Where a Controller is required to appoint a Data Protection Officer, Article 19 of the DIFC Data Protection Law requires the DPO to assess the Controller's processing at least once a year and submit that Annual Assessment to the Commissioner. For a firm that uses AI tools, it is the regular filing in which the firm describes its processing to the regulator and states whether it intends to carry out High Risk Processing Activities in the year ahead. What it says about AI should match what the firm's impact assessments and notices say.
This article reads the published DIFC instruments and the Commissioner's guidance at a general level for orientation. It is not legal advice. Whether a firm must file, and what its Annual Assessment should say, depends on its own processing and should be decided on its own facts.
Who has to file
Article 19(1) reads: “Where a Controller is required to appoint a DPO under Articles 16(2) or 16(3), the DPO shall undertake an assessment of the Controller's Processing activities, at least once per year (‘the Annual Assessment’), which shall be submitted to the Commissioner.”
Article 16(2) requires a DPO of DIFC Bodies (other than the Courts acting in their judicial capacity) and of “a Controller or Processor performing High Risk Processing Activities on a systematic or regular basis”. Under Article 16(3), the Commissioner may require any other Controller or Processor to designate one. Those are the cases the Law names.
The Commissioner's guidance reads the filing duty more widely. The Annual Assessment Checklist and FAQs (DIFC-DP-GL-03, Rev. 02, updated 29 August 2022) answer a Processor that has appointed a DPO with: “If your entity has appointed a DPO, it must complete this form.” The same document says the Portal reminder that the Annual Assessment is due “is linked to the selection in the Portal of a DPO”. The Commissioner's FAQ page uses both formulations: it refers to entities “with an appointed Data Protection Officer”, and also to filing “where a DPO must be appointed”. The position is not entirely consistent. On our reading, the Law sets the floor and the Commissioner's practice follows the DPO recorded in the Portal. A firm that appointed a DPO voluntarily should plan on filing.
On timing, the guidance says the DPO completes or supports completion of the Annual Assessment “on or before each license renewal date”, and the Commissioner's FAQ page says submissions are made on the DIFC Client Portal and that submissions by email are not accepted. Regulation 4.1.1 of the Data Protection Regulations confirms that the format, required content and deadline are those the Commissioner has published via the Client Portal, “which may be updated from time to time”.
Where AI comes in
The route from an AI tool to Article 19 runs through the High Risk test. Schedule 1, Article 3 of the Law defines High Risk Processing Activities by four limbs, any one of which is enough. The first is “Processing that includes the adoption of new or different technologies or methods, which creates a materially increased risk to the security or rights of a Data Subject or renders it more difficult for a Data Subject to exercise his rights”. The third covers a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based. Our reading of the four limbs covers the test in full.
Not every AI tool is High Risk, and Article 16(2)(b) is engaged only where High Risk processing is carried out on a systematic or regular basis. Where it is, the DPO duty follows, and, for a Controller, the Annual Assessment.
Where the tool is a System under Regulation 10.1.1(a), using a vendor's model does not move the processing out of the firm's filing. Regulation 10.1.1(b) makes a firm the Deployer of a System where it is operated under its authority or for its benefit, or where it receives the benefit of the System's operation or output, “without regard to whether or not the System is operated, supervised or hosted by such person”. Regulation 10.3.4(a) then deems the Deployer to act as a Controller (or Joint Controller) in respect of the processing by that System. On our reading, that processing is part of the Controller's Processing activities on which Article 19(2) requires it to report.
The year ahead: Article 19(2)
Article 19(2) reads: “A Controller shall report on its Processing activities in the Annual Assessment and indicate whether it intends to perform High Risk Processing Activities in the following annual period.”
This is the part of the Annual Assessment that AI plans touch most directly. A pilot scheduled for next quarter, a vendor feature about to be switched on, an agent being scoped for client onboarding: each is a question of intention for the following period, and each should be tested against the four limbs before the filing is made, not after.
The answer also connects to Article 20(1), which requires a data protection impact assessment “Prior to undertaking High Risk Processing Activities”, and to Article 20(3), which makes the DPO, where appointed, responsible for overseeing it. If the Annual Assessment indicates no intended High Risk processing and a High Risk AI deployment follows within the period, the firm's record and its practice have diverged. GL-03 notes that once an Annual Assessment is submitted, “A separate form will be available for any updates over the course of the year until your next Annual Assessment is due.”
