Docs

Appearance

Operationalize this framework in Modulos

Consumer Redress and Third-Party AI ​

Sections 6, 7, and 9 of the CBUAE Guidance Note give recommendations on human review, complaints, third-party AI, and the treatment of consumers. The Central Bank of the UAE (CBUAE) issued the Guidance Note on 11 February 2026 for licensed financial institutions (LFIs) in the UAE. In the Guidance Note, LFIs include insurance providers: see Scope and AI uses. The Guidance Note gives advisory principles and does not replace applicable laws, regulations, or directives: see The CBUAE Guidance Note. Article 8 of the CBUAE Consumer Protection Regulation is a different instrument, with its own complaint duties.

Consumer human review, complaints, and redress ​

Section 7(c) of the CBUAE Guidance Note gives these recommendations about consumers and AI decisions:

  • Human review or explanation. "Consumers should be able to request human review or explanation of AI generated decisions".
  • Alternative arrangements. "alternative arrangements should be available where a customer does not wish to be subject to an AI decision."
  • Complaint channels. "LFIs should maintain clear and accessible channels for complaints and redress in line with Article 8 of the Consumer Protection Regulation."
  • Information to consumers. "Consumers should be informed of their right to challenge decisions, correct inaccurate data inputs having impact on AI and the process to challenge data and decisions by AI."
  • Complaints procedure. "A clear complaints-handling procedure/policy should be created, provided and accessible by customers on a regular basis."
  • Complaint handling. "Complaints should be addressed in person, efficiently, confidentially and in as short at time as is reasonable in the circumstances."

Section 7(c) does not limit these recommendations to high-impact decisions or to decisions with a material effect on consumers. Section 7(c) gives no number of days for a response to a complaint. Article 8.1.2.5 of the Consumer Protection Regulation refers to the time frames that the Central Bank prescribes: see Complaint duties in Article 8.

Section 4(c) of the Guidance Note is a different recommendation: LFIs "should consider the provision of opt-out rights", "particularly for High-impact decisions". See Transparency and explainability.

Complaint duties in Article 8 ​

Article 8 of the CBUAE Consumer Protection Regulation (C 8/2020) gives complaint duties to Licensed Financial Institutions. The Regulation applies from 25 December 2020. The Article 8 duties apply also when an institution does not use AI. The Guidance Note does not replace them, and a scope decision in Modulos does not change them.

The Regulation and its Standards apply to all Licensed Financial Institutions licensed by the Central Bank "in relation to their activities specified in Article 65 of the Decretal Law No. 14 of 2018 Regarding the Central Bank & Organization of Licensed Financial Institutions and Activities in provision of Financial Products and/or Services to Consumers that are Natural Persons and Sole Proprietorships" (Scope of Application). Federal Decree-Law No. (6) of 2025 repeals the 2018 law (Article 185) but keeps its instruments "in force" until replacement (Article 183). See Status of related instruments. The Consumer Protection Standards are "mandatory and enforceable in the same manner as the Regulation": see Status of related instruments.

The Consumer Protection Standards set a written acknowledgment "within 2 complete business days" (8.1.2.5, 8.1.3.6). They set the final response in writing "Within 30 complete business days of receiving a Complaint, or such other time limit as may be prescribed by the Central Bank" (8.1.3.7).

Article 8 of the Consumer Protection Regulation has these rules:

