DIFC Regulation 10 evidence checklist: AI notice and register

Check 1: is the tool a System?

The regulation defines a System as:

“any machine-based system operating in an autonomous or semi-autonomous manner, that can: (i) Process Personal Data for human-defined purposes or purposes that the system itself defines, or both; and (ii) generate output as a result of or on the basis of such Processing.”Regulation 10.1

For your company:

• list the tools that process personal data and produce output, such as a chatbot, a document reader or a scoring model;
• for each tool, write down who runs it and for whom.

Record your company's role for each System and the facts behind it. The linked guide explains the deployer and operator roles.

Check 2: a notice where the person first meets the System

“notice must be provided in clear and explicit terms upon the initial use of, or access to, the System, alerting users to any underlying technology and processes comprising the System that may undertake any Processing of Personal Data by the System that is not human-initiated, controlled or directed”Regulation 10.2.2(a)

Regulation 10.2.2(b) lists what the notice describes:

• the purposes set by people, and the limits within which the System may set further purposes;
• the output and how it is used;
• the design principles and safeguards;
• any codes, certifications or principles the System follows.

A privacy policy alone may not show that notice was given at first use. As evidence, show the notice where the person meets the System, such as the chat window, the upload screen or the form, and keep a dated capture of it.

Check 3: an AI systems register, ready on request

Regulation 10.2.2(g) asks the deployer to provide, on request, a register that lists:

• use cases, and why the processing is necessary and proportionate;
• how people exercise their data protection rights;
• whether the System makes decisions with no person involved;
• third parties and authorities that receive the data;
• the lawful basis;
• the contract terms with processors and sub-processors;
• where third parties are, and the safeguards for transfers.

Check 4: evidence the Commissioner can ask for

Regulation 10.2.2(c) to (f) asks the deployer to show, on request:

• compliance with any audit or certification requirements the Commissioner sets;
• human intervention where processing may be unfair or discriminatory, with a risk and impact assessment;
• human intervention where a government or law enforcement body seeks access, with an assessment;
• human intervention where processing could breach Regulation 9, with an assessment.

Regulation 10.2.2(h) allows redaction only to the minimum needed to protect intellectual property or to comply with law, and the Commissioner can ask for the full text.

Check 5: purposes set or approved by people

“No person may use, operate, provide, offer or otherwise make available for commercial use a System to Process Personal Data (or receive the benefit of, or output from, the operation of such System), unless such System: (a) is capable of Processing Personal Data only for purposes that are human-defined or human-approved”Regulation 10.3.2

Keep a record of who set or approved the purposes of each System. The System must also follow the design principles in Regulation 10.3.1: ethical, fair, transparent, secure and accountable.

High risk processing with a System has extra conditions in Regulation 10.3.3, including an Autonomous Systems Officer.

Check 6: a way to receive challenges

“Data Subjects may submit a complaint challenging the outcome of Processing of Personal Data by such Systems in accordance with Parts 9 and 10 of the Law.”Regulation 10.3.5

Keep a route for these complaints, and a record of how you handled them.

A real example

We ran Dembri Privacy Records on our own company. One finding, from our report of 23 October 2026: our privacy policy described the AI chat, but the evidence did not show the notice a person sees at first use. The proposed action was to keep a dated capture of the notice at each AI entry point. It was an open evidence point, not proof that no notice was shown.