Frequently asked questions about the CBUAE AI Guidance Note

Each answer below is about the CBUAE Guidance Note on consumer protection and the responsible use of AI and ML. Each answer refers to the page with the full text.

Disclaimer

This page gives general information. It is not legal advice.

What is the CBUAE Guidance Note on AI and ML for licensed financial institutions?

The Central Bank of the UAE (CBUAE) issued the CBUAE Guidance Note on 11 February 2026. The Guidance Note is about consumer protection and the responsible use of AI and ML. It gives principles and guidelines to licensed financial institutions (LFIs) in the UAE, and these LFIs include insurance providers. It "is focused on areas that may have bearing on consumers".

The CBUAE Guidance Note has ten sections, from definitions to collaboration. The Guidance Note supplements the applicable laws, regulations, and directives, and does not replace them. See The CBUAE Guidance Note and Scope and AI uses.

Is the CBUAE AI guidance mandatory?

No. The CBUAE Guidance Note gives advisory principles to licensed financial institutions (LFIs), with recommendations, expectations, and encouragement. Its closing paragraph preserves all applicable laws, regulations, and requirements. Article 8 of the Consumer Protection Regulation gives complaint duties independently of AI use to institutions in its scope. The Model Management Standards distinguish mandatory and recommended provisions for licensed banks (Sections 1.3.2 and 2.1.1).

See the Guidance Note's status, Article 8 duties, and model-management status.

Does the CBUAE AI guidance apply to insurance companies, DIFC, or ADGM?

The CBUAE Guidance Note addresses "licensed financial institutions, including insurance providers (LFIs), in the United Arab Emirates" and focuses on AI uses with a possible bearing on consumers. It gives no onshore or free-zone test and does not name DIFC or ADGM.

Federal Decree-Law No. (6) of 2025 excludes financial free zones and institutions regulated by their authorities (Article 2). Its institution definition includes in-State branches and subsidiaries of free-zone institutions (Article 1). The Guidance Note does not give this rule's effect on its own scope. These provisions do not resolve if it applies to institutions regulated by free-zone authorities. Examine the institution's license and supervisor. See Scope and AI uses.

What is a high-impact decision under the CBUAE guidance?

Section 1 of the CBUAE Guidance Note defines a high-impact decision by a licensed financial institution (LFI) through its effect on financial access. It is "any determination by an LFI using AI that materially affects a customer's access to financial products or services". Examples include loan applications and insurance claims.

Sections 4(a) and 4(c) put emphasis on high-impact decisions, but also apply to other AI uses. Section 7(c) recommends human review, explanation, and alternatives for AI decisions in general. See Definitions, transparency and opt-out consideration, and human review.

What should the board and senior management do about AI?

The CBUAE Guidance Note recommends board and senior-management accountability for AI systems, outcomes, and ongoing management at licensed financial institutions (Section 2(b)). Section 2 also recommends governance "commensurate with the size, nature and complexity of their operations" (2(a)), and model control (2(b)). It recommends regular performance and risk reports (2(c)), and adaptable roles (2(d)). Boards and senior management also make sure that risk committees and control functions understand AI and "can challenge outcomes where appropriate" (2(e)). Senior management's policies complement existing obligations (8(b)), and institutions keep responsibility for outsourced AI (6(e)). See governance and accountability, risk management, and outsourced AI.

What should an AI inventory contain, including third-party models?

Section 2(f) of the CBUAE Guidance Note recommends that licensed financial institutions inventory all AI models, systems, and technologies developed or deployed. The inventory contains all material metadata, with a minimum of model name, purpose, and risk rating. Section 2(f) also recommends compliance measures and training across responsible functions in accordance with the Model Management Standards and Model Management Guidance.

Section 9(c) includes models developed or hosted by third parties and recommends aiming for in-house standards of fairness, explainability, and robustness. Parity is a target. See inventory content and third-party models.

Does CBUAE prescribe an AI risk score or fixed risk bands?

No. Section 8(d) of the CBUAE Guidance Note recommends risk-rating processes for each "AI system/application/technology" that licensed financial institutions deploy or use. It prescribes no score, scale, fixed dimensions, risk bands, or threshold. Its factors are permissive and include dependence on AI or third parties.

The rating does not set a formula for test or monitoring frequency. Section 3(c) gives testing triggers, while Section 7(b) scales human involvement to consumer risks. See risk-rating processes and factors, bias tests, and human involvement.

How often should AI bias testing take place?

