- Fixed scope
- Arabic and English
Responsible AI stopped being optional in the UAE in 2026. DIFC Regulation 10 reached its compliance date on 1 January 2026 and is now enforced, and in June the UAE created a Cabinet-level Federal Authority for Artificial Intelligence and Data. Certification, an appointed officer and a documented risk assessment all depend on one thing most organizations do not have yet: a register that says which AI systems exist.
In most companies that register is not missing so much as scattered. There are three partial lists, from procurement, from IT and from the last audit, and they disagree. We reconcile them into one register, tier each system by risk and give you the policy and evidence to stand behind it.
What is included
- Full system inventory. Every AI tool and automated decision system in use, including the ones bought on a card and never reviewed.
- Risk tiering. A tier for each system with the reasoning written down, so the classification can be defended or revised.
- AI use policy. A policy your staff can follow on which tools are allowed, with what data and with whose approval.
- Lawful basis per use. What personal data each system uses, where it came from and the basis for using it that way.
- Human approval record. Who signs off on AI-assisted decisions, captured in the system rather than only in a process document.
- Evidence pack. The documents an assessor, a certification body or a data subject request will ask for, assembled in one place.
We do not issue DIFC Regulation 10 certification. Only a DIFC-accredited certification body can. We prepare you for that assessment and build the evidence it runs on, and we do not give legal advice.
How the engagement runs
- Scope. The quotation on this site captures your size, sector and which regulations reach you.
- Discovery. Interviews and system reviews that reconcile the partial lists into one.
- Tier and document. Each system risk-tiered, mapped to its obligations and written into the register.
- Hand over. Your team runs the register and policy, with the remaining gaps ranked by exposure.
Questions
What is AI governance?
AI governance is the set of records, rules and approvals that let an organization show which AI systems it uses, what data they touch, who is accountable for them and how their risks are controlled. In practice it starts with a register of systems and a policy for using them.
Does my company need an AI policy in the UAE?
If your staff use AI tools on company or customer data, yes in practice: the PDPL already governs how personal data is processed, and DIFC entities face Regulation 10 directly. A written AI use policy is the simplest control and the first thing an assessor asks for.
Can you certify our AI system?
No. Regulation 10 certification is issued only by a DIFC-accredited certification body, and it is system-specific. We build the register and the evidence the assessment runs on.
We are not in the DIFC. Is this still relevant?
Yes. The PDPL and sector standards such as ADHICS ask for substantially the same records. Regulation 10 is simply the most prescriptive version, which makes it a sensible design target.
Go deeper: AI governance programmes on lenouar.ae