Notice of Automated & Autonomous Systems Operations
This AI Transparency Notice is provided in accordance with Regulation 10 of the DIFC Data Protection Regulations (“DIFC DPR”) and applies to all autonomous and/or semi-autonomous Systems (referred to as “ Systems” or “System”) used by the Firm that involve the Processing of Personal Data.
This notice is intended to provide a comprehensive, true, and plain description of how Personal Data is Processed by AI Systems, the purposes of such Processing, the design principles governing those Systems, and the safeguards in place to ensure compliance with DIFC Data Protection Law (DIFC Law No. 5 of 2020) (“DIFC DPL”).
Capitalised terms used in this Notice have the meanings given to them under the DIFC DPL and the DIFC DPR.
The Processing of Personal Data by our AI Systems does not impact the exercise of your rights under the DIFC DPL. We have implemented appropriate measures to honour your rights. You may refer to Appendix 19 – Privacy Policy of our Compliance Manual for details of the rights available to you. Cambridge Associates does not use AI Systems for automated decision making.
Intended Purposes of the AI System
AI Systems we use do not autonomously determine why Personal Data is Processed. They function within the purposes determined by the Firm prior to the deployment and/or use of the relevant System.
The AI Systems we use Process Personal Data for the following human defined purposes, as applicable:
- supporting business operations and productivity (e.g. document analysis, summarisation, or workflow optimisation)
- conducting due diligence checks including identity verification
- analysing information to generate insights relevant to the organisation’s lawful activities
- automating or enhancing administrative, analytical, or decision‑support processes
- improving the quality, consistency, or efficiency of internal processes and services
- meeting legal, regulatory, governance, and risk‑management requirements
Defined Principles or Limits of the AI System
The AI Systems we operate have been developed by providers in accordance with industry standards and where possible, configured by us to ensure compliance with DIFC DPL and Regulation 10. Where we have not built the Systems, we apply strict governance and oversight to their use. Our AI Systems operate within fixed settings and defined limits, and the behaviour is designed to be consistent and predictable.
We ensure that the following principles are embedded into the AI Systems we use:
- AI Systems do not have authority to independently define, approve, or implement new or incompatible purposes for Processing Personal Data
- AI Systems do not automatically share Personal Data with any third parties or government authorities, upon their request
- Systems are not authorised to take decisions that produce legal effects or similarly significant impacts on individuals without appropriate human involvement
- AI Systems operate within an established governance framework that monitors misuse, bias, drift, or function creep
- AI Systems adhere to retention limits aligned with legal requirements, where possible
Output Produced by the Systems we Use
The Processing of your Personal Data by the AI Systems we use results in the following outputs:
- Summaries, transcripts, or structured representations of information
- Analytical insights, trends, or patterns derived from input data
- Classifications, recommendations, or decision‑support indicators
- Metadata generated to support analytics, quality control, or system performance
These outputs are used solely to support the human‑defined purposes described above. Outputs are reviewed, interpreted, and acted upon by trained personnel or integrated into business processes under human oversight. The outputs generated by the AI Systems we use do not result in legally binding or materially significant decisions without appropriate human involvement, review, or validation where required by law. In
AI System Design and Governance Principles
Any AI System developed and utilised within our products, services, or other use cases is designed and operated in accordance with the following AI principles of design, as required under the DIFC DPR:
- Ethical and Fair Use: Systems are designed to promote ethical outcomes and to treat individuals fairly. We take reasonable steps to identify and mitigate potential bias that could lead to unfair or discriminatory outcomes.
- Transparency: Where AI is used to Process Personal Data, we aim to ensure that such Processing is explainable in clear, non‑technical terms to data subjects.
- Security: Appropriate technical and organisational measures are in place to protect Personal Data processed by AI Systems and to prevent unauthorised access or a Personal Data Breaches.
- Accountability: We maintain oversight and governance measures to ensure responsibility for the development, deployment, and outcomes of our AI Systems.
Codes and Regulatory Standards
- Our AI Systems are designed, developed, selected, or operated having regard to applicable law and regulation.
Adherence to these frameworks is proportionate to the nature, context, and risks associated with each AI System.
We monitor updates to these frameworks and any additional codes or certifications designated by the DIFC Commissioner and adapt our governance accordingly.
Ongoing Review
This AI Transparency Notice is reviewed periodically and updated as necessary to reflect changes in AI Systems, regulatory expectations, or organisational practices.
You may contact the Firm at the contact details mentioned above/below for further information about the use of AI Systems and the Processing of Personal Data, or to exercise your rights under the DIFC DPL.
Cambridge Associates (DIFC) Limited
Level 15, The Gate Building
DIFC, Dubai, United Arab Emirates
+971 4 323 0800