ProvisionRule
8.1.1Licensed Financial Institutions "must be transparent with Consumers and operate in a fair, honest and competitive manner." They "must have in place a fair, accessible and transparent process provided without charge for addressing Complaints with Consumers and that are resolved in a timely manner."
8.1.2.1"A Licensed Financial Institution must establish an independent Complaint management function in the organisation that directly reports to the Senior Management." The function "must be empowered to effectively resolve Complaints and independent of other business operations."
8.1.2.2"Licensed Financial Institutions must have an efficient and effective Complaint management system with supporting policies and procedures." The system "must enable Consumers to make Complaints easily and free of cost."
8.1.2.3"Licensed Financial Institutions must ensure Consumers are aware of their rights and responsibilities when seeking to resolve their problems or Complaints."
8.1.2.4The Licensed Financial Institution "is responsible for accepting and addressing all Complaints involving the activities of Authorized Agents as well as any product and/or service sold, marketed or advertised by the agent on behalf of the Licensed Financial Institution."
8.1.2.5"Licensed Financial Institutions must ensure compliance with all time frames prescribed by the Central Bank including turnaround time for acknowledgments and provided written responses to Complaints". The written responses "must provide the Consumer an explanation in writing of any delay or any inability of having a resolution to the Complaint or Error."
8.1.2.6"Licensed Financial Institutions must ensure their Authorized Agents provide a credible and unbiased process for Complaint resolution in accordance with this Regulation and Standards and the Licensed Financial Institution's policy and procedures."
8.1.2.7"Licensed Financial Institutions must train their staff and Authorized Agents in identification and handling of Complaints."
8.1.2.8"Consumers must be informed of the Licensed Financial Institution's process for the management of Complaints as well as recourse to a Complaint resolution mechanism to ensure fairness, transparency and neutrality in resolving Complaints."
8.1.2.9"The Central Bank will supervise the effectiveness and efficiency of the financial Complaint resolution mechanism."
8.2.2.1"Licensed Financial Institutions must utilise the Data collected to conduct analysis and assess key risks and trends arising out of the Data." The institution uses the results "for conducting investigations into thematic trends, conducting root cause analysis of repeat issues and for designing new controls to address issues and improving quality and efficiency of various aspects of Consumer service". It "must document any actions taken for review by the Central Bank."
8.2.2.2"The Complaints Data must be provided on a quarterly basis to the Senior Management of the Licensed Financial Institution to enable managerial level monitoring of trends and supportive decision-making."
8.2.2.3"Licensed Financial Institutions must ensure that the Data collected and reported to the Senior Management and to the regulator as required, is accurate, timely and complies with the Licensed Financial Institution's data governance policies and procedures."

Third-party AI ​

Sections 6(e) and 9 of the CBUAE Guidance Note give LFIs recommendations about AI from third parties. These sections set no materiality threshold.

Responsibility for outsourced AI, Section 6(e). Section 6(e) gives this recommendation: "LFIs should remain responsible for outsourced AI functions and should consider:"

  • "appropriate contractual rights with respect to audit and information rights from providers"
  • "be made aware of any material developments with the AI provider"
  • "appropriate termination/cease provisions"
  • "data protection"
  • "cyber security"
  • "performance guarantees"
  • "its compliance with laws/regulations and standards"
  • "any material developments with regard to the AI being outsourced/utilized".

Due diligence and contracts, Section 9(a). Section 9(a) applies "where LFIs rely on third‑party vendors or cloud service providers for AI and ML models, products or solutions". Section 9(a) gives these two recommendations to these LFIs:

  • Due diligence "should be conducted on the provider’s reputation in the field of AI, governance, security and data‑protection practices."
  • "Contracts should include provisions that ensure access to relevant information, audit rights and compliance with CBUAE requirements."

Section 9(a) gives these recommendations "In line with section 4.7 of the MMS and the Outsourcing Regulation for Banks (to the extent applicable)". For MMS Section 4.7, see the next paragraph.