Section 3(c) of the CBUAE Guidance Note recommends testing deployed AI "once a year or each time a model is upgraded, materially changed or a new one is introduced". The purpose of these tests is to identify and remediate "undue/unintended embedded biases" or discriminatory outcomes. Licensed financial institutions are expected to prevent discriminatory or manipulative outcomes (3(a)). The Guidance Note recommends no deployment or use of discriminatory or manipulative AI, also after deployment (3(a)).

It also recommends training data "sufficiently accurate, relevant and representative of the customer populations to which the models will be applied" (3(b)). Section 6(c) adds automatic-update testing, awareness, and output-bias conditions. See fairness and automatic updates.

Do AI disclosures need to be in Arabic and English?

The CBUAE Guidance Note recommends, rather than mandates, understandable, accurate, plain-language disclosures in Arabic and English, with "telephone support available in all major languages of the UAE" (4(b)). It recommends that licensed financial institutions "consider the use of appropriate measures to check understandability" (4(b)).

Section 4(a) recommends transparency to customers and "relevant stakeholders" about AI use, with emphasis on high-impact decisions. It also covers communication or interaction with AI, without a materiality threshold. Section 4(a) also recommends that institutions are clear about AI operations and decisions, and able to disclose this (4(a)). See Transparency and explainability.

Can customers opt out of AI decisions or ask for human review?

The CBUAE Guidance Note recommends that consumers be able to "request human review or explanation" of AI-generated decisions (7(c)). Section 7(c) also recommends alternative arrangements when a customer does not wish to be subject to an AI decision. Section 4(c) recommends consideration of opt-out rights. It does not give customers an opt-out right. Licensed financial institutions "consider the provision of opt-out rights", with emphasis on high-impact decisions, taking into account "the potential risks or impact to the customer, fairness and feasibility" (4(c)).

Human review and alternatives have no high-impact threshold (7(c)). Institutions also tell consumers about decision and data challenge rights and processes, and keep complaint channels aligned with Article 8 (7(c)). Article 8 duties apply independently of AI use. See human review and complaints and opt-out consideration.

What are the three human oversight models, and when can AI operate without a human?

The CBUAE Guidance Note names human-in-the-loop, human-on-the-loop, and human-out-of-the-loop models (7(a)). In human-in-the-loop, AI gives recommendations and a human decision maker "retains full authority to approve or reject the outcome" (7(a)(i)). In human-on-the-loop, AI works autonomously on "routine tasks" while a human monitors outcomes and can intervene where necessary (7(a)(ii)). In human-out-of-the-loop, AI operates "without direct human involvement". The Guidance Note recommends this last model only for "low-risk, non-material processes with appropriate controls in place" (7(a)(iii)).

Licensed financial institutions keep meaningful oversight across AI use, especially for "significant implications for consumers" (7(a)), and scale involvement to consumer risks (7(b)). They keep "the clear and immediate ability, with human intervention, to cease use" at all times (6(f)). See oversight models and human intervention to stop AI use.

Does the guidance require every AI model to pass a pre-deployment test?

No. Section 5(d) of the CBUAE Guidance Note recommends stress testing and validation without a universal pre-deployment or material-change condition. Other provisions give timing conditions for licensed financial institutions:

• Section 3(c) recommends annual or event-triggered bias tests.
• Section 6(c) recommends testing automatic updates before implementation, full awareness of updates, and no resulting output bias.
• Section 9(b) recommends third-party pre-deployment checks.
• Model Management Standards Section 3.3.8 makes pre-implementation validation part of development for licensed banks, with depth based on materiality.

See testing conditions and bank validation and third-party checks.

Do the Model Management Standards apply to every LFI, including insurers?

No. The CBUAE Model Management Standards (MMS) and Model Management Guidance (MMG) apply to licensed UAE banks, with Islamic institutions in scope (MMS 2.1.1). The AI Guidance Note's wider scope includes insurance providers, but does not widen MMS scope. Its MMS references stay recommendations for other licensed financial institutions (2(a), 9(a)).

MMS 2.1.3 addresses UAE branches or subsidiaries of "foreign institutions" and more stringent parent-regulator requirements. MMS 1.3.2 distinguishes mandatory and recommended provisions. MMG 1.1.2(ii) addresses justified deviations and "supervisory review". See bank scope and model-management status.

What does the guidance say about AI data privacy and audit trails?

Section 5(a) of the CBUAE Guidance Note recommends that licensed financial institutions write policies for "accurate, relevant, and up-to-date data, with clear provenance and audit trails". It prescribes no general decision-reconstruction or tamper-evident logging duty.

