CBUAE AI guidance note (2026): what it asks of UAE banks, plus a checklist

The CBUAE AI guidance note asks UAE banks and other licensed financial institutions to govern AI as a risk the board owns. It has ten sections: definitions and nine sets of principles. The core asks are:

• A documented AI governance framework, owned by the board and senior management
• An inventory of every AI model, with a risk rating for each
• Bias testing once a year, or each time a model materially changes
• Plain disclosures to customers in Arabic and English
• Human oversight that matches the risk to the consumer
• The ability to stop any AI model at once
• Documented due diligence and audit rights for AI vendors

The note is principles-based and written almost entirely in "should". It focuses on uses of AI that can affect consumers. Below, each section is summarised with section numbers, so your team can check it against the note's own text. Where the text is unclear, we say so.

About this article. ISTINA AI sells software to banks. This is our summary of a public CBUAE guidance note. It is not legal, regulatory or compliance advice, and we have no relationship with the CBUAE. The full notice is at the end.

Key facts

• Full title: Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.
• Issued by: the Central Bank of the UAE (CBUAE)
• Date: the CBUAE Rulebook says "Issued on 11/2/2026", which is 11 February 2026. The CBUAE announced the note on 23 February 2026.
• Applies to: licensed financial institutions (LFIs) in the UAE, including insurance providers
• Source: the full note on the CBUAE Rulebook

What is the CBUAE AI guidance note, and who does it apply to?

It is CBUAE guidance on how licensed financial institutions in the UAE, including insurers, should adopt and use AI and machine learning. It says it is "focused on areas that may have bearing on consumers". Some items reach further: the inventory covers "all AI models, systems or technologies developed or deployed". The note does not mention the DIFC or ADGM.

The note expects LFIs to refer to it as they write their own internal AI policies. It should be read with the UAE Charter for the Development & Use of AI (July 2024), the UAE National Strategy for AI, and the Central Bank Guidelines for Financial Institutions adopting Enabling Technologies.

It defines AI broadly, including GenAI and large language models. It also defines a high-impact decision: "any determination by an LFI using AI that materially affects a customer's access to financial products or services", for example a loan application or an insurance claim. Sections 4a and 4c raise the bar for these decisions. Section 7a uses a wider phrase: "decisions that have significant implications for consumers".

If your institution is licensed by the DFSA in the DIFC or by the FSRA in ADGM, check your own regulator's rules. The note does not say whether it applies to you.

Is the CBUAE AI guidance note binding?

The note is CBUAE guidance. Its text uses "should" and "expected", sets no effective date or transition period, and "shall supplement and not replace" existing laws and CBUAE directives. Whether and how the CBUAE applies it in supervision is a question for your legal team and the CBUAE; we do not answer it here.

Many items point to other instruments with their own legal status, such as the Consumer Protection Regulation and the Model Management Standards. The note itself invites LFIs to "engage with the CBUAE where guidance or clarification is required".

What does the note ask of the board and senior management?

The board and senior management are accountable for AI systems and their outcomes, from model selection to ongoing monitoring (section 2b). Banks should adopt a documented AI governance framework that follows the CBUAE Model Management Standards (MMS), report regularly to the board on performance and risk, and "not employ AI models that they have no control over".

The rest of sections 2 and 8 fills in the detail:

• Proportion. The framework should be "commensurate with the size, nature and complexity" of the bank's operations (2a).
• Roles and challenge. The note places AI responsibilities with the Audit and Risk Committee, Risk Management, Internal Audit and IT. Control functions should understand AI-driven processes and be able to challenge outcomes (2d, 2e).
• Inventory. Keep an inventory of all AI models, systems or technologies, with at least the model name, purpose and risk rating (2f). Include models developed or hosted by third parties (9c).
• Risk rating. Rate the risk of each AI system, for example by data sensitivity, capability, controls, impact and dependence (8d). Treat consumer risk from AI as conduct risk, with "appropriate reporting to the board and regulators" (8a, 8b).
• Procedures. Senior management should ensure that "policies and procedures for AI adoption complement, rather than duplicate, existing regulatory obligations" (8b).

To explain model outputs, the note names Shapley Additive Explanations (SHAP) as one tool LFIs may consider (2f).

How often should banks test AI for bias?

Once a year, or each time a model is upgraded, materially changed or a new one is introduced (section 3c). The text says "or", so record which reading your institution applies. Banks should not deploy or use any AI system that is discriminatory or manipulative, or that becomes so after deployment.

