Question 1

What is DIFC Regulation 10?

Accepted Answer

DIFC Regulation 10 is part of the DIFC Data Protection Regulations enacted on September 1, 2023. It specifically addresses the processing of personal data through autonomous and semi-autonomous systems, including artificial intelligence (AI). The regulation establishes a framework for certification of AI systems operating within or targeting individuals in the DIFC.

Question 2

How do I know if my AI system requires certification?

Accepted Answer

AI systems that process personal data and operate within the DIFC jurisdiction or target DIFC residents may require certification based on risk factors. Our preliminary assessment tool can help you determine if your system requires certification. Generally, systems with high-risk applications or that process sensitive personal data are more likely to require certification.

Question 3

How can I check my eligibility: the WLC assessment tool or the DIFC portal?

Accepted Answer

You can use either route. Our WLC Assessment Tool is a free preliminary scoping questionnaire that indicates whether your AI system is likely to fall within Regulation 10. Alternatively, you can submit a Regulation 10 Certification Application through the official DIFC portal, which returns a formal eligibility determination from the Commissioner of Data Protection under the DIFC Regulation 10 Certification Guidance. Determining eligibility through the DIFC portal carries an application fee of USD 100 and 200 for DIFC and non-DIFC entities, respectively. If your organisation selects White Label Consultancy as its Accredited Certification Body, we discount those fees from your certification fees.

Question 4

What are the penalties for non-compliance?

Accepted Answer

Non-compliance with DIFC Regulation 10 can result in significant penalties, including fines of up to 50 million USD, prohibition of processing activities, and reputational damage. The exact penalties depend on the severity of the violation, the scope of affected individuals, and other factors determined by the DIFC Commissioner of Data Protection.

Question 5

How long does the certification process take?

Accepted Answer

The certification timeline varies depending on the complexity of your AI system and its current compliance status. Typically, the process takes 2 to 3 months from initial assessment to certification issuance. This includes time for gap analysis, implementation of necessary changes, documentation preparation, formal audit, and certification issuance.

Question 6

How much does certification cost?

Accepted Answer

Certification costs vary based on the complexity of your AI system and the extent of compliance gaps. We offer packages starting from 18,000 AED for basic certification support up to 60,000 AED for complex AI systems requiring comprehensive support. Custom pricing is available based on your specific needs.

Question 7

Is White Label Consultancy officially recognized by DIFC?

Accepted Answer

Yes, White Label Consultancy is officially recognized by the DIFC as an Accredited Certification Body (ACB) for Regulation 10. We are listed on the DIFC Commissioner of Data Protection website as one of only two ACBs, and we are the only external ACB currently available (the other being Standard Chartered Bank, which only certifies internal systems).

Question 8

What documentation is required for certification?

Accepted Answer

Required documentation typically includes technical specifications of your AI system, data processing documentation, risk assessments, governance frameworks, data protection impact assessments (DPIAs), training protocols, and evidence of implemented safeguards. Our team will provide a detailed checklist based on your specific system.

Question 9

Do I need to modify my AI system to achieve certification?

Accepted Answer

Most AI systems will require some modifications to meet DIFC Regulation 10 requirements. These may include implementing additional safeguards, improving transparency mechanisms, enhancing documentation, or modifying data processing practices. Our gap analysis will identify specific areas requiring changes.

Question 10

How often does certification need to be renewed?

Accepted Answer

DIFC Regulation 10 certification is typically valid for 2 years, after which renewal is required. However, significant changes to your AI system or relevant regulations may necessitate reassessment before the renewal date. We offer ongoing monitoring to help maintain compliance between certification cycles.

Question 11

Can you help with both assessment and implementation?

Accepted Answer

Yes, our services cover the entire certification journey. We provide initial assessment, gap analysis, implementation support, documentation preparation, audit readiness, and certification. Our experts work closely with your team to ensure compliance while minimizing business disruption.

Question 12

What platform do you use to run the certification process?

Accepted Answer

We deliver every Regulation 10 engagement on Pritect, White Label Consultancy's AI governance platform. Pritect holds your AI system inventory, the scored gap analysis against each Regulation 10 requirement, the remediation plan and all supporting evidence, so you and our assessors work from one shared record and can export an audit-ready pack at any point. Pritect also covers wider AI governance obligations, including the EU AI Act, DIFC DPL and other privacy regimes, so the work you do for Regulation 10 is reusable.

Questions and answers

Talk to our certification team