Third-party providers in the Model Management Standards, Section 4.7. The CBUAE Model Management Standards (MMS) apply to licensed banks in the UAE (MMS 2.1.1, bank scope). MMS 4.7.1 to 4.7.4 give these rules to the institutions in the MMS scope:

  • Ownership, 4.7.1. Institutions "must remain the owners of their models at all times, under all circumstances." They "must remain accountable for all modelling choices, even in the case of support from a third party consultant for any of the steps in the life-cycle."
  • Knowledge from third parties, 4.7.2. "If modelling support is provided by a third party, institutions must take the necessary steps to transfer knowledge from that third party to internal employees within a given time frame."
  • Third-party contributions, 4.7.3. "Institutions must take the necessary action to fully understand the contributions provided by third parties."
  • Acquired methodology, 4.7.4. For "methodological support", institutions "must operate within the constraints of the acquired model" and "must demonstrate that the method is adequate to their portfolios." "If a methodology acquired from a third party is not fully understood by the institution, then it must not be considered fit for purpose." If a third party supplies a methodology, "any subsequent validation exercise must be performed by an internal or external party independent from the original provider."

The Guidance Note also applies to insurance providers, but Section 9(a) refers to MMS Section 4.7 only "to the extent applicable".

Provider selection and deployment, Section 9(b). Section 9(b) recommends that these items "should be appropriate and documented":

  • "The procurement, choice and justification for selection of a third-party AI provider"
  • the "deployment of their AI models/systems/technology at an LFI".

Section 9(b) also recommends that this "should include annual cybersecurity reviews by independent and suitably qualified third parties and pre-deployment tests and checks to ensure appropriateness and taking into accounts needs, risks and the options available."

Inventory and the same standards, Section 9(c). Section 9(c) gives this recommendation: "Institutions should maintain an inventory of AI models, including those developed or hosted by third parties, and aim to ensure that third-party models adhere to the same standards of fairness, explainability and robustness as in-house models." Section 9(c) makes the same standards a target ("aim to ensure"), not a guaranteed result. For the content of the AI inventory in Section 2(f), see The AI/ML inventory and risk rating.

More than one provider, Section 9(d). Section 9(d) gives this recommendation: "LFIs should consider and try to utilise a range of AI providers if feasible, to try to ensure there is no over reliance on one AI system or provider."

Section 6(g) of the Guidance Note recommends systems that keep LFIs up to date with legal, third-party provider, and market developments. For Section 6(g), see Data, Models, Monitoring, and Remediation.

Consumer treatment and marketing ​

Section 7(d) of the CBUAE Guidance Note gives LFIs these three recommendations on consumer treatment and marketing:

  • "The design and deployment of AI and ML systems should promote fair and equitable treatment."
  • "AI should not be used to target consumers with unsuitable products or to engage in pressure-selling or misleading marketing."
  • "Institutions should ensure that promotional materials and chatbots comply with disclosure requirements, all in line with the Consumer Protection Regulation’s emphasis on good disclosure."

Section 4 of the Guidance Note has the recommendations on transparency, Arabic and English disclosures, understandability, and opt-out rights: see Transparency and explainability.

Telemarketing Regulation. The CBUAE Telemarketing Regulation (C 3/2026) is a different regulation, which applies from 31 March 2026. It applies to Licensed Financial Institutions "specifically in the conduct of Telemarketing". It also applies "in cases where the Telemarketing function is outsourced".

Article 16 of the Telemarketing Regulation gives minimum requirements for a Licensed Financial Institution that uses "automated communication systems or artificial intelligence to conduct Telemarketing". Article 16.2 also gives this rule: "The use of artificial intelligence shall be subject to provisions of applicable laws and/ or Regulations." For the full text, see the Telemarketing Regulation.

  • Section 6(d) of the CBUAE Guidance Note recommends mechanisms "to detect, report and remediate" issues with AI. Section 6(f) recommends that LFIs "at all times retain the clear and immediate ability, with human intervention, to cease use" of AI. See Incident response and remediation.
  • In Modulos, UAE Consumer AI uses OFF-21 at the Organization level and MFF-21 at the AI System level, and it has no scoping questionnaire. See Scope decision.
  • For the Requirements that apply to Sections 6, 7, and 9 and to Article 8, see Requirement mapping.

Sources ​

Disclaimer

This page gives general information. It is not legal advice.