01Who the DFSA is, and the DIFC context
The Dubai Financial Services Authority, the DFSA, is the independent regulator of financial and ancillary services conducted in or from the Dubai International Financial Centre, the DIFC. The DIFC is a financial free zone in the heart of Dubai that runs its own legal and regulatory system, built on common-law principles and served by independent courts, distinct from the civil-law framework of the wider United Arab Emirates. A firm that wants to bank, advise, trade, insure or manage assets from within the Centre is authorised and supervised by the DFSA, not by the onshore UAE regulators.
The instrument the DFSA supervises against is the DFSA Rulebook, a modular body of rules covering authorisation, governance, systems and controls, conduct of business, prudential requirements, financial crime and market conduct. Its General Module sets out the high-level Principles for Authorised Firms and the baseline expectations for management, resources, risk and outsourcing that every regulated firm carries. The DFSA’s style is internationally benchmarked and deliberately principle-based, which means it regulates outcomes and risks rather than prescribing the particular technology a firm may use.
That style matters for artificial intelligence, because AI is spreading through the Centre quickly. The DFSA’s own 2025 survey of firms in the DIFC found that a majority were already using AI, up sharply from roughly a third the year before, with the steepest growth in generative AI. The regulator has been clear that adoption at this pace has to be matched by governance, and that the accountability for getting it right stays with the firms deploying the technology, not with their vendors.
02Is there a DFSA AI compliance framework?
The honest answer is that there is no single rulebook chapter or standalone regulation named the ‘DFSA AI compliance framework’. What that phrase describes in practice is the DFSA’s existing, technology-neutral obligations read together and applied to AI, alongside the supervisory expectations the regulator has set out through its surveys, reports and international collaboration.
In one sentence: the DFSA does not govern AI with a bespoke code, it governs AI with the rules it already has, applied to a new kind of consumer of data and maker of decisions.
This distinction is worth getting right, because firms sometimes wait for a dedicated AI rulebook before treating AI as a regulated activity. The DFSA’s consistent position is the opposite. Rules on systems and controls, senior management responsibility, risk management, outsourcing and conduct were written to be technology-neutral, and they apply to AI now. A model that prices risk, screens a transaction, drafts advice or triages a claim sits inside the same accountability structure as any other process that does the same job. The technology is new. The obligation is not.
Where the DFSA adds AI-specific colour, it does so through guidance, thematic reports and dialogue rather than a new instrument. The result is a moving picture of supervisory expectation layered on top of a stable set of rules. Reading the two together is what people mean, loosely, when they talk about the DFSA AI compliance framework, and it is the accurate way to think about the obligation.
03The DFSA’s approach to AI and digital regulation
Four characteristics describe how the DFSA has approached AI to date. Together they explain why the obligation looks the way it does, and where it is likely to move.
Principle-based and technology-neutral. The DFSA regulates the risk and the outcome, not the tool. The same expectations of governance, accountability, fair conduct and operational resilience apply whether a process is run by a person, a spreadsheet or a large language model. That keeps the rulebook durable as the technology changes, and it puts the burden on the firm to show that its controls reach the new way of working.
Forward-looking and collaborative. The DFSA has positioned itself as an active participant in the international conversation on AI in finance rather than a rule-maker acting alone. It co-led cross-border work on the impact of consumer-facing AI in financial services, and it convened a regulatory college during the Dubai FinTech Summit that brought many authorities together to compare notes on AI and cyber risk. The signal is a preference for harmonised, principle-based supervision over a prescriptive local code.
Evidence-gathering through thematic work. The DFSA runs a periodic AI survey of DIFC firms and has published work exploring the regulatory implications of AI alongside cyber and quantum risk. That work has consistently flagged the same themes: explainability and interpretability, model bias, data governance, operational resilience, and dependency on opaque third-party AI vendors. Its own survey found that while most firms had some governance structure for AI, a meaningful minority still lacked clear accountability or oversight even where AI was central to the business. The regulator’s phrasing has been that innovation must be matched with integrity.
A more digital regulator. The DFSA’s digital-regulation efforts so far have focused on making the regulator itself more digital and data-driven, for example a digital platform that streamlines authorisation and approval workflows, and the adoption of AI, including agentic AI, in its own supervisory operations. It is worth being precise here: this is the modernisation of the regulator’s processes, not the conversion of the rulebook into a machine-readable form that firms compile their systems against. Firms should not expect a machine-executable AI rulebook, and should instead work from the principles and the published expectations.
