Operationalizing UAE Consumer AI in Modulos

Modulos has two Frameworks for the CBUAE Guidance Note on consumer protection and the responsible use of AI and ML. The two Frameworks have the name UAE Consumer AI:

• OFF-21 at the Organization level. Add OFF-21 to the organization AI System.
• MFF-21 at the AI System level. You add it to the AI System of each AI use in scope.

The Guidance Note gives advisory principles and guidelines. See The CBUAE Guidance Note.

Recommended AI System structure

For the CBUAE Guidance Note, Modulos recommends one organization AI System with OFF-21, and one AI System with MFF-21 for each AI use in scope. The Guidance Note does not set this structure.

To add the Frameworks:

1. Make the scope decision for the institution and its AI uses. See Scope decision.
2. Add OFF-21 at the Organization level to your organization AI System.
3. If an AI use in scope has no AI System in Modulos, add an AI System for that AI use.
4. Add MFF-21 at the AI System level to the AI System of each AI use in scope.

Organization AI Systems

OFF-21 attaches to the organization AI System. If your organization has none, contact Modulos before you add OFF-21.

Some provisions of the Guidance Note have Requirements at the two levels. See Requirement mapping.

Scope decision

For the CBUAE Guidance Note, your organization makes the scope decision. OFF-21 and MFF-21 have no scoping questionnaire, and their Requirements have no scope tags. Modulos recommends that you record the scope decision and its reasons in ORF-423. The Guidance Note does not recommend this record.

Examine these items at the start of the work:

• The institution. Examine the institution's licensing and supervision against Scope and AI uses.
• The AI uses. The Guidance Note focuses on uses of AI and ML that "may have bearing on consumers". It gives no materiality threshold for this scope. See Scope and AI uses.
• Third-party AI. Identify each AI use that relies on third-party vendors or cloud service providers for AI and ML (Section 9(a)). Section 9 recommends checks for this reliance, and some of these checks come before deployment. See Third-party AI.
• AI uses with consumers. Identify each AI use where a customer is "communicating or interacting with an AI application" (Section 4(a)). Also identify AI uses with consumer decisions "made or supported by AI" (Section 3(c)). This includes decisions that humans make (Section 7(a)(i)). Section 7(c) gives this recommendation: "Consumers should be able to request human review or explanation of AI generated decisions". See Consumer human review, complaints, and redress.
• Complaint duties. Examine the complaint duties before you make the scope decision.

If a Requirement does not apply to your organization or to an AI use, record the reasons in that Requirement. For the status of a Requirement, see Requirements.

Requirement mapping

For the CBUAE Guidance Note, the table gives each Requirement of OFF-21 (Organization level, ORF codes) and MFF-21 (AI System level, MRF codes). For each Requirement, the table gives the provisions that it refers to and where to find information on the law. A section number refers to the Guidance Note.

