Docs

Appearance

Operationalize this framework in Modulos

Scope and Governance ​

The Central Bank of the UAE (CBUAE) issued the "Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E." (the Guidance Note). This page gives the scope of the Guidance Note, the definitions in its Section 1, and its governance recommendations in Sections 2, 8, and 10. The page UAE Consumer AI gives the date and the status of the Guidance Note.

Scope and AI uses ​

The CBUAE Guidance Note gives principles and guidelines for the use of AI systems and ML technologies by "licensed financial institutions, including insurance providers (LFIs), in the United Arab Emirates (the UAE)". The Guidance Note "is focused on areas that may have bearing on consumers". It has "the aim of promoting consumer protection and good market conduct by all LFIs in their use of AI/ML".

The Guidance Note applies to LFIs in the UAE. It gives no onshore or free-zone test and does not name a free zone. The page UAE Consumer AI in Modulos gives the steps to record a scope decision.

Federal Decree-Law No. (6) of 2025 has a rule for financial free zones. Article 2 gives this rule: the decree-law "shall not apply to the Financial Free Zones in the State and financial institutions regulated by the authorities of such zones". Article 1 of the decree-law gives the definition of Licensed Financial Institutions. These institutions include "a branch or subsidiary inside the State of a financial institution incorporated outside the State or in Financial Free Zones". The location of an institution alone does not show if the decree-law applies to it.

The Guidance Note does not give the effect of this decree-law rule on its own scope. These provisions do not resolve if the Guidance Note applies to institutions regulated by free-zone authorities. Examine the license and the supervisor of each institution.

The Guidance Note gives advisory principles. Its last paragraph preserves applicable law and the responsibility of LFIs for compliance (status of the Guidance Note).

Definitions ​

Section 1 of the CBUAE Guidance Note gives LFIs five definitions "For the purpose of this Guidance Note":

Artificial Intelligence (AI) means computer or machine-based systems or models that perform tasks or generate outputs normally requiring human intelligence, including learning, reasoning, understanding, and interacting and GenAI (as defined below) which may have varying levels of autonomy and/or the ability to learn from data and adapt.

GenAI means artificial intelligence models that can understand and generate human like text, audio and images by leveraging vast amounts of training data and deep learning techniques, including popular Large Language Models.

Machine Learning (ML) means a subset of AI that enables systems to learn, both as supervised and unsupervised learning, from data and improve performance without being explicitly programmed or instructed to do so.

High‑impact decision means any determination by an LFI using AI that materially affects a customer’s access to financial products or services, for example in respect of a potential loan application or insurance claim.

MMS means the Model Management Standards, as issued by the Central Bank of the UAE.

The high-impact decision definition is not a general test for high-risk AI. Sections 4(a) and 4(c) of the Guidance Note use the term in their recommendations on transparency and opt-out rights (Transparency and explainability).

The Guidance Note refers to the MMS in Sections 2(a), 2(f), 6(a), and 9(a). Section 9(a) adds the words "(to the extent applicable)". The section Model Management Standards for banks gives the scope of the MMS.

Section 1 does not give a definition of LFI. The first paragraph of the Guidance Note gives the short name "LFIs" (Scope and AI uses).

Accountability and the governance framework ​

Section 2 of the CBUAE Guidance Note gives governance recommendations to LFIs, to their senior management, and to their boards.

Governance framework (Section 2(a)). The Guidance Note recommends that LFIs "adopt a documented governance framework for AI and ML that is commensurate with the size, nature and complexity of their operations". Section 2(a) also gives these recommendations:

  • "A culture of responsible use of AI with an understanding of the risks of it should be promoted in LFIs."
  • The Guidance Note "should be read in conjunction with all relevant CBUAE regulations and standards".
  • "The governance, usage and validation of AI use in LFIs should follow the principles of the MMS."

Accountability (Section 2(b)). The Guidance Note recommends that senior management and the Board of Directors of LFIs are "responsible and accountable for AI and ML systems and outcomes, model selection/development, deployment, accountability, appropriate human resourcing and oversight and monitoring and management on an on-going basis". Section 2(b) also recommends that "LFIs should not employ AI models that they have no control over." This recommendation is about control of a model. Section 2(e) has a different recommendation: risk committees and control functions understand AI-driven processes.

Reports (Section 2(c)). The Guidance Note gives this recommendation: "Regular reporting should be required by and provided to Senior Management and Boards of LFIs, covering performance and risk."

Governance structures (Section 2(d)). The Guidance Note recommends that governance structures do these three things:

  • "facilitate informed decision‑making"
  • "enable the identification and mitigation of risks"
  • make sure that AI and ML systems and applications "are aligned with the institution’s risk appetite and legal obligations".

Section 2(d) also recommends that AI risks become part of the governance framework of the institution "in a cohesive and consolidated manner". This includes "specific adaptable roles and responsibilities for the Audit and Risk Committee, Risk Management, Internal Audit, and IT".

Challenge by control functions (Section 2(e)). The Guidance Note recommends that boards and senior management make sure that risk committees and control functions "understand AI‑driven processes and can challenge outcomes where appropriate". Section 2(e) gives compliance, internal audit, and risk management as examples of control functions. It also recommends that "the adoption, deployment and use of AI" is "an integral part of the Risk Management framework".

Section 6(e) of the Guidance Note recommends that LFIs "remain responsible for outsourced AI functions" (Third-party AI).

