DFSA AI Survey 2026: AI Adoption Among DIFC Financial Firms Reaches 71%, More Than Double the 2024 Level
Three out of four financial institutions in Dubai’s main financial hub now run artificial intelligence in their daily operations. According to fresh data from the Dubai Financial Services Authority (DFSA), AI adoption inside the Dubai International Financial Centre (DIFC) surged to 71% this year. That is up from 52% in 2025 and 33% in 2024. The shift happened fast. What used to be isolated experiments in IT departments has morphed into core business infrastructure. In our earlier DFSA AI Study 2025 analysis, we tracked early testing. Today, the conversation centers on generative tools, third party risk management uae challenges, and direct regulatory oversight.
DFSA AI Survey 2026 Shows AI Use at 71% of Responding DIFC Firms
Three-Year Trend: 33% in 2024, 52% in 2025 and 71% in 2026
In 2024, barely a third of regulated firms used AI. By 2025, that number crossed the halfway mark. Now, at 71%, deployment is standard practice across the free zone. Local teams are no longer asking if they should automate; they are figuring out how fast they can scale without breaking compliance rules.
Generative AI Climbs From 22% to 67% of Respondents, Used by 94% of AI Adopters
Generative software drove most of this expansion. Back in 2024, just 22% of surveyed entities used generative models. That number hit 48% last year and sits at 67% today. If you isolate the institutions already using AI, 94% rely on generative platforms to handle daily workloads.
Growth Expectations Rise From 54% to 84% Over Three Survey Rounds
Budgets are moving with the trend. Fully 84% of responding firms expect to increase their technology investments over the next three years. Compare that with 75% in 2025 and 54% in 2024. Confidence is high, and expansion plans are already locked in.
DIFC Closes In on International AI Adoption Benchmarks
Third Annual DFSA Survey Builds on 661 Firm Responses in 2025
This latest release builds on a massive dataset gathered across banking, asset management, insurance, and fintech sectors in Dubai. The regulator’s multi-year tracking gives a rare, transparent view into how regional financial institutions build out their tech stacks.
UK Financial Services Benchmark of 75% AI Use in the 2024 Bank of England–FCA Survey
At 71%, Dubai’s financial district is practically tied with older global capitals. For context, official joint data from the Bank of England and the FCA pinned UK financial sector adoption at 75%. DIFC is operating at global scale.
Adoption Is Wide but Deployment Remains Shallow
Broad Deployment Rises From 23% to 39% of AI Adopters
Getting a tool into a building is one thing; embedding it across every department is another. While 39% of adopting firms now run AI across a large chunk of their operations—up from 23% in 2024—most entities are taking smaller steps.
74% Still Piloting or Using AI Within a Small Share of a Business Area
Nearly three-quarters (74%) of active users admit their setups remain stuck in narrow pilot programs or small sub-units. Firms are using the tech, but they are keeping it on a short leash.
Internal Functions Lead, With Audit, Compliance and Risk Use Rising to 52%
91% of Generative AI Users Apply It in HR, Legal or Finance
Where are companies actually putting these systems to work? Back-office operations. Nine out of ten generative AI users run the software inside internal units like legal document review, human resources, or financial accounting.
Client-Facing Use Grows More Slowly, From 33% to 36%
Front-office tools are moving much slower. Client-facing applications edged up slightly from 33% in 2025 to 36% this year. Strict suitability rules, data privacy concerns, and simple brand preservation keep boards from letting automated systems talk directly to customers.
If you want to see how control teams manage these boundaries, read our analysis on the future of auditing in AI advancements and our review of DIFC AI data protection regulation.
Third-Party AI and Cloud Dependence Raise Concentration Risk
Third-Party Generative AI Applications Rise From 65% to 75% of Users
Few companies build their own models from scratch. Three-quarters of generative AI users buy off-the-shelf commercial software from vendor platforms, up from 65% last year.
73% of Adopters Run 91–100% of AI Applications on Cloud Platforms, Up From 62%
The infrastructure story is even more concentrated. Right now, 73% of adopters run practically all their AI tools (91% to 100%) on public cloud infrastructure. That is up from 62% in 2025.
Firms Remain Responsible for Data Security, Continuity and Concentration Risks
Outsourcing software hosting does not outsource liability. When a third-party vendor goes down or suffers a breach, the regulated firm takes the hit.
Outsourcing to AI and Cloud Vendors Leaves Regulatory Responsibility With the Firm Under DFSA GEN 5.3.21
DFSA rules leave zero room for confusion here. Under Rule 5.3.21 in the General Module of the official DFSA Rulebook, ultimate operational accountability stays with the authorized firm. You can hire vendor tech, but you cannot delegate your legal duties.
