Docs

Appearance

Operationalize this framework in Modulos

Data, Models, Monitoring, and Remediation ​

The CBUAE AI Guidance Note gives recommendations to licensed financial institutions (LFIs) about AI and ML data, validation, monitoring, and remediation. These recommendations are in Sections 5 and 6, with related points in Sections 3, 8, and 9. The Guidance Note gives advisory principles and supplements applicable laws (The CBUAE Guidance Note).

Data governance and privacy ​

Section 5 of the CBUAE Guidance Note gives these recommendations to LFIs about the data that AI and ML models use:

  • Quality and applicable law (Section 5(b)) — LFIs make sure that the data in AI and ML models "is of sufficient quality and relevance and is updated as necessary". The data complies with "all relevant standards, laws and regulations including, where applicable, the UAE Personal Data Protection Law and the UAE Information Assurance Regulation".
  • Personal data (Section 5(c)) — personal data is collected, stored, and used "in compliance with applicable laws and regulations, including the Consumer Protection Standards and rules on data being retained in the country". Personal data is collected, stored, and used only for purposes that are "legitimate and proportionate". For outsourcing, Section 5(c) refers LFIs to Section 9 (Third-party AI).
  • Privacy-by-design and security-by-design (Section 5(d)) — LFIs include privacy-by-design and security-by-design principles in AI systems. LFIs also "maintain safeguards to protect data from unauthorised access or misuse".

The Guidance Note names the UAE Personal Data Protection Law and the UAE Information Assurance Regulation with the qualifier "where applicable". For the obligations of the UAE Personal Data Protection Law, see UAE PDPL.

For the data that trains AI and ML models, Section 3(b) recommends data that is "sufficiently accurate, relevant and representative of the customer populations to which the models will be applied" (Fairness and non-discrimination).

Data provenance and audit trails ​

Section 5(a) of the CBUAE Guidance Note recommends that LFIs "establish policies to ensure AI and ML models use accurate, relevant, and up-to-date data, with clear provenance and audit trails". Section 5(a) is a recommendation about data policies. It does not tell LFIs to record each decision, to keep tamper-evident records, or to reconstruct each AI outcome. No section of the Guidance Note is about recordkeeping in general.

Two other provisions of the Guidance Note are related:

  • Section 2(f) recommends an inventory of all AI models, systems, or technologies that are developed or deployed, with "all material metadata" (The AI/ML inventory and risk rating).
  • Section 8(b) gives an example for senior management: consumer risk from AI-driven models is treated as part of the conduct risk framework, "with appropriate reporting to the board and regulators" (AI and enterprise risk management).

Model validation and automatic updates ​

The CBUAE Guidance Note gives LFIs different testing recommendations in different sections. No single time or condition applies to all AI tests.

Section 5(d) gives the general recommendation for robustness and validation:

Robustness and safety should be integral to AI development. AI should be subject to stress testing and validation to ensure they operate reliably under a range of scenarios and do not produce unsafe or unintended outputs.

Section 5(d) gives no time for these tests. It does not set a pre-deployment test, or a new validation after each material change, for all AI.

Section 6(c) is about automatic updates of AI tools. Section 6(c) recommends all of these conditions:

  • LFIs make sure that the automatic updates of their AI tools are "tested before implementation".
  • LFIs are "fully aware of such updates".
  • The updates do not "result in bias in the model output".

The Guidance Note also gives these testing recommendations:

ProvisionTestWhen the test applies
Section 3(c)Periodic tests to identify and remediate "undue/unintended embedded biases or discriminatory outcomes" (Fairness and non-discrimination)"once a year or each time a model is upgraded, materially changed or a new one is introduced"
Section 9(b)"pre-deployment tests and checks" for the AI of a third-party AI provider (Third-party AI)Before deployment at the LFI

Section 8(d) recommends that LFIs "create processes to rate the risk of each AI system/application/technology they deploy or use". The factors in Section 8(d) "may" influence the rating, and the Guidance Note gives no score or risk bands (The AI/ML inventory and risk rating).

