AI governance,before the audit.

There is no single AI statute yet. Obligations arise through the PDPL and free-zone data protection laws, the DIFC's Regulation 10 for autonomous systems, sector regulators' model-risk expectations, and general consumer, employment and IP law, all framed by the UAE AI Charter and national strategy. That patchwork is exactly why a governance framework matters: it is how you demonstrate compliance across all of them.

It can. The Act applies to providers placing AI systems on the EU market and to providers and deployers outside the EU where the system's output is used in the EU. If your product serves EU customers or your enterprise clients use your AI features in Europe, you should assume it applies and classify your systems now; high-risk obligations phase in from 2026 and 2027.

Regulation 10 under the DIFC Data Protection Law imposes duties on controllers and processors deploying autonomous or semi-autonomous systems that process personal data: assessments, transparency, human oversight, contestability and, for high-risk systems, engagement with the Commissioner. It is one of the first binding AI-specific rules in the region and DIFC entities using AI in decisions about people should treat it as live.

At minimum: an inventory of AI systems and their owners; a risk-tiering method; policies on development, procurement and acceptable use; assessment procedures for high-impact systems; human-oversight and incident-response processes; training; and board-level reporting. We align frameworks to ISO/IEC 42001 and NIST AI RMF so that they translate into audits and certifications later.

Yes, with rules. An acceptable-use policy should define permitted tools and use cases, prohibit input of confidential, personal or client data into unapproved tools, address output review and attribution, and set procurement standards for enterprise AI tools. Most incidents we see arise from the absence of a policy rather than a breach of one.

Ownership and licensing of outputs, training data and fine-tuned models should be allocated by contract, because copyright law in most jurisdictions gives limited or uncertain protection to purely machine-generated works. We draft AI clauses for customer, vendor and cloud agreements that make ownership, indemnity and audit rights explicit.

Through guidelines and existing law rather than a dedicated statute: MeitY advisories on generative AI and intermediaries, the India AI Governance Guidelines, the DPDP Act for personal data in training and inference, and sector rules from RBI, SEBI and IRDAI for AI in financial and insurance services. Indian deployments should be governed to those standards and documented accordingly.

A framework and policy suite for a mid-sized organisation typically takes eight to twelve weeks. EU AI Act readiness for a product company runs six to ten weeks for classification and roadmap, with implementation depending on the systems in scope. Single AI impact assessments take two to four weeks. All are fixed-fee.