DFSA finds AI use at 71% of surveyed DIFC firms

The Dubai Financial Services Authority (DFSA) said on 2 November 2026 that 71% of surveyed firms authorised in the Dubai International Financial Centre (DIFC) used at least one form of artificial intelligence (AI) this year. That compares with 52% in 2025 and 33% in 2024. The figures come from the DFSA’s third annual AI Survey, which examines firms’ use of AI, governance arrangements, risks and deployment trends.

For compliance teams, the DFSA said it will use the results in risk-based supervision, including its annual technology and cyber-risk self-assessment and its assessment of firms’ material AI use, governance and third-party dependencies. Firms using AI therefore need to be able to explain where it is deployed, who supplies it, how it is monitored and how service disruption or control failure would be managed.

Adoption is ahead of governance

Generative AI use rose from 22% of respondents in 2024 to 48% in 2025 and 67% in 2026. Among firms that used any AI this year, 94% reported using generative AI.

The increase does not mean that AI is deployed extensively across entire business functions. Among AI adopters, 39% said AI was deployed across a considerable share of a business area, up from 23% in 2024. But 74% said at least some AI applications were being piloted or used within only a small share of a business area.

Governance is developing behind adoption:

- 61% of AI adopters had an AI governance framework;
- 53% had organisational policies governing AI use, while another 28% were developing them;
- 41% maintained an inventory or register of AI use cases, with 31% developing one;
- post-deployment monitoring ranged from formal reporting to informal or ad hoc arrangements, with some firms still building their capabilities.

Generative AI remains concentrated in internal functions. Ninety-one per cent of its users reported applications in areas such as human resources, legal or finance. Use in internal systems and controls, including audit, compliance and risk management, rose from 39% of generative AI users in 2025 to 52% in 2026.

External exposure was lower but increased from 33% to 36%. The DFSA’s figures therefore distinguish between using AI as an internal productivity tool and deploying it in activities that can affect clients or other external stakeholders.

Third-party and cloud exposure

The survey also points to a growing dependency risk. Seventy-five per cent of generative AI users reported using applications developed by third-party providers, compared with 65% in 2025. Firms could select more than one development model, including internal, group-level and joint development.

Cloud concentration was similarly high. Seventy-three per cent of AI adopters said that between 91% and 100% of their AI applications ran on cloud platforms, up from 62% in 2025.

The DFSA said these arrangements can create additional data-security, service-continuity and concentration risks. It said firms remain responsible for understanding those dependencies and ensuring that appropriate governance, security, monitoring and recovery arrangements are in place.

In Atlas’s view, the combination of high third-party and cloud use with incomplete inventories is the practical control issue in the survey. A firm cannot properly assess vendor concentration, data exposure, resilience or accountability if it has not established a reliable list of its AI use cases and dependencies.

AI agents remain early-stage

More than half of respondents, 53%, said they were exploring, testing, piloting or deploying AI agents. Only 14% had reached deployment stage, suggesting that interest is broad but operational use remains comparatively limited.

The DFSA said it welcomes early dialogue on higher-impact or emerging use cases. Its survey findings will feed into supervision of material AI use, governance and third-party dependencies.

Firms should expect scrutiny to focus on the difference between experimentation and material deployment: whether the use case affects clients or controls, whether the firm can monitor it after launch, and whether its third-party and cloud arrangements support recovery if the system becomes unavailable or unreliable.