Check our specialized cyber risk advisory services in the UAE to evaluate vendor contracts and infrastructure risks.
Governance Gaps Remain: 61% Have an AI Framework, 41% Keep a Use-Case Register
AI Policies in Place at 53% of Adopters, With 28% Still Drafting
Policy creation is struggling to keep up with software installations. Only 61% of adopting entities have an active ai governance framework in place. Written corporate policies exist at 53% of firms, while 28% say theirs are still being drafted.
Acceptable Use Rules to Contain Shadow AI and Client Data Leakage
Without clear acceptable use policies, shadow AI runs rampant. Staff will inevitably copy sensitive client records or internal financial figures into unapproved public chat interfaces to save time on a Friday afternoon.
Use-Case Inventories: 41% in Place and 31% Under Development
Only 41% of adopting institutions maintain a formal, centralized inventory of their active AI tools. If you do not know what software your teams are using, you cannot audit it.
Post-Deployment Monitoring Ranges From Formal Reporting to Ad Hoc Checks
Monitoring after launch remains messy across the district. Some firms run structured board reporting, but many rely on informal check-ins with zero defined metrics for tracking model explainability or output drift.
Browse through our practical toolkits on our corporate governance services and internal audit services pages.
AI Agents Move From Exploration to Early Deployment
53% Exploring or Testing AI Agents, Only 14% at Deployment Stage
Autonomous ai agents in finance are getting plenty of attention. Over half of survey participants (53%) are testing or running pilots with agentic setups, but only 14% have moved those agents into live production environments.
DFSA Research on What Deployed and Agentic AI Can Access and Affect
To evaluate system safety, the regulator published joint research with Cambridge scholars looking at what autonomous software can touch, alter, or break inside a bank’s network. For the bigger policy context, see our article on DIFC becoming an AI-native financial centre.
Explainability and Traceability Become Central as Agents Act Under Delegated Authority
When an autonomous agent takes action without a human clicking “approve,” you need airtight audit trails to prove why the decision was made when regulators inspect your book.
DFSA Will Use the Findings in Risk-Based Supervision
Survey Results Feed the Annual Technology and Cyber-Risk Self-Assessment
These survey metrics are not just for public relations. The DFSA uses the data to calibrate its risk-based supervisory priorities and update annual tech self-assessment forms for license holders.
Regulatory Expectations on AI Risk Management and Early Dialogue on Higher-Impact Use Cases
Regulators want senior management to speak up early. If you plan to deploy high-impact or customer-facing automated systems, open a dialogue with your supervision team first. Review the latest guidance on the DFSA SEO Letters portal to align your internal ai risk management policies with official expectations.
ADEPTS View: Five Gaps DIFC Firms Should Close Before the Next Supervisory Cycle
- Build a Complete Use-Case Register: Log every active tool, vendor contract, and internal pilot project running in your building.
- Enforce an Acceptable Use Policy: Put strict guardrails around what employees can upload to third-party software.
- Set Up Post-Deployment Reviews: Check your models regularly to catch logic drift, errors, or biased outputs.
- Review Vendor Contracts: Audit your cloud host agreements against DFSA GEN 5.3.21 standards.
- Keep Decisions Audit-Ready: Ensure every automated action has a clear, explainable decision trail.
DIFC Data Protection Regulation 10 Adds a Separate Layer for AI Processing Personal Data
Under DIFC Data Protection Regulation 10, processing personal information using semi-autonomous systems requires explicit privacy impact reviews and strict data handling safeguards.
Evaluate your compliance posture with our enterprise risk advisory experts.
ADEPTS Supports DIFC Firms With AI Governance and Technology Risk Reviews
ADEPTS helps financial institutions across the DIFC design practical AI governance, manage vendor reliance, and prepare for DFSA supervisory reviews. Visit our risk advisory page to see how we can assist your team.
FAQs:
The DFSA takes a tech-neutral approach. Standard DIFC rules on governance, risk controls, operational systems, and outsourcing cover all AI applications.
Yes. Running automated financial advisory or algorithmic portfolio management is a regulated activity. You must secure a licence from the Dubai Financial Services Authority.
Yes. The Innovation Testing Licence (ITL) gives eligible startups a sandbox setting to test novel AI financial products under regulatory oversight.
The DFSA runs this survey every year. The first survey launched in July 2024, followed by reports in late 2025 and late 2026.
Firms outside the DIFC fall under the Central Bank of the UAE (CBUAE), the Securities and Commodities Authority (SCA), ADGM’s FSRA, or VARA.
