Artificial intelligence is changing how financial institutions assess credit, detect fraud, process insurance claims and engage with customers. But deploying AI successfully requires more than accurate models. It requires clear accountability, fair outcomes and effective oversight.
The Central Bank of the UAE’s guidance on the responsible adoption and use of artificial intelligence and machine learning puts accountability at the centre of this conversation. Its message is clear: financial institutions should be able to explain how they use AI, manage the risks it creates and protect consumers affected by its decisions.
For boards, risk leaders, compliance teams and CISOs, the practical question is no longer simply, “Where can we use AI?” It is, “Can we demonstrate that our AI is governed responsibly?”
What Is the CBUAE AI Governance Guidance?
The document’s formal title is the “Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.”
Published on 11 February 2026 and publicly announced by the CBUAE on 23 February 2026, it sets out principles for responsible AI adoption across licensed financial institutions within the Central Bank’s supervisory ecosystem. Consumer protection is a central focus.
An important distinction: the guidance is non-binding. It should not be presented as a standalone AI law or as a replacement for existing regulatory obligations. Nevertheless, it communicates clear regulatory expectations concerning AI governance, transparency, accountability and consumer protection
The following takeaways explain those expectations and translate them into practical implementation priorities.
1. AI Governance Is a Board-Level Responsibility
AI governance should not sit solely with data scientists, technology teams or external vendors.
The guidance places responsibility for AI oversight with boards and senior management. This builds on the UAE’s existing Enabling Technologies Guidelines, which state that governing bodies and senior management should remain accountable for the outcomes and decisions of their AI applications.
What this means in practice
A useful governance structure should establish:
- Who approves AI use cases and accepts the associated risks.
- Who owns each AI system and its business outcomes.
- Which decisions require escalation.
- What information reaches senior management and the board.
- Who can suspend an AI system when risks become unacceptable.
These are implementation measures rather than a prescribed organisational chart. The objective is to make responsibility visible and actionable—not simply to establish another committee.
2. An AI Inventory Is the Starting Point for Effective Oversight
An institution cannot govern AI it has not identified.
The CBUAE guidance calls for an inventory of AI models, systems and technologies, including third-party models. At a minimum, this should capture the model’s name, purpose and risk rating. Risk assessment should consider factors such as data sensitivity, system capability, potential impact, controls and the dependency the system creates.
What this means in practice
Use the inventory as a working governance tool, not a static spreadsheet. For each use case, consider recording:
- Business purpose and accountable owner.
- Whether the system is internally developed or vendor-provided.
- Data categories used.
- Whether outputs affect consumers.
- Risk classification and approval status.
- Testing history and monitoring arrangements.
- Human oversight and suspension mechanisms.
These additional fields are practical implementation suggestions. They help connect AI discovery with risk assessment, approval and ongoing assurance.
3. Consumer Protection Should Shape AI Controls
The guidance is not only about model performance. It is also about what AI decisions mean for the people affected by them.
Fairness, transparency, explainability and meaningful human oversight are recurring themes. These become particularly important where AI influences consequential outcomes, such as credit decisions or insurance claims.
What this means in practice
Assess the full customer journey—not just the model.
For example, when AI contributes to an adverse decision, the institution should examine whether the customer receives an understandable explanation, can raise concerns and has access to an effective review process.
A technically accurate model does not, by itself, demonstrate that the surrounding customer experience is fair or adequately governed.
4. Bias Testing Should Continue Throughout the AI Lifecycle
Fairness cannot be established through a one-time assessment at deployment.
The guidance addresses testing for bias annually and again when models are upgraded, materially changed or newly introduced. It also calls for ongoing monitoring and mechanisms to detect and address bias, performance problems and unintended consequences.
What this means in practice
Build fairness testing into the model lifecycle:
- Identify potentially affected consumer groups.
- Assess whether the data is appropriate for the intended use.
- Test relevant outcomes for unjustified disparities.
- Investigate and document findings.
- Implement remediation and retest.
- Monitor results after deployment.
The appropriate tests will depend on the use case. A credit assessment model and a customer-service assistant should not automatically receive the same evaluation approach.
5. Transparency Must Be Understandable to Consumers
Transparency is not achieved by publishing a technical description that customers cannot understand.
The guidance addresses clear disclosure of AI use and understandable explanations. It also calls for plain-language, accurate disclosures in both Arabic and English.
What this means in practice
Review customer-facing communications to determine whether they clearly explain:
- When the customer is interacting with AI.
- What role AI plays in the service or decision.
- How the customer can raise a concern or seek assistance.
Technical explainability and customer communication are related but different. Internal model documentation supports assurance; consumer-facing explanations should help people understand the outcome and their available options.
