The DIFC High Risk test for AI: four limbs, and the one an AI risk review can overlook

AI tools increasingly sit inside the ordinary operations of DIFC firms, from screening and onboarding to drafting and staff assistants. The question the DIFC Data Protection Law turns on is whether any of that processing is High Risk, and it deserves a written answer. The test has four limbs. The fourth needs no finding of increased risk at all, and it is the one a review focused on AI risk can overlook.

Why the determination matters

“High Risk Processing Activities” is a defined term in Schedule 1 of DIFC Data Protection Law No. 5 of 2020. Several obligations switch on only when a firm is on the far side of that line, and some of them carry maximum administrative fines listed in Schedule 2 of the Law. Regulation 10 of the Data Protection Regulations, which has governed personal data processed through autonomous and semi-autonomous systems since 1 September 2023, uses the same term to decide when its strictest conditions apply.

So the determination is not a compliance formality. Until it has been made, a firm does not know whether it needs a Data Protection Officer, whether it owes the Commissioner an Annual Assessment, whether a prior impact assessment was required, or whether the AI conditions in Regulation 10.3.3 reach it. The definition contains no numerical threshold. “Materially increased”, “considerable amount” and “material amount” are all judgements, which is why the answer has to be reasoned and written down rather than looked up.

The test, word for word

Processing of personal data is High Risk where one or more of the following applies (DIFC Data Protection Law, Schedule 1):

Limbs (a), (b) and (c) each carry a qualifier: a materially increased risk, a likely high risk, or an effect that is legal or similarly significant. Limb (d) carries none. It asks only whether a material amount of a particular kind of data is processed.

The fourth limb and financial firms

The Law defines Special Categories of Personal Data as data revealing or concerning, directly or indirectly, racial or ethnic origin, communal origin, political affiliations or opinions, religious or philosophical beliefs, criminal record, trade-union membership, health or sex life, and genetic data and biometric data used to uniquely identify a natural person.

Read that list against the ordinary operations of a DIFC financial firm and several routine activities come into view:

• Financial crime screening. Sanctions, politically exposed person and adverse media checks can surface information concerning criminal records and, where a person's public role is a political one, political affiliations, often at scale and through a screening tool with automated matching.
• Identity verification. Onboarding tools that match a selfie to an identity document typically process facial biometric data to confirm who a person is, which is likely to be biometric data used to uniquely identify them.
• Staff and benefits data. Medical insurance, sick leave and occupational health records are health data. DIFC guidance indicates this is more likely to be material where a firm has a large number of staff.
• Building and device access. Fingerprint or facial recognition entry systems can process biometric data for identification.

None of this means a given firm is High Risk. “Material amount” is a judgement, and DIFC's guidance says the more sensitive the data, the lower the volume needs to be for it to be material. It does mean that a firm which has only asked whether its AI use “increases risk” has answered one of the four questions, and possibly not the one that matters most for it.

The same guidance goes further on the second limb. Discussing particularly sensitive data, including personal financial data, it says the Commissioner “would expect virtually all medical practices and regulated financial businesses, for example, to be conducting High-Risk Processing Activities” (DIFC guidance on High Risk Processing Activities and DPO appointments, 2022). That is the regulator's expectation for the sector, stated in general terms; each firm still has to reach its own conclusion on its own facts.

Why a vendor system is still yours

A natural response to all of this is that the AI belongs to a vendor. Regulation 10 closes that door deliberately. A “Deployer” is the person under whose authority, on whose direction or for whose benefit a system is operated, or who receives the benefit of its operation or output, “without regard to whether or not the System is operated, supervised or hosted by such person” (Regulation 10.1.1(b)). A Deployer is deemed to act as the Controller for the personal data the system processes (Regulation 10.3.4).

In practice, where a third party screening engine, onboarding tool or AI assistant operates with some autonomy and is a System in the Regulation's sense, a DIFC firm that uses it on its own clients and staff is very likely its Deployer. Purely rule-based tools whose operation is fully controlled by humans are not intended to be captured. The vendor's contract can allocate work and liability between the parties. It does not move the firm's obligations to the vendor.

What the Law requires once you are in

A High Risk finding triggers duties under the Law itself, independently of Regulation 10:

• A Data Protection Officer where High Risk Processing is performed on a systematic or regular basis (Article 16(2)(b)). Failing to appoint one where required is listed in Schedule 2 with a maximum fine of USD 50,000.
• An Annual Assessment by that DPO, submitted to the Commissioner, which must indicate whether the firm intends to perform High Risk Processing in the following year (Article 19). Schedule 2 lists a maximum of USD 25,000 for failing to complete it.
• A data protection impact assessment before the processing starts(Article 20(1)), overseen by the DPO where one is appointed (Article 20(3)). Schedule 2 lists a maximum of USD 50,000 for failing to carry one out prior to High Risk Processing.

Where no DPO is required, the Law still requires responsibility for data protection oversight and compliance to be clearly allocated within the organisation, with the persons responsible identifiable to the Commissioner on request (Article 16(4)). None of these duties depends on a future announcement. They apply now to any firm whose processing meets the definition.

What Regulation 10 adds

Regulation 10 applies to every System that processes personal data, High Risk or not. Deployers and Operators must apply the Law's general processing principles (Regulation 10.2.1). Where an application or website service uses a System, they must give clear notice on first use and describe its purposes, outputs and safeguards (Regulation 10.2.2). Systems that may affect Data Subjects must be designed to be ethical, fair, transparent, secure and accountable (Regulation 10.3.1).

The High Risk conditions

Above the line, Regulation 10.3.3 says no person may use, operate, provide, offer or otherwise make available for commercial use a system to engage in High Risk Processing unless the Commissioner has set audit and certification requirements, the system complies with them, it processes personal data only for human-defined or human-approved purposes, and the Deployer or Operator has appointed an Autonomous Systems Officer with the same or substantially similar competencies, status, role and tasks as a DPO.

Two points deserve care. First, the Commissioner's FAQ states that the audit and certification framework required by Regulation 10.3.3(a) has been published, while the framework itself says the timeline for implementing it is at the Commissioner's discretion. Regulation 10.3.3 is framed as a prohibition: until a System meets every condition, it should not be used commercially for High Risk Processing. How that applies while certification bodies are still being accredited is a question for counsel, and nobody can responsibly promise a date.

Second, the FAQ says “commercial use” is similar to placing a System in the consumer market under the EU AI Act, with a consumer protection element. The FAQ does not have the force of law, and how far the phrase reaches into purely internal systems is also a question for counsel. Neither point affects the Law duties above, which apply regardless.

What a written determination contains

A determination that will stand up to a question from the Commissioner, an auditor or a board is short and specific. It usually covers:

• An inventory of the systems in scope, including vendor tools, with what each one does and who relies on its output.
• The categories of personal data each system processes, with Special Categories identified explicitly.
• Each of the four limbs applied to each system, with the reasoning written out, not a tick.
• The conclusion for each system, and the duties that follow: DPO, Annual Assessment, impact assessment, Regulation 10 conditions.
• An owner, a date, and the events that will trigger a review, such as a new tool, a new data source or a change in how output is used.

The work need not be large. The definitions are fixed and the facts are knowable; most of the effort goes on finding out which tools are actually in use and what data reaches them. That is what the two week AI Governance Assessment produces, at a fixed AED 5,000.