AI governance for UAE financial institutions: the CBUAE guidance note

The Central Bank of the UAE (CBUAE) issued its Guidance Note on Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in February 2026. It is the most specific statement of what a UAE financial regulator expects of AI governance onshore. This guide sets out what it asks for and how to do the work in practice.

Who it applies to

The note covers licensed financial institutions (LFIs) supervised by the CBUAE, including insurance providers. It is concerned with AI and machine learning that may affect consumers, which in a bank or insurer covers most customer-facing models, from credit scoring and underwriting to fraud detection, collections and chat assistants.

Firms licensed inside the Dubai International Financial Centre answer to the Dubai Financial Services Authority, and those in Abu Dhabi Global Market to the Financial Services Regulatory Authority. Inside the DIFC, personal data processed by AI systems also falls under DIFC Regulation 10.

The note supplements the CBUAE’s existing laws, regulations and directives rather than replacing them. It refers in particular to the Central Bank’s Model Management Standards, its Consumer Protection Regulation and the federal Personal Data Protection Law.

What the note expects

The expectations are grouped under a handful of themes.

Governance and accountability. Boards and senior management are accountable for AI outcomes. Boards should make sure risk committees and control functions understand AI-driven processes and can challenge their outcomes. Institutions should not use AI models they have no control over.

Risk rating. Institutions should set up processes to rate the risk of each AI system, application or technology they deploy, and fold AI into their existing risk frameworks rather than running it on the side.

Fairness. AI should be tested periodically for bias, at least annually or when a system changes materially, and biases found should be corrected.

Transparency and explainability. Institutions must tell customers when they are communicating with an AI application, in plain language. Institutions should explain clearly how AI systems operate and make decisions, and should consider offering customers a way to opt out.

Human oversight. Oversight should match the risk to the consumer, using human-in-the-loop, human-on-the-loop or human-out-of-the-loop models as appropriate. Customers should be able to ask for human review or an explanation of an AI-generated decision.

Complaints and redress. Institutions must keep clear and accessible complaint and redress channels, in line with the Consumer Protection Regulation.

Data. Models should use data with clear provenance and audit trails, built with privacy and security by design.

Model risk and monitoring. AI should be stress tested and validated so that it works reliably across scenarios, and monitored continuously under the Model Management Standards.

Third parties. Institutions should keep an inventory of AI models, including those developed or hosted by third parties. Contracts with providers should give access to relevant information and audit rights, institutions should avoid relying too heavily on a single provider, and the selection of third-party AI should be documented.

Turning the note into a working programme

The note says what good looks like. The work behind it comes down to six pieces.

1. An AI inventory that includes vendors. Start with every model and AI feature in use, including AI built into vendor platforms. Record the owner, the purpose, the customers it affects, the data it uses and who hosts it. Our guide to building an AI system register covers the fields and how to find AI nobody registered.
2. A risk rating per system. Rate each system on the harm it could do to consumers, how much it decides on its own and how material it is to the business. The rating decides how much testing, oversight and board attention it gets.
3. Bias testing on a schedule. For credit, pricing, underwriting and claims models, define the groups and fairness measures that matter for the decision, test before launch, and retest at least yearly and after material changes. The AI bias assessment guide sets out a method.
4. Oversight and review that customers can reach. Decide, per system, where a person reviews decisions and who can stop the system. Connect the customer’s request for human review or an explanation to someone with the authority to change the outcome, and record what happened. See human oversight of AI.
5. Vendor due diligence and contract terms. For each provider, record what you know about the model, the data it was trained on, its testing and its change process, and make sure contracts carry information and audit rights. Our vendor AI risk management guide covers the questions to ask.
6. Board reporting. Give the board and risk committee a regular view of the inventory, the highest-rated systems, test results, incidents and open findings, so they can challenge outcomes as the note expects.

How it fits with the rest of UAE law

The note sits on top of binding law. The federal Personal Data Protection Law applies to AI that processes personal data onshore, and its Article 18 gives people a right to object to automated decisions that seriously affect them. The national UAE AI Charter sets non-binding principles, such as human oversight, transparency and addressing algorithmic bias, that the note puts into banking terms.

Many institutions structure the work on an international standard so it can serve more than one regulator. ISO/IEC 42001 and the NIST AI RMF both cover the governance, risk and monitoring practices the note describes.

Where Aicura helps

Aicura is an AI governance platform. Its AI register holds the inventory, including vendor AI, its assessments rate and document each system’s risks, and its oversight, guardrails and monitoring features record where people review decisions and how each system behaves in production. Pro adds assessment against ISO/IEC 42001 and the NIST AI RMF. Aicura does not assess against the CBUAE note itself. It supports the work the note describes, and the judgements stay with your institution.

A note on this guide

This is Aicura’s reading of the CBUAE guidance note and published commentary on it. It is not legal or regulatory advice. Read the note in the CBUAE Rulebook and take advice on how it applies to your institution.