Multi-authority complexity in a single country — and DIFC Regulation 10 is already in force.
← Back to Regulatory LandscapeThe Dubai International Financial Centre's Regulation No. 10 of 2024 (Regulation of Autonomous and Semi-Autonomous Systems) is already in force and establishes binding obligations for entities operating within the DIFC. It is one of the most specific pieces of AI regulation globally, with requirements that go beyond principles to prescribe concrete governance mechanisms.
The Abu Dhabi Global Market has taken a distinctive approach to AI governance by establishing a digital sandbox environment for controlled agentic AI experimentation in financial services. This allows institutions to test and iterate on AI governance frameworks in a supervised environment before full production deployment.
The ADGM framework complements DIFC Regulation 10 but operates under a separate regulatory authority with its own expectations, reporting requirements, and oversight mechanisms. For financial institutions operating across both free zones, this creates a dual-compliance obligation within a single country.
ADGM's approach reflects a deliberate balance between fostering innovation and managing risk — providing a structured pathway for institutions to deploy increasingly autonomous AI systems while maintaining regulatory confidence in the governance frameworks surrounding them.
The UAE's federal Personal Data Protection Law (PDPL), effective since 2022, applies to personal data processing across the country, including automated decision-making. While the DIFC and ADGM operate under their own data protection regimes, the federal PDPL establishes baseline obligations that apply to operations outside these free zones.
For financial institutions with operations spanning onshore UAE, DIFC, and ADGM, the interaction between the federal PDPL and the free zone-specific regulations creates a layered data protection landscape that must be navigated carefully, particularly where AI systems process personal data across jurisdictional boundaries within the UAE.
The UAE's national AI Strategy 2031 positions the country as a global leader in artificial intelligence across government services, economic sectors, and society. For financial institutions, the strategy signals continued investment in AI-friendly infrastructure and regulatory frameworks, but also creates multi-authority complexity:
This multi-authority landscape means that a single financial institution operating across the UAE may be subject to requirements from three or more regulatory bodies simultaneously, each with different expectations for AI governance.
For institutions expanding from Singapore to Dubai or Abu Dhabi, the additional complexity of navigating DIFC, ADGM, and federal requirements within a single country adds another dimension to the governance challenge. An institution already building for MAS AIRG compliance must layer UAE-specific requirements on top of an already complex governance architecture.
Corvair's unified governance architecture is designed precisely for this scenario: building once to the most demanding standard, then mapping outputs to each regulatory authority's expectations. The alternative — building separate compliance programmes for MAS, DIFC, ADGM, and federal UAE requirements — is neither efficient nor sustainable.
Understand the multi-authority landscape and build a governance architecture that satisfies DIFC, ADGM, and federal requirements.
Schedule a Briefing