Both maintain tech-neutral stances centered on risk oversight and consumer protection, adapting specifics to their local market structures.
Yes. The EU AI Act has extra-territorial reach. If your DIFC firm serves EU clients or exports AI outputs into the EU market, you must meet Regulation (EU) 2024/1689 rules.
No single federal statute governs AI alone. The UAE guides technology adoption through strategic plans like the UAE National Strategy for Artificial Intelligence 2031 and regulatory circulars.
Yes. Regulators hold enforcement powers, shown by penalties against entities like Moody’s Middle East for data control failures.
ISO/IEC 42001 is an international standard for AI management. It gives firms a structured roadmap to set up ethical oversight and risk controls.
Ultimate accountability rests with the Senior Executive Officer (SEO) and the Board. Operational tracking is usually handled by the Chief Risk Officer or an internal governance committee.
Yes. Because automated software touches critical operations, high-risk use cases and vendor setups belong in annual internal audit reviews.
Yes, but the firm stays fully responsible under DFSA AML rules. Senior officers must verify that automated screeners process transaction data accurately without missing red flags.
Cross-border data transfers are permitted under DIFC Data Protection Law rules if the destination country offers adequate protection or clear safeguards exist.
Directors should ask: What data goes into the model? Where is it hosted? What human checkpoints exist? How do we monitor system errors and vendor stability over time?
To align your technology oversight with upcoming supervisory standards, read our detailed guide on the UAE AI tech audit framework.
References
- Bank of England, & Financial Conduct Authority. (2024, November 21). Artificial intelligence in UK financial services 2024. Bank of England. https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024
- Dubai Financial Services Authority. (2024, December 22). Cyber risk management guidelines (Dear SEO letter). https://365343652932-web-server-storage.s3.eu-west-2.amazonaws.com/files/1216/0863/2796/20201222_Dear_SEO_Letter_Cyber_Risk_Management_Guidelines.pdf
- Dubai Financial Services Authority. (2024, February 23). Key themes and findings from 2023 DFSA risk assessments (Dear SEO letter). https://365343652932-web-server-storage.s3.eu-west-2.amazonaws.com/files/6717/0893/5561/20240223_Dear_SEO_Letter-Key_Themes_and_Findings_from_2023_DFSA_Risk_Assessments.pdf
- Dubai Financial Services Authority. (2025, June 30). New DFSA report explores regulatory insights: Cybersecurity, artificial intelligence, and quantum risks. https://www.dfsa.ae/news/new-dfsa-report-explores-regulatory-insights-cybersecurity-artificial-intelligence-and-quantum-risks
- Dubai Financial Services Authority. (2025, November 12). New DFSA AI survey: Generative AI adoption has nearly tripled within DIFC over the last 12 months while governance continues to develop. https://www.dfsa.ae/news/new-dfsa-ai-survey-generative-ai-adoption-has-nearly-tripled-within-difc-last-12-months-governance-continues-develop
- Dubai Financial Services Authority. (2025). DFSA artificial intelligence survey 2025 full report [PDF]. https://365343652932-web-server-storage.s3.eu-west-2.amazonaws.com/files/4317/6284/9776/DFSA_Artificial_Intelligence_Survey_2025_Final.pdf
- Dubai Financial Services Authority. (2026, October 28). DFSA fines Moody’s Investors Service Middle East Limited USD 585,825 for data confidentiality breaches. https://www.dfsa.ae/news/dfsa-fines-moodys-investors-service-middle-east-limited-usd-585825-data-confidentiality-breaches
- Dubai Financial Services Authority. (2026, November 2). AI adoption among DIFC financial services firms has more than doubled since 2024. https://www.dfsa.ae/news/ai-adoption-among-difc-financial-services-firms-has-more-doubled-2024
- Dubai Financial Services Authority. (n.d.). Senior Executive Officer (SEO) letters. https://www.dfsa.ae/your-resources/publications-reports/seo-letters-1
- Dubai International Financial Centre Authority. (n.d.). Data protection law and regulations. https://www.difc.ae/business/operating-here/data-protection
- European Parliament, & Council of the European Union. (2024, June 13). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
- International Organization for Standardization. (2023). Information technology — Artificial intelligence — Management system (ISO/IEC Standard No. 42001:2023). https://www.iso.org/standard/81230.html
- United Arab Emirates Government. (n.d.). UAE national strategy for artificial intelligence 2031. Official Portal of the UAE Government. https://u.ae/en/about-the-uae/strategies-initiatives-and-awards/strategies-plans-and-visions
Related Articles