The AI/ML inventory and risk rating ​

Section 2(f) of the CBUAE Guidance Note recommends that LFIs keep an inventory of "all AI models, systems or technologies developed or deployed". That inventory "should contain all material metadata, to include as a minimum model name, purpose, risk rating". Section 2(f) also recommends compliance measures and training "in all functions responsible for the use, management, and monitoring of the same". This inventory recommendation "should follow the CBUAE Model Management Standards and Model Management Guidance (2022)".

Section 9(c) recommends that institutions keep an inventory of AI models, "including those developed or hosted by third parties". Section 9(c) recommends that institutions "aim to ensure" the same fairness, explainability, and robustness standards for third-party and in-house models (Third-party AI).

Section 8(d) of the Guidance Note recommends that LFIs "create processes to rate the risk of each AI system/application/technology they deploy or use". The purpose of the rating is "to enable appropriate risk assessment, monitoring and management of the AI whilst deployed in use and developing". Section 8(d) gives these factors, which "may" have an effect on the rating:

  • "data quality and sensitivity"
  • "capability of the AI"
  • "controls in place"
  • "impact of the AI"
  • "dependence on the AI and/or third parties in the use of the AI".

The Guidance Note does not give a score, a scale, fixed dimensions, risk bands, or a threshold for the rating.

AI and enterprise risk management ​

Section 8 of the CBUAE Guidance Note connects AI to the risk management of an LFI.

Section 8(a) recommends that "AI tools should be integrated in the enterprise-wide risk management framework of any LFI that is utilising AI." This "will ensure effectiveness of AI management for the purpose of Consumer Protection and for the purpose of other decisions taken by LFI". Section 8(a) also recommends that "AI risk assessments should not operate in isolation but should inform and be informed by the institution’s overall risk appetite and controls."

Section 8(b) gives a recommendation to senior management: "Senior management should ensure that policies and procedures for AI adoption complement, rather than duplicate, existing regulatory obligations under the Consumer Protection Regulation and other CBUAE directives." Section 8(b) then gives an example: "For example, consumer risk arising from AI-driven models should be treated as part of the conduct risk framework, with appropriate reporting to the board and regulators."

Two other sections of the Guidance Note are about the treatment of consumers:

The Guidance Note does not recommend an approval step of its own for each AI use that has an effect on consumers. Section 3(a) recommends this: "No AI system or application should be deployed or used if it is discriminatory or manipulative or develops as such post-deployment." The page Fairness, Transparency, and Oversight gives Section 3.

Model Management Standards for banks ​

The CBUAE Model Management Standards (MMS) and Model Management Guidance (MMG) have their own scope. MMS Section 2.1.1 gives the scope: the MMS and the MMG "apply to all licensed banks in the UAE". It adds: "This scope covers Islamic institutions." MMG Section 1.4.1 gives the same scope for the MMG, and MMG Section 1.4.2 refers to the MMS for more information.

MMS Section 2.1.3 gives this rule for UAE branches or subsidiaries of "foreign institutions": "At a minimum, UAE branches or subsidiaries of foreign institutions must apply the MMS and the MMG." It adds: "Where certain elements of the requirements of the parent company’s regulator are more stringent, then these requirements should be implemented."

The Guidance Note addresses all LFIs, and these include insurance providers. Its references to the MMS do not extend the MMS scope in Section 2.1.1 to an LFI that is not a licensed bank. For such an LFI, the MMS references stay recommendations of the Guidance Note, for example to follow "the principles of the MMS" (Section 2(a)). For mandatory and recommended provisions (MMS 1.3.2) and "supervisory review" of deviations (MMG 1.1.2(ii)), see MMS and MMG status.

For banks in MMS scope, MMS Section 3.3.8 makes pre-implementation validation mandatory as part of model development.

For all LFIs, see the Guidance Note's testing recommendations (5(d)) and recommendations on AI reviews (6(b), 8(c)).

Industry collaboration and case studies ​

Section 10 of the CBUAE Guidance Note gives LFIs two recommendations with different strengths.

The first is an encouragement: "LFIs are encouraged to collaborate with industry peers (and participate in the UAE AI sandboxes and the Innovation Hub in relation to AI), academia, the CBUAE and other stakeholders to share best practices and to contribute to the development of industry standards for trustworthy AI."

The second is a "should": the Guidance Note recommends that LFIs publish case studies on "AI development, responsible use and its interaction with customer care and good market conduct". These case studies include "any relevant examples which may be provided anonymously". The publication recommendation applies also to an LFI that does not collaborate with others.

The last paragraph of the Guidance Note adds an encouragement: "LFIs are encouraged to stay informed of developments in AI technologies and to engage with the CBUAE where guidance or clarification is required."

Sources ​

  • Central Bank of the UAE, Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., issued 11 February 2026. CBUAE Rulebook. Provisions used: the first paragraph and Sections 1, 2, 3(a), 3(c), 4(a), and 4(c). Also Sections 5(d), 6(a), 6(b), 6(e), 7(d), 8, 9(a), 9(c), and 10, and the last paragraph.
  • Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business. CBUAE Rulebook. Provisions used: Article 1 (Financial Free Zones, Licensed Financial Institutions) and Article 2.
  • CBUAE, Model Management Standards. CBUAE Rulebook. Provisions used: Sections 1.3.2, 2.1.1, 2.1.3, and 3.3.8.
  • CBUAE, Model Management Guidance. CBUAE Rulebook. Provisions used: Sections 1.1.2(ii) and 1.4.1 to 1.4.2.

Disclaimer

This page gives general information. It is not legal advice.