Validation in the Model Management Standards ​

The CBUAE Model Management Standards (MMS) apply to licensed UAE banks (MMS 2.1.1, bank scope). MMS 3.3.8 gives this rule: "The pre-implementation validation must be considered an integral part of the development process." In MMS 3.3.8, "The depth of the pre-implementation validation should be defined based on model materiality."

The MMS validation rule is different from the testing times and conditions of the Guidance Note. For the status of each MMS provision, see MMS and MMG status.

Continuous monitoring ​

Section 6 of the CBUAE Guidance Note gives these recommendations to LFIs about AI monitoring:

  • Continuous monitoring (Section 6(a)) — "In accordance with the MMS, AI should be subject to continuous monitoring to ensure ongoing understanding, reliability, relevance and alignment with consumer protection objectives."
  • Review, update, or stop (Section 6(b)) — the Guidance Note expects LFIs "to consistently monitor and review and, where appropriate, update or cease using AI and ML models". LFIs do this "taking into account changes in data, market conditions and customer behaviors".
  • Third parties and experts (Section 6(b)) — three groups "should be engaged periodically to assess the development of and use of AI including third-party AI providers". The three groups are "Independent third-party providers of AI, independent experts and third parties (willing to challenge and question the use of AI in an LFI)".
  • Developments (Section 6(g)) — LFIs have "systems in place to keep up to date with legal, third-party provider and market developments with respect to the use of AI". This recommendation is about the information that the LFI has. It does not tell LFIs to update each AI system after each development. A decision to update or stop the use of a model follows Section 6(b).

For AI that an LFI develops internally, Section 8(c) recommends that the LFI "consider the use of third-party independent reviews to check suitability, security and reliability". This is a recommendation to "consider the use of third-party independent reviews". It is different from Section 6(b), in which three groups are "engaged periodically to assess" AI.

Incident response and remediation ​

Sections 5(d) and 6 of the CBUAE Guidance Note give these recommendations to LFIs about issues with AI and their remediation:

  • Detection, reports, and remediation (Section 6(d)) — "Mechanisms should be in place to detect, report and remediate any performance issues, biases or unintended consequences that may arise from any AI tool or model before implementation and over time."
  • Operational resilience (Section 5(d)) — "Institutions should incorporate operational resilience measures—such as redundancy, contingency planning and incident response—to minimise disruption or harm to consumers from system failures or cyber-attacks." The three measures are examples.
  • Human intervention to stop the use of AI (Section 6(f)) — "LFIs should at all times retain the clear and immediate ability, with human intervention, to cease use of an AI model system, technology or application deployed or utilized."

The Guidance Note gives no escalation thresholds and no time limit to report an issue. It also gives no single response, for example a rollback, for all issues. Other applicable laws and regulations continue to apply, because the Guidance Note supplements them and does not replace them (The CBUAE Guidance Note).

AI for fraud and financial-crime detection ​

Section 5(e) of the CBUAE Guidance Note gives LFIs these recommendations about AI for fraud and financial-crime detection:

  • What LFIs do — LFIs "assess" the use of AI for this purpose, and "try to utilise" AI "where feasible". It is a recommendation to try. It does not make the use of AI a duty each time that the use is "feasible".
  • What AI identifies — "potential fraud or criminal activity", "anti-money laundering disparities or issues", and "potential suspicious activity". AI identifies them "through trends and patterns".
  • Material findings — "in the event material findings are identified", LFIs "comply with their legal, regulatory and reporting requirements". This part includes all three types of requirement.
  • Section 6(e) of the CBUAE Guidance Note recommends that LFIs "remain responsible for outsourced AI functions". For outsourced AI and third-party AI providers, see Third-party AI.
  • Article 8 of the Consumer Protection Regulation gives binding complaint duties to the LFIs and activities that the Regulation covers. These duties apply independently of the use of AI. See the Article 8 section and the section on consumer human review in Consumer redress and third-party AI.
  • For the Modulos Requirements that apply to Sections 5 and 6, see Requirement mapping.

Sources ​

Disclaimer

This page gives general information. It is not legal advice.