6. Human Oversight Must Be Meaningful
Human oversight should provide a genuine ability to intervene—not merely a person nominally assigned to review automated outputs.
The guidance calls for oversight proportionate to consumer risk and a clear, immediate human ability to cease AI use. It also addresses continuous monitoring and remediation when problems arise.
What this means in practice
Document the intervention process before deployment:
- Who can challenge or override an AI output?
- When is human review triggered?
- Does the reviewer have enough information to make an independent decision?
- Who can stop the system?
- What happens to customers and business operations when it stops?
Testing these arrangements is as important as documenting them. An escalation procedure offers limited protection if staff do not know how to use it.
7. Outsourcing AI Does Not Remove Institutional Responsibility
Using a vendor’s AI model does not eliminate the need for governance.
The CBUAE guidance addresses outsourced AI oversight and pre-deployment checks for third-party solutions. Its broader governance approach requires institutions to retain meaningful control over AI-related risks rather than treating vendor assurances as sufficient evidence.
What this means in practice
Translate third-party AI risk into procurement and assurance questions:
- Can the provider explain the system’s intended use and limitations?
- What evidence supports its performance and fairness claims?
- How are customer data and confidential information handled?
- How are model changes communicated?
- Can the institution investigate incidents and obtain relevant records?
- Can the service be suspended or replaced without unacceptable disruption?
These questions help identify whether the institution can govern the service throughout its lifecycle—not just approve it at procurement.
8. Security, Privacy and Resilience Belong in AI Design
AI governance is not separate from cybersecurity or operational resilience.
The guidance calls for security and privacy by design, stress testing, validation and safeguards against unauthorised access or misuse. It also connects AI oversight with incident response and operational resilience.
What this means in practice
Bring security, privacy, technology and business owners into the approval process early. Assess:
- What data the AI system can access.
- How that data is protected.
- How the system could be misused.
- How failures or degraded performance would be detected.
- What fallback arrangements exist.
- How incidents would be contained and investigated.
The aim is to make AI risks part of established enterprise control processes while addressing the characteristics of each system.
9. AI Assurance Should Continue After Deployment
Pre-deployment testing provides evidence about a system at a particular point in time. It does not establish that the system will remain suitable indefinitely.
The guidance calls for continuous monitoring and regular reporting of AI performance and risks to senior management and the board. The existing Enabling Technologies Guidelines similarly address periodic reviews of reliability, fairness, accuracy and relevance after deployment.
What this means in practice
Define monitoring thresholds and escalation routes before go-live. Useful measures may include:
- Performance against approved objectives.
- Fairness test results and unresolved findings.
- Consumer complaints associated with AI.
- Human overrides and escalations.
- Significant vendor or model changes.
- Incidents and remediation status.
Select metrics that support decisions. A dashboard should help management identify where intervention is needed, not simply count how many AI projects are running.
A Practical 90-Day CBUAE AI Governance Roadmap
The following roadmap is a suggested implementation approach, not a CBUAE-prescribed deadline.
| Period | Priority | Suggested deliverables |
|---|---|---|
| Days 1–30 | Establish visibility and ownership | Initial AI inventory, named owners, preliminary risk classification and gap assessment |
| Days 31–60 | Design proportionate controls | Approval criteria, testing plans, disclosure templates, oversight procedures and vendor review questions |
| Days 61–90 | Validate and operationalise | Priority-system assessments, intervention exercises, monitoring dashboards and a remediation plan |
Prioritise systems with greater potential consumer harm, sensitive data exposure or business dependency. This reflects the guidance’s emphasis on risk-proportionate governance and oversight.
Frequently Asked Questions About CBUAE AI Governance
Is the CBUAE AI guidance a binding regulation?
The guidance is non-binding, but it communicates regulatory expectations for responsible AI use. Institutions should distinguish its recommendations from obligations under applicable laws, regulations and standards rather than treating every provision as a new standalone legal requirement.
Who does the guidance apply to?
It addresses licensed financial institutions within the CBUAE’s supervisory ecosystem. It should not be described as a universal AI governance law for every organisation operating in the UAE.
Does it address third-party AI systems?
Yes. The guidance addresses third-party models within AI inventories and oversight arrangements, as well as checks before deployment of third-party solutions.
How often should AI bias testing take place?
The guidance addresses annual bias testing, with further testing when models are upgraded, materially changed or newly introduced. Institutions should combine these assessments with ongoing monitoring rather than treating annual testing as the only control.
Final Perspective: Make Responsible AI Demonstrable
The most useful way to approach CBUAE AI governance is as an evidence-building exercise. Institutions need a clear view of where AI is used, who owns its risks, how consumer outcomes are evaluated and when people can intervene.
That approach connects responsible innovation with the guidance’s central priorities: consumer protection, transparency, fairness and accountable oversight.]