04The core compliance expectations for AI
Pulling the rules and the supervisory signals together, five expectations describe what a DIFC firm is expected to demonstrate when it uses AI. Each maps to obligations the firm already carries, and each is only as real as the evidence behind it.
| Expectation | What it means for AI | What a firm should be able to evidence |
|---|---|---|
| Governance and senior accountability | AI sits inside the firm’s governance and risk framework, with board and executive oversight and a clearly identified senior individual accountable for AI-related risk. | Approved policy, AI risks recorded in the risk register, oversight in board and committee records, and a named owner rather than diffuse responsibility. |
| Transparency and explainability | The firm can understand and explain how a material AI-driven outcome was reached, to itself, to affected customers and to the regulator, and it understands the model’s limitations. | Model documentation, a recorded rationale for material decisions, and a trail that links an outcome back to the data and logic behind it. |
| Data quality and provenance | Data feeding models is accurate, relevant, lawfully obtained and appropriately governed, and the firm knows where each input came from. | Lineage from source to model, data-quality controls, and a record of the lawful basis and the permitted purpose for the data used. |
| Human oversight | Meaningful human review proportionate to the impact of the decision, with the ability to intervene or override, above all for customer-affecting or high-stakes outcomes. | Defined review checkpoints, override and escalation logs, and a documented basis for how much oversight each use case receives. |
| Technology and outsourcing risk | Where models, compute or AI capability come from third parties, the firm stays responsible for the outcome and manages concentration, resilience and exit. | Due-diligence records, contractual controls, resilience testing, and notification to the DFSA of any material outsourcing arrangement. |
None of these expectations is a new invention. They map onto the Principles for Authorised Firms, the systems-and-controls and risk-management provisions of the General Module, its outsourcing chapter, and the DFSA’s cyber-risk rules, read alongside the DIFC’s own Data Protection Law. The work for most firms is not to author something from scratch. It is to extend the frameworks they already run so that they cover AI as thoroughly as they cover a person doing the same task, and to make the coverage visible.
05Operationalising the expectations
Read closely, the five expectations are data problems wearing a governance label. You cannot evidence provenance without lineage. You cannot hold access to least privilege without enforcing it at the point of use. You cannot demonstrate oversight or explain an outcome without a record of what the model saw and did. So the practical route to meeting the DFSA’s expectations runs through data readiness and governance, and it rests on three capabilities.
- Lineage in both directions. Trace upstream into the sources that fed a model, and downstream into every output and action the model produced and where each one went. When a supervisor asks how a result was reached, or a source turns out to be wrong, the firm can follow the thread in either direction rather than reconstruct it from memory.
- Least-privilege access over the underlying data sets. Every model, copilot and agent receives the minimum access a use case genuinely requires, the default is closed, and the same rule is enforced consistently on every AI interaction rather than granted unevenly system by system. Access governed this way is what keeps entitlement real once a machine, not a person, is the consumer of the data.
- Immutable audit as a by-product of operation. Every access decision, policy check and output validation is written to a tamper-evident trail as it happens. Evidence assembled for an examination is stale the moment it is finished. Evidence produced continuously is current by construction, and it is ready before anyone asks for it.
The failure mode to avoid is governance that lives as policy but is never enforced where AI actually consumes data. A DFSA examiner tends to ask to be shown, not told. A binder of well-written policy does not answer that request. A firm that has treated these as data-readiness problems, in the way set out in our guide to data governance for AI, can answer it with records the systems produced on their own.
06Evidencing compliance with a control plane
This is the layer DataReadyAI provides. A governed control plane sits above the data platform a firm already runs, with the cloud and model providers of its choice, and it turns the three capabilities above into infrastructure rather than intention. It unifies the firm’s data into a consistent semantic layer and applies access control, lineage and audit on every interaction, so that the same governance is enforced no matter which model, copilot or agent is asking.
Unified semantic layer
Data across the estate resolved once into consistent, governed meaning, so provenance and definitions are known rather than assumed.
Least-privilege access
Access to the underlying data sets scoped tightly and inherited from existing identity controls, enforced on every AI request.
Lineage and immutable audit
Every input, decision and output recorded in both directions, producing the evidence a supervisor asks to see.
Fig. 1 · A governed control plane turns the DFSA’s expectations into enforced behaviour, with sources above and AI consumption below.
