A due-diligence checklist for UAE financial institutions procuring AI — mapped to the DIFC Data Protection Regulation 10, the UAE PDPL and the ADGM Data Protection Regulations 2021. Use it in RFPs, security reviews and DPA negotiations.
DIFC Regulation 10, the UAE PDPL and ADGM DPR each treat the physical location of processing as a control question. Get the vendor to name the region, not the parent brand.
Which specific cloud region(s) will host our data at rest, and can you contractually pin processing to the UAE (e.g. AWS me-central-1, Azure UAE North, Oracle UAE Central)?
Why it matters — Marketing pages often say 'available in UAE' while the default tenant sits in EU or US regions. Pin the region in the DPA schedule.
Where will data be processed in transit — including inference, embeddings, logging, telemetry, and backups?
Why it matters — Inference traffic and vector stores are frequently routed to a US or EU region even when the primary DB is in-country.
Do you offer a UAE-only deployment tier with no fallback to out-of-region infrastructure during incidents or capacity events?
Why it matters — Disaster-recovery failover to another region is a cross-border transfer and must be disclosed.
How is data segregated between tenants — dedicated VPC, dedicated database, or logical row-level separation?
Why it matters — Financial regulators (DFSA, FSRA, CBUAE) increasingly ask for tenant isolation evidence.
Under PDPL Article 22 and DIFC DP Law 2020 Articles 26–28, every onward transfer needs a lawful basis. Sub-processors are the most common blind spot.
Provide the current sub-processor list, their location, and the personal data categories each one accesses.
Why it matters — You cannot sign a valid DPA without this list. Ask for change-notification rights (minimum 30 days).
What is the legal transfer mechanism for each out-of-UAE flow — adequacy decision, DIFC-approved SCCs, PDPL standard contract, BCRs, or explicit consent?
Why it matters — The DIFC Commissioner and UAE Data Office publish approved model clauses; generic GDPR SCCs are not automatically valid.
Do any sub-processors use our data — or derived data — to train foundation models, benchmark, or evaluate?
Why it matters — Model training on customer data is the single most common cause of failed procurement reviews in 2026.
Will you commit contractually to zero-retention on prompts, completions, and embeddings, and provide logs proving it?
Why it matters — OpenAI, Anthropic, Google and Azure OpenAI all offer zero-retention tiers — but only if you ask and configure them.
DIFC Regulation 10 requires controllers to understand how their autonomous systems were trained and how they behave over time.
What is the provenance of the training data for the base model, and how do you handle copyrighted, biometric, or special-category data?
Why it matters — The controller — not the vendor — is accountable to the regulator.
Can you provide a model card, evaluation set results, and known bias/fairness metrics per protected attribute?
Why it matters — DIFC Reg 10 §10.2 requires bias testing on 'consequential' decisions.
How often is the underlying model updated or deprecated, and what is the notice period before a behavioural change reaches production?
Why it matters — Silent model swaps break your DPIA and your explanations to customers.
Do you support model version pinning, and can we roll back to a prior version if a new one degrades on our test set?
Why it matters — Version control is a prerequisite for reproducible audits.
PDPL Article 20 and DIFC DP Law Article 14 both require 'appropriate technical and organisational measures'. Ask for specifics, not certifications alone.
Provide current ISO 27001, SOC 2 Type II, and — if applicable — ISO 42001 (AI management system) reports.
Why it matters — ISO 42001 is becoming the baseline expectation for AI vendors selling into DIFC/ADGM.
Do you support customer-managed encryption keys (CMEK/BYOK) via a UAE-based KMS, and can you demonstrate key rotation and revocation?
Why it matters — BYOK gives you a kill switch independent of the vendor.
What is your breach notification SLA in hours, and can you meet the DIFC 72-hour and PDPL 'without undue delay' timelines?
Why it matters — Contracts frequently default to 'commercially reasonable' — insufficient under UAE law.
How do you handle prompt-injection, data-exfiltration and jailbreak attacks, and can you share your red-team results from the last 12 months?
Why it matters — OWASP LLM Top 10 findings are now an expected diligence artefact.
DIFC Regulation 10 §10.5 requires meaningful human oversight and audit trails. Your vendor contract must let you exercise both.
Can we, or an independent auditor on our behalf, audit the service against contractual and regulatory obligations at least annually?
Why it matters — Regulators expect controllers to retain — not waive — audit rights.
What immutable audit logs do you retain (inputs, outputs, model version, user, timestamp), for how long, and in what export format?
Why it matters — You need these to meet DIFC record-keeping and explainability duties.
Do you provide an in-product explanation API for consequential decisions (e.g. reason codes, feature attributions)?
Why it matters — Regulation 10 requires explanations to data subjects on request.
On termination, will you return or delete all personal data — including embeddings, fine-tunes, logs and backups — within 30 days and certify deletion?
Why it matters — Cessation clauses are mandatory under DIFC DP Law and often missing in AI vendor templates.
Do you offer an escrow arrangement or on-prem fallback if the service is discontinued or your entity is acquired?
Why it matters — Business-continuity is a DFSA outsourcing rulebook requirement for regulated firms.
Contracts frequently push regulatory risk onto the controller. Push back — the vendor knows their product best.
Do you formally acknowledge processor status under PDPL, DIFC DP Law and ADGM DPR in your DPA, and accept the corresponding obligations?
Why it matters — Some vendors describe themselves as 'independent controller' to limit liability.
Will you assist us with DPIAs, data-subject requests and regulator investigations within defined SLAs, at no additional charge?
Why it matters — You are legally required to complete DPIAs and respond to DSRs — the vendor's cooperation must be contractual.
What are the liability caps and carve-outs specifically for privacy breaches, regulatory fines pass-through, and IP infringement claims from model output?
Why it matters — Default caps (12 months' fees) rarely cover a AED 5m PDPL fine or a DIFC USD 50,000-per-violation penalty.
Do you maintain cyber and professional-indemnity insurance sufficient to cover UAE regulatory exposure, and will you name us as an additional insured on request?
Why it matters — Insurance is now a standard DFSA outsourcing due-diligence line item.
This checklist is a starting point, not legal advice. Cross-reference each answer against your firm's outsourcing policy, the DFSA / FSRA outsourcing rulebooks (GEN 5.3 / COBS 6), and the current PDPL Executive Regulations before signing.