DIFC Data Protection Regulations, Regulation 10 (AI systems)

Binding law — in force

Apps using autonomous or semi-autonomous systems on personal data must give a clear notice on first use describing the system (DIFC Reg. 10.2.2(a)-(b))

Regulation 10.2.2(a) (notice upon initial use or access) · official text · In force: applies since 1 Sep 2023 · AE-DU-DIFC

In the DIFC, where an application or website service employing Systems (machine-based systems operating autonomously or semi-autonomously that process personal data and generate output, Reg. 10.1.1(a)) is used, the Deployer or Operator must give a clear and explicit notice on the initial use of, or access to, the System, alerting users to the underlying technology and processes that may process personal data without being human-initiated, controlled or directed, and indicating the impact on individual rights (Reg. 10.2.2(a)). The notice must describe the human-defined purposes, the principles and limits within which the System may define further purposes, its outputs and how they are used, its design principles and safeguards, and the codes, certifications or principles it follows (Reg. 10.2.2(b)). Detect an app or route that returns AI output with no AI notice, and a repository with no notice copy covering those elements.

Who it applies to

• Duty falls on: deployer, operator
• Deployers and Operators (Reg. 10.1.1(b)-(c)) of autonomous or semi-autonomous Systems processing personal data through an application or website, where the DIFC Data Protection Law applies: controllers or processors incorporated in the DIFC, wherever the processing occurs, or processing in the DIFC as part of stable arrangements (Law Art. 6(3)). Consolidated Version No. 2 of the Regulations is in force from 2023-09-01. Whether a given model-based feature is 'semi-autonomous' rather than purely automated is a human determination.
• Not covered:
  • Processing by natural persons in a purely personal or household activity with no commercial connection (Law Art. 6(4))
  • Purely automated systems with no degree of autonomy are not Systems (Reg. 10.1.1(a): autonomous or semi-autonomous operation)
• Whether it applies depends on facts outside the code; a person has to decide.

const { messages, input, handleSubmit } = useChat({ api: '/api/chat' });

const { messages, input, handleSubmit } = useChat({
  api: '/api/chat',
  initialMessages: [{ id: 'ai-notice', role: 'assistant',
    content: 'I am an AI assistant, not a human.' }],
});
// and render <AiBadge /> next to every assistant message

Standards that recommend the same control

• Persons should be notified they are interacting with an AI system (CoE Framework Convention) (CoE AI Framework Convention (CETS 225) · CoE Framework Convention on AI (CETS 225), Article 15(2))
• AI should be transparent, traceable, and disclose AI interaction to users (EU ALTAI) (EU ALTAI · ALTAI / EU Ethics Guidelines — Requirement 4 (Transparency))
• AI operators should provide verifiable transparency information and maintain accountability (Japan) (Japan AI Guidelines for Business · AI事業者ガイドライン（第1.2版） 第2部C 共通の指針 6) 透明性 (Common Guiding Principle 6) Transparency))
• People should be made aware they are interacting with AI (OECD AI Principles · OECD/LEGAL/0449 — Principle 1.3)

Related incidents

• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Tell people when they are interacting with AI — everywhere, not only where required

Rule id difc-dp-reg10.ai-system-notice-on-first-use · review status: primary source derived