Mapped against the five expectations, the fit is direct. Governance and accountability are supported because policy is applied uniformly and centrally rather than reimplemented in each system. Transparency and explainability are supported because every interaction is recorded and traceable. Data quality and provenance are addressed by the semantic layer and its lineage. Human oversight is easier to design and prove when checkpoints and overrides are logged. Third-party and outsourcing risk is contained because the governing layer is the firm’s own, and access to the underlying data is governed with least-privilege controls regardless of which external model is called.
Two properties matter especially for firms in the DIFC. First, the platform deploys inside the firm’s own environment, on its own Databricks, Snowflake or BigQuery, so enterprise data does not leave the tenancy, which speaks directly to data residency and sovereignty concerns. Second, the path from connection to a governed, production-grade AI capability is measured in weeks rather than years, so evidence and control arrive early enough to matter. DataReadyAI is working with organisations across financial services, telecommunications and other regulated sectors to put this layer in place, and the same pattern underpins governed AI in adjacent domains such as enterprise AI in insurance.
DataReadyAI is a governed layer above the data platform a firm already runs, with the cloud and model providers of its choice. It provides one unified, consistent semantic layer with access control, lineage and audit on every interaction, deploys on the customer’s own Databricks, Snowflake or BigQuery so no enterprise data leaves the environment, and reaches production-grade AI in weeks rather than years. For the full architecture, see our guide to the enterprise AI control plane.
A closing note on scope. This article explains the DFSA’s approach and the practical way firms meet it. It is not legal advice, and it does not stand in for the DFSA Rulebook or DIFC law, both of which prevail. The regulated firm remains accountable for its own compliance, and where an AI use case is material it is worth confirming the current position with the DFSA and with qualified advisers before relying on it.
07Frequently asked questions
Is there an official DFSA AI compliance framework?
As at the time of writing there is no single rulebook chapter or standalone regulation named the DFSA AI compliance framework. The DFSA regulates AI the way it regulates other technology, through its existing technology-neutral, principle-based rules on governance, systems and controls, senior management responsibility, risk management, outsourcing and conduct, read together with the supervisory expectations it has set out through its AI surveys, reports and international work. Firms should not wait for a bespoke AI code before applying those rules to their AI use.
Which DFSA rules apply to the use of AI?
The obligations that bite most directly are the Principles for Authorised Firms and the systems-and-controls, risk-management, senior-management and outsourcing provisions of the General Module, the conduct-of-business rules where AI touches customers, and the DFSA cyber-risk rules where AI depends on ICT and third-party services. These are read alongside the DIFC Data Protection Law. None of them name AI specifically, and all of them apply to it, because they were written to be technology-neutral.
Does the DFSA require human oversight of AI decisions?
The DFSA expects governance and accountability to be maintained at every stage of AI deployment, which in practice means meaningful human oversight proportionate to the impact of the decision. For customer-affecting or high-stakes outcomes that implies defined review checkpoints, the ability to explain a result, and the ability for a person to intervene or override. The degree of oversight scales with the consequence of the decision rather than being fixed for every use case.
How does using third-party or cloud AI affect DFSA compliance?
Using a third-party model, cloud platform or vendor does not transfer responsibility away from the regulated firm. The DFSA outsourcing and third-party risk rules require due diligence, contractual control, operational resilience and a workable exit, and a material outsourcing arrangement must be notified to the DFSA. The regulator has specifically flagged concentration and dependency on opaque third-party AI vendors as a risk firms are expected to manage.
How can a firm evidence AI compliance to the DFSA?
By producing evidence as a by-product of operation rather than assembling it for an examination. That means lineage in both directions from source into a model and from a model into every output and action, least-privilege access over the underlying data sets enforced on every AI interaction, and an immutable audit trail of access decisions, policy checks and output validations. A governed control plane is the layer that produces this evidence continuously, so the answer already exists when a supervisor asks to see it.
08Sources and further reading
- Dubai Financial Services Authority, official site and the DFSA Rulebook, including the General Module and Conduct of Business modules that carry the governance, systems-and-controls, outsourcing and cyber-risk obligations.
- Dubai Financial Services Authority, Artificial Intelligence Survey 2025, on AI adoption and the state of governance across the DIFC.
- Dubai Financial Services Authority, report on regulatory insights into cybersecurity, artificial intelligence and quantum risks (2025).
- Dubai International Financial Centre, the DIFC Data Protection Law and the Commissioner of Data Protection.
- DataReadyAI, Enterprise AI Control Plane: definition, architecture and buyer’s guide.
