DIFC Regulation 10 vs EU AI Act: Key Differences

DIFC Regulation 10 and the EU AI Act both govern high-risk AI systems, but they are built on different legal foundations and use different compliance mechanisms. Regulation 10 sits inside data protection law and applies to any AI system that processes personal data, with compliance demonstrated through certification by a DIFC-accredited body. The EU AI Act is standalone product-safety legislation organised by risk tier and sector, with compliance demonstrated through conformity assessments and CE marking. Regulation 10 has been in full enforcement since January 2026. EU AI Act obligations for high-risk standalone systems apply from 2 August 2026, with certain standards-dependent requirements deferred under the Digital Omnibus to as late as December 2027.

The two frameworks start from different premises.

Regulation 10 asks: does this AI system process personal data in the DIFC, and if so, how must it be governed? The trigger is data processing. The obligations sit inside the DIFC Data Protection Law and extend the data protection framework to cover AI-specific risks such as automated decision-making, bias, and lack of human oversight.

The EU AI Act asks: what risk does this AI system pose to health, safety, or fundamental rights, and does that risk meet the threshold for a named category? The trigger is risk classification by sector and use case. The obligations are product-safety requirements that apply to providers and deployers regardless of whether personal data is involved.

A firm using a credit scoring model in the DIFC must satisfy Regulation 10 because the model processes personal data. The same firm deploying the same model in the EU must satisfy the EU AI Act because credit scoring is listed as a high-risk use case in Annex III. The compliance tasks are different in each case, even though the system is the same.

This is the most practically significant difference for compliance teams.

Regulation 10 uses a criteria-based definition tied to data protection risk. A system is in High Risk Processing territory if it meets any one of four conditions: it uses new technology that materially increases risk to data subject rights; it processes a considerable volume of sensitive personal data; it makes automated decisions with legal or similarly significant effects on individuals; or it processes special categories of personal data at material volume. Any novel AI system processing large amounts of financial or identity data can qualify, even if it does not appear in any prescribed list.

The EU AI Act uses a prescriptive list. Annex III sets out the categories of high-risk AI systems: biometric identification, critical infrastructure, education, employment, access to essential services (including credit scoring), law enforcement, migration management, and administration of justice. A system is high-risk if it falls into one of these categories. If it does not appear on the list, it is not classified as high-risk under the Act, regardless of what data it processes.

The practical consequence is that Regulation 10's definition is broader. A system that is not high-risk under the EU AI Act can still constitute High Risk Processing under Regulation 10 if it meets the data-risk criteria. Firms should not assume that a system falling outside Annex III is outside Regulation 10's enhanced obligations.

Under Regulation 10, compliance for high-risk systems requires certification by an Accredited Certification Body approved by the DIFC Commissioner. The firm must apply to the ACB, have its system assessed against the Certification Program Requirements set out in Part 2 of the Accreditation and Certification Framework, and obtain a certificate before operating the system commercially. As of June 2026, White Label Consultancy is the only external body approved to carry out this certification. Certification is valid for up to three years.

Under the EU AI Act, compliance for high-risk systems is demonstrated through a conformity assessment. For most Annex III systems, providers can carry out a self-assessment against harmonised standards, where those standards exist, and affix CE marking. Third-party conformity assessment bodies are required only for certain categories, including biometric identification systems and remote biometric categorisation. The AI Act also requires registration in the EU database of high-risk AI systems before the system is placed on the market.

The certification requirement under Regulation 10 is, in practical terms, more demanding than the conformity assessment under the EU AI Act for most system types. Regulation 10 requires an independent third-party assessment regardless of system type. The EU AI Act allows self-assessment for a broader range of high-risk systems.

Regulation 10 is the earlier enforcement reality for DIFC-licensed firms. A firm that has been focused on EU AI Act preparation and has not addressed Regulation 10 is already behind.

Regulation 10 assigns obligations to Deployers and Operators. A Deployer is the organisation under whose authority or for whose benefit the system runs. An Operator is a provider that operates or supervises a system on a Deployer's behalf. Both carry obligations, and both can be held accountable. The concepts were introduced specifically because the traditional controller/processor distinction breaks down when neither party is, strictly speaking, in control of an autonomous system.

The EU AI Act assigns the primary obligations to Providers, the organisations that develop or place AI systems on the market, and Deployers, organisations that use AI systems in a professional context. Providers carry heavier obligations including technical documentation, conformity assessment, and post-market monitoring. Deployers must ensure human oversight, maintain logs, and inform data subjects of interactions with AI systems in certain contexts.

The EU AI Act's provider/deployer split means that off-the-shelf AI systems come with obligations that the vendor has already addressed. Under Regulation 10, the Deployer remains responsible for certification of the system it operates regardless of whether the system was built in-house or procured from a third party. Procurement due diligence requirements are different under each framework.

Regulation 10 fines are specific and per-violation: USD 50,000 for failure to complete a DPIA before high-risk processing, USD 50,000 for certain Article 28 data-sharing failures, and USD 25,000 for failure to complete the annual DPO assessment. The Commissioner can also issue decision notices, remedial directions, and investigate unfair or deceptive privacy practices. Data subjects have had a direct right of action in the DIFC Courts since 15 July 2025.

The EU AI Act fines are percentage-of-revenue based. Breaches related to prohibited AI practices carry fines of up to EUR 35 million or 7% of global annual turnover, whichever is higher. Breaches of high-risk system obligations carry fines up to EUR 15 million or 3% of turnover. Providing incorrect information to authorities carries fines up to EUR 7.5 million or 1% of turnover. Enforcement is carried out by national market surveillance authorities, coordinated by the EU AI Office.

For most DIFC-licensed financial institutions, the absolute fine amounts under Regulation 10 are smaller than the potential EU AI Act exposure. The litigation risk under Regulation 10 from the private right of action is harder to cap, since claims in the DIFC Courts are not subject to a fixed ceiling.

A DIFC-licensed firm that also deploys AI systems affecting EU users faces both frameworks simultaneously. The obligations do not directly conflict, but they do not fully overlap either.

Areas of overlap that a single compliance programme can cover:

• DPIA requirements (both frameworks require impact assessments for high-risk systems)
• Human oversight obligations (both require documented controls for human intervention)
• Transparency to data subjects about automated processing
• Record-keeping and audit trail requirements

Areas where separate action is needed:

• Certification under Regulation 10 is distinct from conformity assessment under the EU AI Act. Completing one does not satisfy the other.
• Registration in the EU AI Act database has no Regulation 10 equivalent.
• The ASO appointment is a Regulation 10 requirement with no EU AI Act equivalent.
• Post-market monitoring obligations under the EU AI Act go beyond Regulation 10's ongoing audit trail requirements.

The most efficient approach for dual-regulated firms is to build a single AI governance programme that satisfies both frameworks' DPIA, transparency, and human oversight requirements, then manage certification and conformity assessment as parallel workstreams for each jurisdiction.

Regulation 10's criteria-based definition of High Risk Processing captures systems that the EU AI Act's Annex III list does not. A firm that has mapped its AI systems against the EU AI Act's high-risk categories and concluded that certain systems fall outside scope has not completed the Regulation 10 analysis. The two assessments must be done separately. For DIFC-licensed firms, the Regulation 10 assessment should come first, since it is already being enforced.

Magpie generates the audit trails, DPIA documentation, and observability records required under both Regulation 10 and the EU AI Act, from a single self-hosted platform. Request a demo.