Section 5(b) recommends that data in AI models is "in compliance with all relevant standards, laws and regulations including, where applicable, the UAE Personal Data Protection Law and the UAE Information Assurance Regulation". Section 5(c) recommends that personal data is "collected, stored and used" only for "legitimate and proportionate" purposes and "in compliance with applicable laws and regulations, including the Consumer Protection Standards and rules on data being retained in the country". Section 5(d) recommends privacy-by-design, security-by-design, and safeguards against "unauthorised access or misuse". See data privacy and provenance and audit trails.

What should continuous AI monitoring cover?

Section 6(a) of the CBUAE Guidance Note recommends continuous AI monitoring for ongoing understanding, reliability, relevance, and consumer protection, in accordance with Model Management Standards. Licensed financial institutions are expected "to consistently monitor and review" and update or stop use "where appropriate" as data, markets, and customer behavior change (6(b)).

Section 6(b) also recommends periodic assessments of AI development and use, with third-party AI providers in scope. The assessors are "Independent third-party providers of AI, independent experts and third parties (willing to challenge and question the use of AI in an LFI)" (assessors). The Guidance Note also recommends automatic-update testing before implementation (6(c)), and issue detection, reporting, and remediation before implementation and "over time" (6(d)). Section 6(g) recommends systems to keep institutions informed of legal, provider, and market developments. See monitoring and assessors, updates, and remediation.

What should an LFI do about AI incidents and consumer harm?

Section 6(d) of the CBUAE Guidance Note recommends mechanisms for licensed financial institutions to "detect, report and remediate" AI performance issues, biases, and unintended consequences before implementation and "over time". Section 5(d) recommends resilience measures to "minimise disruption or harm to consumers" from failures or cyber-attacks. Its examples include redundancy, contingency planning, and incident response. Section 6(f) recommends "the clear and immediate ability, with human intervention, to cease use" of AI at all times.

The Guidance Note specifies no escalation threshold, numeric reporting deadline, or universal response such as rollback. Other applicable laws continue to apply. See Incident response and remediation.

Does the guidance require AI for fraud and financial-crime detection?

No. Section 5(e) of the CBUAE Guidance Note recommends that licensed financial institutions "assess and try to utilise, where feasible, AI". It does not mandate adoption each time it is "feasible". The detection targets are "potential fraud or criminal activity", anti-money laundering disparities or issues, and "potential suspicious activity" through trends and patterns.

When material findings occur, Section 5(e) recommends compliance with legal, regulatory, and reporting requirements, not only reporting duties. See AI for fraud and financial-crime detection.

Which AI complaints duties are legally binding?

Article 8 of the CBUAE Consumer Protection Regulation gives binding complaint duties independently of AI use. Its scope covers Central Bank-licensed financial institutions that supply financial products or services to natural persons and sole proprietorships. The covered activities are those specified in Article 65 of Decretal Law No. 14 of 2018 (Scope of Application). Federal Decree-Law No. (6) of 2025 repeals the 2018 law (Article 185) but keeps its instruments "in force" until replacement (Article 183). See Status of related instruments.

Article 8 covers free, "fair, accessible and transparent" complaint processes (8.1.1), "independent" complaint management, consumer information, agent responsibility, training, response time frames, recourse, and supervision (8.1.2.1–8.1.2.9). Article 8.1.2.5 also makes written explanations of "any delay or any inability" to resolve a complaint or error mandatory. Article 8 also covers complaint analysis and documented actions (8.2.2.1), management data "on a quarterly basis" (8.2.2.2), and accurate, timely reporting in compliance with data-governance policies (8.2.2.3).

Guidance Note Section 7(c) gives recommendations without a numeric deadline. The Consumer Protection Standards set a written acknowledgment "within 2 complete business days" (8.1.2.5, 8.1.3.6). They set the final response in writing "Within 30 complete business days of receiving a Complaint, or such other time limit as may be prescribed by the Central Bank" (8.1.3.7). See complaint time frames. Modulos scope decisions do not change Article 8. See the Article 8 table.

Does outsourcing AI transfer the LFI's responsibility?

No. Section 6(e) of the CBUAE Guidance Note recommends that licensed financial institutions keep responsibility for outsourced AI, without a materiality threshold. It recommends considering contract rights, material provider and AI developments, termination, data protection, cybersecurity, performance guarantees, and compliance (6(e)).

