Jurisdiction

Regulation 10 is one of the few AI rules with a certification path

It sets outcomes rather than methods, and it lines up with the EU AI Act, the UK ICO framework and ISO/IEC 42001.

See how the platform maps to Reg 10 Talk to the ASO

DIFC by the numbers

The regulator is named, and so are the bodies that certify.

Both figures below are sourced, and each carries the date it was read. We have removed two market-size estimates that were not: a page about a regulation is the wrong place for a number we cannot attribute.

3

DIFC Accredited Certification Bodies

Named on the Commissioner's Regulation 10 page as at 26 September 2026: Eversheds Sutherland, Middle East Privacy, White Label Consultancy.

2020

The framework Reg 10 sits in

Regulation 10 was introduced under the DIFC Data Protection Law 2020 framework.

Why it is worth doing properly

Four things Reg 10 gives you that most AI rules do not

Read what each point means in practice in Four things Reg 10 gives you that most AI rules do not.

Residency

Where your data sits, stated exactly

Reg 10 does not require UAE residency. We do it anyway. Every DPIA, notice, audit trail, evidence pack and register entry sits at rest in Azure UAE North.

Inference is a separate question. The judgement deployment is provisioned in UAE North, but its Azure OpenAI deployment type is documented as processable in any Azure region. So we tell you where the deployment sits and claim nothing about where a given request runs. Access from outside the UAE runs under DIFC Standard Contractual Clauses, with a Transfer Impact Assessment on file.

UAE NorthPrimary regulated data plane

All Reg 10 regulated data is pinned to UAE-resident storage, with cross-border access only under DIFC SCCs and a Transfer Impact Assessment. What sits in the UAE North data plane

Adequacy peers

DIFC is the only regime here with a working certification path.

Placed under more than one regime? See the full five-jurisdiction comparison against the EU, UK, Singapore and US. How DIFC compares to other AI-governance regimes

Stand up Reg 10 evidence in a sovereign jurisdiction

Start a Reg 10 assessment