Appearance
UAE Consumer AI
Guidance NoteCentral Bank of the UAE
Consumer protection and responsible use of AI and machine learning by licensed financial institutions
Key facts
Issuer
Central Bank of the UAE (CBUAE)
Instrument
Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.
Issued
11 February 2026
Type
Guidance Note with "broad principles and guidelines"
Relation to other law
It "shall supplement and not replace any laws, regulations or directives issued by the CBUAE or other competent authorities".
For
Licensed financial institutions (LFIs) in the UAE, including insurance providers
Structure
Introduction paragraphs, ten sections, and closing paragraphs
Modulos Frameworks
MFF-21 (AI System) and OFF-21 (Organization)
The CBUAE Guidance Note
The Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E. is from the Central Bank of the UAE (CBUAE). The CBUAE issued this Guidance Note on 11 February 2026. The Guidance Note is for licensed financial institutions (LFIs) in the UAE, and these LFIs include insurance providers. The Guidance Note gives principles and guidelines "with the aim of promoting consumer protection and good market conduct by all LFIs in their use of AI/ML".
The CBUAE Guidance Note calls its content "broad principles and guidelines" and "flexible principles to be used to guide and inform responsible AI/ML use over time". The introduction adds: "It is expected LFIs will refer to this Guidance as they develop their own internal policies and guidance".
Most provisions of the Guidance Note tell LFIs what they "should" do. Sections 3(a) and 6(b) tell LFIs what they "are expected to" do. Section 10 encourages collaboration and recommends case-study publication. The closing paragraph tells LFIs what they "are encouraged to" do.
The closing paragraph of the CBUAE Guidance Note gives its relation to other law: "This Guidance Note shall supplement and not replace any laws, regulations or directives issued by the CBUAE or other competent authorities, and LFIs remain responsible for complying with all applicable laws, regulations and requirements."
The CBUAE Guidance Note has introduction paragraphs, ten sections, and closing paragraphs. These are the ten sections:
| Section | Title |
|---|---|
| 1 | Definitions |
| 2 | Governance and Accountability |
| 3 | Fairness/Non-Discrimination and Ethics |
| 4 | Transparency and Explainability |
| 5 | Data Quality, Privacy and Security |
| 6 | Continuous Monitoring and Review |
| 7 | Human Oversight and Consumer Protection |
| 8 | Integration with Existing Frameworks |
| 9 | Outsourcing and Third-Party Risk |
| 10 | Ethical Collaboration and Innovation |
The introduction of the CBUAE Guidance Note recommends that the Guidance Note is read "in conjunction with the UAE Charter for the Development & Use of AI, published in July 2024, the UAE National Strategy for AI, and the Central Bank Guidelines for Financial Institutions adopting Enabling Technologies". The CBUAE Rulebook gives 15 November 2021 as the issue date of the Guidelines for Financial Institutions Adopting Enabling Technologies.
Scope and AI uses
The CBUAE Guidance Note is for UAE LFIs, "including insurance providers", and AI/ML uses with a possible effect on consumers. For the distinction from the decree-law's financial-free-zone rules, see Scope and AI uses.
Section 1 defines a high-impact decision as "any determination by an LFI using AI that materially affects a customer's access to financial products or services".
Status of related instruments
The CBUAE Guidance Note refers to the CBUAE instruments on consumer protection and model management. These instruments and Federal Decree-Law No. (6) of 2025 each have their own legal status.
Consumer protection. The CBUAE Consumer Protection Regulation (C 8/2020) applies from 25 December 2020. The Consumer Protection Standards (N 1158/2021) "form part of the Consumer Protection Regulation", and their introduction tells LFIs that "These Standards are mandatory and enforceable in the same manner as the Regulation". Article 8 of the Regulation gives complaint duties to LFIs for their activities in the scope of the Regulation. These duties apply with or without the use of AI. For these duties, see Complaint duties in Article 8.
Model management. Section 1.3.2 of the CBUAE Model Management Standards (MMS) tells institutions that requirements "associated with 'must' are mandatory", and that requirements "associated with 'should' are strongly recommended". Section 1.1.2(ii) of the Model Management Guidance (MMG) tells institutions that the MMG "neither constitutes additional legislation or regulation nor replaces or supersedes any legal or regulatory requirements or statutory obligations". The same provision adds that "deviations from the MMG should be clearly justified and will be subject to CBUAE supervisory review". The MMS and MMG apply to licensed UAE banks (MMS 2.1.1): see Model Management Standards for banks.
