At a glance
| Jurisdiction tier | Tier A - Specified and enforced. A binding instrument that applies to insurers' own use of AI, or an issued regulator document addressed to this insurance market, addresses AI - by name or by an unambiguous description such as "predictive models" or "automated decision system" - and sets out rules or expectations that apply to it; and the regulator has a live mechanism to check or sanction them. |
| Case examined | Atradius (DIFC) - AI models that process credit-limit applications |
| Band for this case | Watching |
| Rules reach | Insurers: directly · Reinsurers: directly · Intermediaries: directly |
| Last verified | [actual date of the launch-window check] |
The DIFC's Data Protection Regulations (Consolidated Version No. 2, in force 1 September 2023) include Regulation 10 on autonomous and semi-autonomous systems that process personal data. The deployer must be able to produce a risk and impact assessment on request; high-risk processing may run only on a certified system with an appointed Autonomous Systems Officer. The Commissioner can inspect and fine.
Regulation 10 applies only where such a system processes personal data.
Who these rules reach
- Insurers: directly, where it deploys or operates in the DIFC a system "operating in an autonomous or semi-autonomous manner" that processes personal data (Regulation 10.1.1(a)).
- Reinsurers: directly, on the same terms.
- Intermediaries: directly, on the same terms.
This band describes how clearly the rules meet the AI use that Atradius (DIFC) has itself published. It is not a finding that Atradius (DIFC) has breached any rule.
Why Atradius (DIFC): Atradius's own pages of 17 August 2022 and 11 March 2026 describe its proprietary AI models and the share of credit-limit applications they process automatically.
The question
In briefAtradius said in August 2022 that it was scaling its AI and machine-learning underwriting tools "functionally and geographically", and says that more than 70% of its credit-limit applications, across more than 140 countries, are now processed automatically using its proprietary AI machine-learning models. DIFC's Regulation 10, in force since 1 September 2023, applies only where such a system processes personal data. Where it does, the deployer must be able to produce on request a risk and impact assessment covering whether the processing may result in unjust bias or High Risk Processing. High Risk Processing may run only on a system certified under the Commissioner's requirements, with an appointed Autonomous Systems Officer. If Atradius's DIFC entity uses those models, does it process personal data there - for example on sole-trader buyers or individual guarantors - and has it made that assessment?
Why this band: Both points are less firm: the rule bites only where personal data is processed, and whether the DIFC entity uses the models is not public.Atradius says most of its credit-limit applications worldwide are now processed automatically by its own AI models. In the DIFC, such a system meets a rule that bites only where personal data is processed - and then demands a documented high-risk assessment, plus certification if the answer is yes. Whether the DIFC entity uses those models, on what data and with what assessment, is not public.
3. The same question for other firms in United Arab Emirates (DIFC)
Any firm in the DIFC that uses autonomous systems on applications involving individuals faces the same points: whether it processes personal data there, and whether it has made the assessment the rule requires. This entry gives no band to any firm other than Atradius (DIFC).
4. What this entry does not establish
- The list of what counts as high-risk processing sits in the DIFC Data Protection Law 2020, which was not read; the Commissioner's guidance is used.
- Whether the DIFC entity uses the group's models, and whether it processes personal data. The question asks both.
- Whether the DIFC entity is the reinsurer of record for regional partners; a 2026 release says only that "an Atradius company" has acted as reinsurer.
- The 2022 statement is dated in the question; whether it is current is not established.
- Launch-window check: both Atradius pages remain live.
Sources
- Atradius, "AI - a new frontier in credit insurance", 17 Aug 2022 (printed). Company's own. group.atradius.com
- Atradius, "AI, automation and the next era of trade credit underwriting", 11 Mar 2026 (printed). Company's own. group.atradius.com
- DIFC Authority, release on Atradius's DIFC hub, 14/04/2026 (printed). Government. difc.com
- Government of Dubai Media Office, release, Tuesday, April 14, 2026 (printed). Government. mediaoffice.ae
- DIFC Data Protection Regulations, Consolidated Version No. 2, in force on 1 September 2023 (printed), Regulation 10. Regulation. assets.difc.com PDF
- DIFC Commissioner of Data Protection, Regulation 10 guidance (DIFC-DP-GL-23) and FAQs (DIFC-DP-GL-24), Rev. 03, 27th August 2024 (printed). Regulator. guidance PDF · FAQs PDF
None share a law or regulator with this entry.
________________________________________
Commercial relationship with any party named here: None · Right of reply: indexreport.protocol@fijishi.com; with the sender's agreement, replies are published in full below the entry, dated · Cite as: Fijishi Jurisdiction Index 2026, Entry AE-DIFC · Corrections: none.