UAE Central Bank AI guidance: what banks, insurers and fintechs must put in place

Country reference

• Country: United Arab Emirates
• Authority: Central Bank of the UAE (CBUAE)
• Topic: Consumer protection and responsible use of AI and machine learning
• Key date: Issued 23 February 2026; no compliance deadline stated
• Document: Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the UAE

Who it covers

• All licensed financial institutions supervised by the CBUAE: banks, finance companies, insurers, exchange houses and payment providers.
• Machine learning models and generative AI, including large language models.
• It adds to, and does not replace, the CBUAE Model Management Standards (2022), the Consumer Protection Regulation and outsourcing rules.

The five principles

• Governance and accountability: the board and senior management own AI outcomes. Keep a live inventory of AI models with a risk rating for each, and report regularly to the board on performance, bias, model drift, complaints and incidents.
• Fairness: no discriminatory or manipulative outcomes. Use representative data and test for bias regularly and after material model changes (Hadef & Partners reads this as at least once a year).
• Transparency: tell customers when they deal with AI or when AI drives a decision. Explain outcomes in plain Arabic and English.
• Human oversight: high-impact decisions, such as credit approvals, pricing and insurance claims, need meaningful human oversight. Customers can ask for a human review. Fully autonomous AI should be kept to lower-risk processes.
• Data and privacy: comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), with privacy and security built in.

Third-party AI

• Regulatory responsibility cannot be outsourced. An institution using a vendor model is still accountable for it.
• Do due diligence, secure audit and information rights, and keep an inventory of third-party models.
• Contracts with “black-box” providers should give access to documentation and model logic, and the right to suspend or end the service.
• Existing AI and cloud contracts may need to be renegotiated.

What finance teams should note

• Credit scoring, pricing, fraud and collections models are the most likely to be treated as high impact.
• AI used inside the finance function, such as forecasting or reconciliations, is lower risk, but it still belongs in the model inventory.
• Generative AI tools used by staff, such as chat assistants, need a usage policy and data controls.

What to do now

• Build or update the AI model inventory and rate each model by customer impact.
• Run a gap check against the five principles and present it to the board.
• Set a bias-testing schedule and keep the results.
• Update customer disclosures and the process for requesting a human review, in Arabic and English.
• Review vendor contracts for audit rights, explainability and exit rights.

Our take

The guidance is not binding, but it tells institutions what supervisors will look for. Institutions that already follow the 2022 Model Management Standards have a head start. The new elements are customer disclosure, the right to a human review and tighter vendor contracts. Fintechs that build AI tools for UAE banks should expect these terms to appear in their contracts.