AI adoption in the DIFC is running ahead of accountability
Authorised Firms had until 27 August to tell the DFSA what governs their use of AI. The findings will not be public for months, so the 2025 report is the picture the regulator already holds.
The Dubai Financial Services Authority (DFSA) issued its 2026 artificial intelligence survey to Authorised Firms on 30 July, in a letter to Senior Executive Officers, and required responses by 27 August. It asked what types of AI are in use and how far they have spread, what is driving and blocking adoption, and what governance and oversight arrangements sit around the technology. Those answers are now with the regulator.
What they say will not be public for months. The DFSA ran its 2025 survey in June and published the findings in November. Until the equivalent appears, the 2025 report remains the only published picture of AI in the Dubai International Financial Centre (DIFC), and it is the picture the DFSA had in front of it when it drafted this year’s questions.
The 2025 survey drew 661 responses, 88 percent of those asked, against 544 responses and 83 percent in 2024. Every figure below describes those 661. The DFSA published no breakdown by sector, so none of it reads as a wealth or asset management number on its own.
It found 345 of the 661 actively using AI, or 52 percent, against 177 of 544, or 33 percent, in 2024. Generative AI drove most of the movement, rising from 119 companies to 317.
The DFSA put 79 percent of use cases in internal operations such as human resources, legal and finance, or in internal systems and controls such as audit, compliance and risk. Client-facing deployment remained the minority. Maturity moved too. Companies running AI across a considerable share of a business area tripled from 41 to 121, and those calling it critical to at least one area rose from 17 to 29.
Of the 345 companies using AI, 72 lacked clear accountability mechanisms for governing it. That is 21 percent of the companies using AI. Several published summaries report it as 21 percent of all 661 respondents, which spreads the gap across a population nearly twice the size.
The gap widens where the stakes are highest. Of the 121 companies running AI across a considerable share of a business area, 11 percent had no governance framework at all, or roughly 13 companies. Among the 29 describing AI as critical to a business area, about eight had none.
The survey’s own figures do not reconcile. Its executive summary states that 60 percent of companies have some form of AI governance structure. Its body states that 70 percent of companies using AI have formal frameworks and that almost 90 percent have allocated governance responsibility, which sits awkwardly against 72 of the 345 having none. The DFSA has not reconciled the three. For a board reading this, the useful number is the one from the regulator’s own count.
Companies asked for help in return. A total of 526 asked the DFSA to clarify how existing regulation applies to AI, and lack of regulatory guidance displaced lack of expertise as the most cited governance challenge, named by 255 companies.
Three questions sit behind the DFSA’s concern, and a supervisor can ask any of them without notice. Who inside the company owns the decision to deploy a given AI capability, and is that ownership recorded where a supervisor could find it. What review takes place before AI-assisted output reaches a client. And what happens to the record, since a company producing client-facing commentary with AI assistance holds the same recordkeeping obligations it always did.
None of this requires an elaborate framework. A one-page policy naming the approved tools, the prohibited uses, the review requirement before external release and the person accountable for the whole arrangement answers most of what a supervisor will ask. A company that already holds a model risk or outsourcing policy has most of the structure in place.
Underneath the policy sits a question about permissions. An AI assistant working inside Microsoft 365 draws on whatever the person asking can already open, which makes the governance question and the permissions question the same question. A research analyst who can technically reach the compliance team’s files will get answers out of them.
“
The governance question and the permissions question are the same question.
For a company of 30 to 80 people the sequence is narrow and dull. Find out what is actually shared with whom across the Microsoft 365 environment, and correct it. Write the one-page policy. Take one use case that works from documents the company already holds, give it to the handful of people who do that work, and decide what comes next from what you observe.
The deadline was 27 August. Whatever the DFSA publishes from this year’s returns, the arrangement each company described is the one it will be measured against. Put it on the board agenda now, and Penta can help you get there.
Lester Pinto is Regional Manager at Penta, where he manages client relationships and ensures seamless delivery of IT services tailored to regulated industries. With a focus on understanding business needs and translating them into secure, compliant solutions, he plays a pivotal role in maintaining long-term partnerships and supporting clients through complex IT and compliance challenges.