Requirement	Requirement name	Provisions	Information on the law
ORF-423	UAE Scope and AI Use Applicability	Introduction, Section 1, closing paragraph	Scope and AI uses, Definitions, The CBUAE Guidance Note
ORF-424	AI Governance and Accountability	2(a)–(f), 8(a)–(b)	Accountability and the governance framework, The AI/ML inventory and risk rating, AI and enterprise risk management
ORF-425	AI and ML Inventory and Risk Rating	2(f), 8(d), 9(c)	The AI/ML inventory and risk rating, Third-party AI
ORF-426	Consumer-Protection Impact Governance	Section 1 (high-impact decision), 3(c), 7(d), 8(a)–(b), 8(d)	Definitions, Fairness and non-discrimination, Consumer treatment and marketing, AI and enterprise risk management, The AI/ML inventory and risk rating
ORF-427	Fairness and Non-Discrimination Governance	3(a)–(c), 7(d)	Fairness and non-discrimination, Consumer treatment and marketing
ORF-428	Transparency and Explainability Governance	4(a)–(c)	Transparency and explainability
ORF-429	Human Oversight and Consumer Protection Governance	4(c), 6(f), 7(a)–(c)	Transparency and explainability, Human oversight, Incident response and remediation, Consumer human review, complaints, and redress
ORF-430	Data Quality, Privacy, and Security Governance	5(a)–(d)	Data governance and privacy, Data provenance and audit trails, Model validation and automatic updates, Incident response and remediation
ORF-431	Model Governance, Validation, and Independent Challenge	2(a), 5(d), 6(b), 8(c)	Accountability and the governance framework, Model validation and automatic updates, Monitoring of AI
ORF-432	Third-Party AI Governance	2(b), 6(e), 6(g), 9(a)–(d)	Accountability and the governance framework, Third-party AI, Monitoring of AI
ORF-433	Continuous Monitoring and Review of AI	6(a), 6(b), 6(d), 6(g)	Monitoring of AI, Incident response and remediation
ORF-434	Incident Response, Resilience, and Remediation Governance	5(d), 6(d)	Incident response and remediation
ORF-435	Consumer Human Review, Complaints, and Redress	7(c), and Article 8 of the Consumer Protection Regulation	Consumer human review, complaints, and redress, Article 8 complaint duties
ORF-436	Recordkeeping and Supervisory-Readiness Governance	2(f), 8(b), closing paragraph: indirect basis. The Guidance Note has no discrete recordkeeping clause.	The AI/ML inventory and risk rating, AI and enterprise risk management, The CBUAE Guidance Note
ORF-437	Proactive AI Use for Fraud and Financial-Crime Detection	5(e)	AI for fraud and financial-crime detection
ORF-438	Ethical AI Collaboration and Industry Engagement	Section 10	Industry collaboration
MRF-397	AI Use-Case Validation, Update Testing, and Risk Rating	5(d), 6(c), 8(d)	Model validation and automatic updates, The AI/ML inventory and risk rating
MRF-398	Data Governance, Privacy, Quality, and Lineage Execution	3(b), 5(a)–(d)	Fairness and non-discrimination, Data governance and privacy, Data provenance and audit trails
MRF-399	Fairness Testing and Bias-Mitigation Execution	3(a)–(c), 6(c)	Fairness and non-discrimination, Model validation and automatic updates
MRF-400	AI Explainability and Decision Disclosure	4(a)	Transparency and explainability
MRF-401	Human Oversight, Override, and Contestation	6(f), 7(a)–(c)	Incident response and remediation, Human oversight, Consumer human review, complaints, and redress
MRF-402	Data Provenance and Audit Trails	5(a)	Data provenance and audit trails
MRF-403	Monitoring, Drift, and Outcome-Review Execution	6(a)–(d)	Monitoring of AI, Model validation and automatic updates, Incident response and remediation
MRF-404	Incident Detection, Containment, Cease-Use, and Remediation Execution	5(d), 6(d), 6(f)	Incident response and remediation
MRF-405	Third-Party Model or Service Assurance Execution	6(e), 9(a)–(d)	Third-party AI, The AI/ML inventory and risk rating
MRF-406	Consumer Communication Support for AI-Assisted Consumer Interactions or Outcomes	4(a)–(c), 7(c)–(d), and Article 8 of the Consumer Protection Regulation	Transparency and explainability, Consumer human review, complaints, and redress, Consumer treatment and marketing, Article 8 complaint duties

Recommended work sequence

For the CBUAE Guidance Note, Modulos recommends the steps below, in this sequence. The Guidance Note does not give this sequence. Where a provision gives a time, for example before deployment or before implementation, the steps keep that time.

