose or risk usually is.

Two points are often misstated, so be precise about them.

First, Regulation 10 sets no filing deadline for a Substantial Change. It imposes no fourteen-day notification, and no notification duty of its own. Regulation 10.3.4, the provision most often cited for one, is a deeming provision: it says a Deployer is treated as a Controller and an Operator as a Processor. What Regulation 10 does require is at §10.2.2(g): a register listing your use cases, processing activities, third-party arrangements and safeguards, which you must be able to provide on request to any relevant party. A change that makes the register wrong is a change you have to work through.

Second, a separate duty can be triggered. Where the change means Personal Data is processed in a manner different to the notification you filed with the Commissioner, Regulation 3.2.1(c) of the DIFC Data Protection Regulations requires you to notify the Commissioner as soon as possible, and in any event within thirty days. That is a thirty-day clock on a changed processing notification, not a Regulation 10 AI clock.

If you are an Accredited Certification Body, a different rule applies to you: under the DIFC Accreditation and Certification Framework §7.3, an Accredited Certification Body must record substantial changes and report them to the Commissioner immediately.

Why it matters

A register that no longer describes the system it names is not a register, and it is the artefact the Commissioner can ask for. The gap is dated and easy for an inspector to see.

The notification path matters for the same reason. Where DIFC Data Protection Regulation 3.2.1(c) is triggered and you stay silent, the omission is a contravention with a date on it.

There is a private route as well. Under DPL Article 64A a Data Subject who suffers damage by reason of a contravention of the Law may apply to the DIFC Court for compensation. A documented change process is what shows the contravention did not happen.

How to comply

1. Define what counts as a Substantial Change for your systems.
2. Name one owner for spotting and assessing changes.
3. Assess each change against the definition, with the ASO involved.
4. Update the AI System Register entry and the DPIA so both describe the system as it now is.
5. Check whether the change alters the processing you notified. If it does, notify the Commissioner within thirty days under Regulation 3.2.1(c).

How regulation10.ae helps

regulation10.ae helps you define Substantial Change, assign an owner, and route a change through the register entry, the classification and the DPIA so all three stay consistent. Each change is captured as evidence for assessment and linked to the system it affects.

Test your process with the free readiness assessment, or see our plans.