Section 9(a) recommends due diligence and contract provisions, with references to Model Management Standards (MMS) 4.7 and the Outsourcing Regulation for Banks "to the extent applicable". For licensed UAE banks, MMS 4.7.1 makes model ownership at all times mandatory. Banks stay accountable for all modeling choices, also with "support from a third party consultant". MMS 4.7 also addresses knowledge from third parties, understanding and suitability of acquired methods, and validation "independent from the original provider". See Third-party AI.

What checks does CBUAE recommend for third-party AI providers?

Section 9 of the CBUAE Guidance Note recommends that licensed financial institutions check third-party AI without a materiality threshold. Institutions do provider due diligence and include information access, audit rights, and compliance provisions in contracts (9(a)). The Model Management Standards and bank-outsourcing references apply "to the extent applicable" (9(a)).

Institutions document "appropriate" selection and deployment, with annual cybersecurity reviews by "independent and suitably qualified third parties" and pre-deployment checks (9(b)). They inventory third-party-developed or hosted models and "aim to ensure" in-house fairness, explainability, and robustness standards (9(c)). They "consider and try" provider diversity "if feasible" (9(d)). See Third-party AI and inventory content.

Are there separate rules for AI telemarketing?

Yes. The CBUAE Telemarketing Regulation (C 3/2026) applies from 31 March 2026, and it is a different regulation from the CBUAE Guidance Note. Its Article 16 gives minimum requirements for a Licensed Financial Institution that uses "automated communication systems or artificial intelligence to conduct Telemarketing". Other points:

• The Regulation applies to Licensed Financial Institutions "specifically in the conduct of Telemarketing", also when they outsource Telemarketing. It does not apply to all AI uses.
• Article 16.2 adds that the use of AI is "subject to provisions of applicable laws and/ or Regulations".
• No Requirement of OFF-21 or MFF-21 refers to the Telemarketing Regulation.

See Consumer treatment and marketing and the work that the Frameworks do not hold.

Are AI collaboration and case-study publication optional?

The CBUAE Guidance Note encourages collaboration and independently recommends case-study publication (Section 10). These are not mandatory duties of the Guidance Note. Licensed financial institutions are encouraged to collaborate with peers, academia, the CBUAE, and other stakeholders, also through UAE AI sandboxes and the Innovation Hub.

The publication recommendation applies independently of collaboration. It covers AI development, responsible use, "customer care and good market conduct". The "relevant examples" can be anonymous. See Industry collaboration and case studies.

How do I set up OFF-21 and MFF-21 in Modulos?

Add OFF-21 at the Organization level to your organization AI System. Add MFF-21 at the AI System level to the AI System of each AI use in scope. Other points:

• You cannot make a new organization AI System in Modulos. If you do not have one, contact Modulos before you add OFF-21.
• Modulos recommends this structure. The CBUAE Guidance Note does not set it.
• See the Requirement mapping for the provisions covered at each level.
• A Fulfilled Requirement in Modulos does not show legal compliance.

See Recommended AI System structure.

How do I decide applicability without a UAE Consumer AI questionnaire?

For the CBUAE Guidance Note, your organization decides scope. Modulos has no UAE Consumer AI scoping questionnaire or Requirement scope tags. Modulos recommends recording the decision and reasons in ORF-423.

Examine the institution and its license and supervisor for free-zone connections, and consumer-related AI uses (introduction). Identify third-party reliance at the start for pre-deployment checks (9(b)), consumer interactions (4(a)), and AI-generated decisions (7(c)). These recommendations have no materiality gate. Platform scope decisions do not remove Article 8 complaint duties. See Scope decision.

In what order should an LFI implement UAE Consumer AI in Modulos?

Modulos recommends that licensed financial institutions start with scope and third-party reliance, set up Organization governance, then prepare each AI use. The CBUAE Guidance Note does not prescribe this sequence.

The steps keep third-party checks before deployment (9(b)), automatic-update tests before implementation (6(c)), and issue mechanisms before implementation and "over time" (6(d)). They also keep annual and event-triggered bias tests (3(c)), human review and complaints (7(c)), and ongoing monitoring and reviews (6(b)). Collaboration follows Section 10. The sequence does not change other legal duties, for example Article 8 complaints. See Recommended work sequence.

Who reviews UAE Consumer AI Requirements in Modulos?

The Requirement Owner does the Review of each Requirement of OFF-21 and MFF-21. The Requirement Owner examines the completed work and decides if the Requirement is Fulfilled. A Fulfilled status does not show compliance with the CBUAE Guidance Note or with other law. See Review Requirements and Reviews and statuses.