1. Make the scope decision. Do the work of ORF-423.
   • Identify the institution, the AI uses in scope, the third-party AI, and the AI uses with consumers. See Scope decision.
2. Add the Frameworks. See Recommended AI System structure.
3. Make the governance framework. In the organization AI System, do the work of ORF-424, ORF-425, ORF-426, and ORF-436.
   • Make senior management and the Board of Directors accountable for AI and ML (Section 2(b)). See Accountability and the governance framework.
   • Keep an inventory of all AI models, systems, and technologies. Include the models "developed or hosted by third parties" (Sections 2(f) and 9(c)).
   • Make "processes to rate the risk of each AI system/application/technology" that you deploy or use (Section 8(d)). See The AI/ML inventory and risk rating.
   • Make AI tools part of the enterprise-wide risk management framework (Section 8(a)).
   • Make sure that the policies and procedures for AI adoption "complement, rather than duplicate, existing regulatory obligations" (Section 8(b)). See AI and enterprise risk management.
4. Write the policies for each topic of the Guidance Note. Do the work of ORF-427 to ORF-431, ORF-433, ORF-434, and ORF-437.
   • For fairness, transparency, and human oversight, see Fairness and non-discrimination, Transparency and explainability, and Human oversight.
   • For data, model validation, monitoring, and incidents, see Data governance and privacy and the sections after it.
   • Plan how to apply the recommendations in Section 5(e) on the use of AI for fraud and financial-crime detection, and on material findings.
5. Check third-party AI before deployment. Do the work of ORF-432, and of MRF-405 for each AI use.
   • Do due diligence on the provider. Put the contract provisions of Section 9(a) into the contracts.
   • Complete the provider selection and pre-deployment checks and plan annual cybersecurity reviews (Section 9(b)).
   • Keep the responsibility for outsourced AI functions (Section 6(e)). See Third-party AI.
6. Prepare each AI use. In each AI System, do the work of MRF-397 to MRF-402, and MRF-404.
   • Rate the risk of the AI use (Section 8(d)).
   • Make robustness and safety part of the development. Section 5(d) recommends stress testing and validation, but it gives no time for them. See Model validation and automatic updates.
   • Make sure that the training data is "sufficiently accurate, relevant and representative" (Section 3(b)).
   • Do not deploy or use AI that is, or becomes after deployment, discriminatory or manipulative (Section 3(a)). See Fairness and non-discrimination.
   • Prepare the disclosures in Arabic and English. Examine the recommendation to "consider the provision of opt-out rights" (Section 4). See Transparency and explainability.
   • Select the human oversight model for the risks to consumers (Section 7(a) and 7(b)). See Human oversight.
   • Write policies for data with clear provenance and audit trails (Section 5(a)). See Data provenance and audit trails.
   • Before implementation, prepare mechanisms "to detect, report and remediate any performance issues, biases or unintended consequences" (Section 6(d)).
   • Keep "the clear and immediate ability, with human intervention, to cease use" at all times (Section 6(f)). See Incident response and remediation.
7. Prepare human review, complaints, and redress. Do the work of ORF-435, and of MRF-401 and MRF-406 for each AI use.
   • Plan how to apply the recommendations in Section 7(c) on human review, alternative arrangements, challenge rights, and complaint channels.
8. Monitor each AI use. Do the work of ORF-433, ORF-434, MRF-403, and MRF-404.
   • Monitor the AI continuously (Section 6(a)).
   • Test the AI for bias "once a year or each time a model is upgraded, materially changed or a new one is introduced" (Section 3(c)).
   • Test automatic updates before implementation (Section 6(c)).
   • Use the mechanisms of Section 6(d) "over time", not only before implementation.
   • Examine changes in data, market conditions, and customer behaviors. Update the AI and ML models or stop their use "where appropriate" (Section 6(b)).
   • Section 6(b) recommends periodic assessments by "Independent third-party providers of AI, independent experts and third parties".
   • Keep up to date with legal, third-party provider, and market developments (Section 6(g)). See Monitoring of AI.
9. Review collaboration and plan case-study publication. Do the work of ORF-438.
   • Section 10 encourages collaboration and recommends case-study publication independently of collaboration (Industry collaboration).
10. Review the Requirements. See Review Requirements.

Review Requirements

For the CBUAE Guidance Note, the Requirement Owner reviews completed work and makes the fulfillment decision for OFF-21 and MFF-21 Requirements. See Reviews and statuses.

Work not held in Modulos

When you use the CBUAE Guidance Note, examine other applicable law independently of OFF-21 and MFF-21. Requirement fulfillment in Modulos does not show compliance with the Guidance Note or with other law. Do the work below independently of the Review of each Requirement:

• Applicable law. The Guidance Note supplements applicable law and keeps licensed financial institutions responsible for compliance (The CBUAE Guidance Note).
• Complaint duties. The binding Article 8 duties of the Consumer Protection Regulation apply to LFIs in its scope independently of AI use and Requirement status.
• Model Management Standards. Licensed banks in the UAE apply the Model Management Standards and Model Management Guidance.
• Telemarketing. No Requirement of OFF-21 or MFF-21 refers to the Telemarketing Regulation (C 3/2026) or its Article 16. See Consumer treatment and marketing.
• Decisions. Your organization makes the scope decisions and the decisions about each AI use. A Requirement status does not replace these decisions.

For the Controls that are in OFF-21 or MFF-21 and also in other Frameworks, see Control overlap.

Related information

• UAE Consumer AI: the Guidance Note, its status, and the related instruments.
• Scope and governance, Fairness, transparency, and oversight, Data, models, monitoring, and remediation, and Consumer redress and third-party AI: the provisions of the Guidance Note.
• FAQ.
• Requirements and Reviews and statuses: Requirements, their status, and their Review.
• Governance operating model: how AI Systems, Requirements, Controls, and Evidence work together.

Sources

• Central Bank of the UAE (CBUAE), "Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.", issued 11 February 2026: the introduction, Sections 1 to 10, and the closing paragraphs.
• CBUAE, Consumer Protection Regulation, C 8/2020, applies from 25 December 2020: Scope of Application and Article 8.
• CBUAE, Model Management Standards: Section 2.1.1.
• CBUAE, Telemarketing Regulation, C 3/2026, applies from 31 March 2026: Scope of Application and Article 16.

Disclaimer

This page gives general information. It is not legal advice.