What the form asks
GL-03 says the Annual Assessment requires knowledge of how personal data is collected, shared, deleted and stored, and of the nature, scope, context and purposes of processing and its necessity and proportionality. It lists the information requested, including:
- Data collection methods.
- Internal or external data sharing.
- Where it is processed, including transfers.
- The technical and organisational measures taken to secure the processing.
- Lawful basis for processing.
The Commissioner has also published a sample Annual Assessment and Risk Matrix from 2023, completed with test answers. In it, the question on the context of processing asks “What is the current state of emerging or advanced technology in this area?”, with options that include “AI”. The question on the firm's relationship with the individuals whose data it processes includes “Generative technology / AI users or developers”. The High Risk question lists the four Schedule 1 limbs, in shortened form, for selection. The current Portal form may differ from the 2023 sample, but in the sample AI appears by name among the answer options.
Once the questions are answered, the form produces a pre-populated risk assessment and mitigation template. GL-03 is clear that it is guidance only: “Each entity is responsible for assessing its own risks.” It also notes a practical point: the Risk Matrix can be downloaded as a CSV file only before the Annual Assessment is submitted, and only as a PDF afterwards.
After submission
GL-03 says: “The Commissioner’s Office does not approve the Annual Assessment in the Portal, but will review most of the submissions and may include certain entities for inspection purposes, based on response and clarity of the information, as well as the risks associated with the processing.” The Annual Assessment is therefore not a box that is ticked and filed away. It is information the Commissioner uses to decide where to look.
Under Regulation 4.1.2, if an Annual Assessment is late or incomplete the Commissioner may direct the Controller to submit it, or a complete one, within a further fixed period where proper justification is given. Where no proper justification is given, the Commissioner may fine the Controller, including a fine for failure to respond, an administrative fine under Article 62(2) and Schedule 2 of the Law, or a fine under Article 62(3).
GL-03, updated in 2022, says: “There is currently no fine for failure to complete the Annual Assessment.” The consolidated Law published in July 2025 lists, in Schedule 2, a maximum administrative fine of USD 25,000 for “Failure to complete Annual Assessment in accordance with Article 19 of the Law”. The same Schedule lists maximums of USD 50,000 for failing to appoint a DPO under Articles 16(2) and 16(3) and for failing to carry out an impact assessment before High Risk processing under Article 20. These are Schedule 2 maximums for administrative fines under Article 62(2), not tariffs; Article 62(3) separately allows a general fine that is not limited to those amounts. The current text of the Law is the one to rely on.
The ASO does not file it
Regulation 10.3.3 provides that no person may use, operate, provide, offer or otherwise make available for commercial use a System to engage in High Risk Processing Activities unless the System meets the Commissioner's audit and certification requirements, processes personal data solely for human-defined or human-approved purposes, and the Deployer or Operator has appointed an Autonomous Systems Officer (Regulation 10.3.3(a) to (d)). The Commissioner's Regulation 10 FAQs (DIFC-DP-GL-24, Rev. 03) say at Q18 that, at this time, “unless the ASO is in fact also the DPO, the requirements of Article 19, DPO Controller assessment, will not apply to this function”.
On the Commissioner's current guidance, then, Article 19 does not apply to the ASO role as such. That does not take AI out of the Annual Assessment. Where the firm must file, its DPO reports on all of the Controller's processing, AI included. A firm with both roles needs the ASO's view of its AI systems to reach the DPO before the filing date. Our note on who needs an ASO covers that role.
Preparing the AI section
A firm whose DPO is preparing an Annual Assessment, and which uses or plans to use AI tools, would want the following in writing before the licence renewal date:
An inventory of AI tools that process personal data
A High Risk determination for each tool
The plan for the following annual period
Impact assessments that agree with the filing
One description of the processing
An owner for changes during the year
Where to start
The inventory and the High Risk determinations are the inputs everything else depends on. They are what the two-week AI Governance Assessment produces: a written Regulation 10 baseline across a firm's AI tools and a costed roadmap, at a fixed AED 5,000.