Federal Decree-Law No. (6) of 2025. The CBUAE Rulebook gives 16 September 2025 as the date from which Federal Decree-Law No. (6) of 2025 applies. Article 185 of the decree-law repeals Decretal Federal Law No (14) of 2018 and Decretal Federal Law No (48) of 2023. Article 183 keeps these items from the two earlier laws until replacements are issued:
- Article 183(1): the current "regulations, decisions, standards, guidelines, and circulars" issued in accordance with the two earlier laws "shall remain in force".
- Article 183(2): the definitions and technical terms in these instruments "shall remain with the same meaning and interpretation".
The CBUAE issued the Consumer Protection Regulation and its Standards with its powers in Article (121) of Decretal Federal Law No. 14 of 2018.
Article 184 of Federal Decree-Law No. (6) of 2025 tells "All agencies and Persons subject to the provisions of this decree-law" to "reconcile their respective positions with its provisions, within a period of one (1) year from the date of entry into force of this decree-law". The same article adds: "The Board of Directors may extend this period of time, as it deems appropriate." The decree-law defines the Board of Directors as the Board of Directors of the Central Bank.
Read by topic
Each page in this table gives the CBUAE Guidance Note provisions for its topics:
| Page | Provisions | Topics |
|---|---|---|
| Scope and governance | Introduction, Sections 1, 2, 8(a), 8(b), 8(d), and 10 | Scope, definitions, governance and accountability, the AI inventory, risk rating, enterprise risk management, the MMS for banks, and collaboration |
| Fairness, transparency, and oversight | Sections 2(f) (SHAP explanation tool), 3, 4, 7(a), and 7(b), with links for 6(c), 6(f), 7(c), and 7(d) | Fairness, bias tests, disclosures, opt-out rights, and the three human oversight models |
| Data, models, monitoring, and remediation | Sections 5, 6(a) to 6(d), 6(f), 6(g), and 8(c) | Data quality, privacy, provenance and audit trails, validation, automatic updates, continuous monitoring, incident response, human intervention to stop AI use, and fraud and financial-crime detection |
| Consumer redress and third-party AI | Sections 6(e), 7(c), 7(d), and 9, and Article 8 of the Consumer Protection Regulation | Human review, complaints, redress, the Article 8 complaint duties, third-party AI, consumer treatment and marketing, and the Telemarketing Regulation |
| Operationalizing in Modulos | All | The two Frameworks, the scope decision, the Requirement table, and the recommended steps |
UAE Consumer AI in Modulos
Modulos has two Frameworks with the name "UAE Consumer AI" for the CBUAE Guidance Note. OFF-21 is for the organization AI System, and MFF-21 is for each AI System in the scope of the Guidance Note. Modulos recommends this sequence of work: scope and third-party AI first, then Organization governance, then each AI System, then continuous monitoring and remediation. For the steps, see Recommended work sequence.
The two Frameworks do not include all applicable law, and Requirement fulfillment in Modulos does not prove legal compliance. For this work, see work that the Frameworks do not include. For the Controls that other Frameworks share, see Control overlap.
UAE Consumer AI FAQ
LFIs and their advisers can find short answers about the CBUAE Guidance Note in the UAE Consumer AI FAQ.
Sources
The CBUAE Rulebook has these sources:
- CBUAE, Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., issued 11 February 2026. Parts used: the introduction, Section 1 (High-impact decision), the section titles, Sections 3(a), 6(b), and 10, and the closing paragraphs.
- CBUAE, Consumer Protection Regulation, C 8/2020, applies from 25 December 2020. Parts used: the introduction, the section "Scope of Application", and Article 8.
- CBUAE, Consumer Protection Standards, N 1158/2021. Part used: the introduction.
- CBUAE, Model Management Standards. Parts used: Sections 1.3.2 and 2.1.1.
- CBUAE, Model Management Guidance. Part used: Section 1.1.2(ii).
- Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business, applies from 16 September 2025. Articles used: 1, 2, 183, 184, and 185.
- CBUAE, SCA, DFSA, and FSRA, Guidelines for Financial Institutions Adopting Enabling Technologies, issued 15 November 2021.
Disclaimer
This page gives general information. It is not legal advice.