DIFC opens consultation on three-tier AI governance framework

The Dubai International Financial Centre has opened a consultation on a three-tier AI governance framework that would recognise certification standards from the European Union, ISO and Singapore. The draft AI Adequacy Protocol sets out which external frameworks DIFC-regulated entities may rely on when deploying AI systems within the centre's jurisdiction. The consultation document proposes a recognition structure that would allow entities holding valid certification under specified international standards to demonstrate compliance with DIFC requirements.

Three-tier recognition structure#

The protocol proposes three tiers of adequacy. Tier one would recognise compliance with the EU AI Act as meeting DIFC requirements for high-risk AI systems. Tier two would accept ISO/IEC 42001 certification for AI management systems. Tier three would recognise Singapore's Model AI Governance Framework and accompanying implementation guide for entities demonstrating conformity with that standard. Each tier addresses a different aspect of AI governance, with the EU framework focused on risk classification, the ISO standard on management systems, and the Singapore framework on governance practices.

Compliance pathway for regulated entities#

Entities holding valid certification under any recognised tier would be deemed to meet corresponding DIFC AI governance obligations without duplicative assessment. The protocol specifies that certification must be current, issued by an accredited body, and cover the AI system's deployment scope within DIFC. The draft sets out documentation requirements for entities seeking to rely on external certification, including evidence that the certifying body holds accreditation from a recognised national or international accreditation authority. Entities must maintain records demonstrating that the scope of their certification matches the AI systems they deploy within the centre.

Scope and application conditions#

The protocol applies to AI systems deployed by DIFC-regulated financial services firms, data processors and ancillary service providers operating within the centre. It does not apply to AI systems used solely for internal administrative functions with no customer-facing or decision-making role. Entities relying on recognised certification must maintain documentation demonstrating the system's conformity with the standard claimed and make that documentation available to DIFC upon request. The consultation document states that the adequacy determination applies only to AI governance requirements and does not affect other regulatory obligations under DIFC law.