Training data should be accurate, relevant and representative of the customers the model will serve (3b). Decisions made or supported by AI should be consistent with "the duty to act honestly, fairly and in the best interests of consumers" (3c).

Section 6 adds continuous monitoring in line with the MMS (6a), periodic independent review (6b), and ways to detect, report and fix problems (6d). It also asks banks to test automatic updates to AI tools before they go live (6c). That matters for vendor models that change without a release from your side.

What should banks tell customers about AI?

Banks should tell customers when they use AI, particularly for high-impact decisions, and when a customer is interacting with an AI application (section 4a). Disclosures should be in plain language, in both Arabic and English, with telephone support in all major languages of the UAE. Banks should also consider offering opt-out rights, especially for high-impact decisions.

Banks should also consider measures to check that customers understand the disclosures (4b). After a decision, section 7 adds:

• Customers should be able to request a human review or an explanation of an AI decision, and have an alternative if they do not want an AI decision (7c).
• Customers should know how to challenge a decision and correct inaccurate data. Complaints channels should follow Article 8 of the Consumer Protection Regulation (7c).
• AI should not target customers with unsuitable products, pressure-selling or misleading marketing. Chatbots and promotional material should meet disclosure requirements (7d).

How much human oversight does the CBUAE expect?

Oversight should match the risk to the consumer (section 7b). The note names three oversight models and limits the third: AI without direct human involvement "should only be utilised for low-risk, non-material processes with appropriate controls in place". Banks should also keep "the clear and immediate ability, with human intervention, to cease use" of any AI (6f).

The three models in section 7a:

1. Human-in-the-loop. The AI recommends, and a person keeps full authority to approve or reject the outcome.
2. Human-on-the-loop. The AI works on its own for routine tasks. A person monitors the outcomes and can step in.
3. Human-out-of-the-loop. The AI runs without direct human involvement. Only for low-risk, non-material processes, with controls.

The note asks for "meaningful human oversight and judgement", particularly for decisions with significant implications for consumers. It applies the same expectation to choosing AI vendors, deploying AI and monitoring it (7a).

How can UAE banks apply the CBUAE guidance to AI agents in operations?

The note does not classify any process. Your own risk assessment decides which model fits. If you run AI agents in banking operations, the question applies to every step an agent takes. A practical way to start is to go process by process and write three things down:

1. The oversight model for each step, and why it fits the risk (7a, 7b).
2. The person or role who approves, monitors or can stop the AI (6f, 7a).
3. The record that shows what happened in each case, so a person can review or explain it later (7c).

The note gives one anchor: its own example of a high-impact decision is a loan application. Our seven-step playbook for AI agents in banking operations shows a similar three-tier split for card disputes, as one illustration.

What does the note say about data and security?

AI should use accurate, relevant and up-to-date data "with clear provenance and audit trails" (section 5a). Personal data should follow applicable law, including the UAE Personal Data Protection Law, the Consumer Protection Standards and "rules on data being retained in the country" (5b, 5c). AI systems should be private and secure by design, stress tested, and resilient.

Section 5d asks for privacy and security by design, stress testing and validation, and resilience measures such as redundancy, contingency planning and incident response. Section 5b also names the UAE Information Assurance Regulation, where applicable. Section 5e asks banks to assess using AI, where feasible, to detect fraud, money laundering issues and suspicious activity.

What does the note require from AI vendors?

The bank stays responsible for outsourced AI (section 6e). Banks should check a vendor's AI reputation, governance, security and data protection, and document the choice (9a, 9b). Contracts should include access to information, audit rights and compliance with CBUAE requirements (9a). Banks should aim to hold third-party models to in-house standards (9c).

The rest of sections 6 and 9:

• The documented selection should include annual cybersecurity reviews by independent, suitably qualified third parties, and tests before deployment (9b). The note does not say whether the review covers the provider, the bank's deployment, or both.
• Banks should consider terms on termination, performance guarantees, data protection and notice of material developments (6e), and consider using a range of AI providers, if feasible (9d).

What does the note leave unclear?

Several points are open in the text itself. It has no effective date, and the two official versions currently differ. It does not define "control" over an AI model, "low-risk, non-material" processes, or "all major languages of the UAE". It also does not say how far it covers internal operations AI with no direct consumer impact.

The open points in detail:

1. No effective date. The note gives no effective date or transition period.
2. Two versions. As of 23 October 2026, the web version and the PDF download on the Rulebook page differ. The PDF does not contain item 2f: the inventory with minimum fields and the SHAP reference. Its section 8 is lettered differently, and its cover title reads "Guidance Note on Consumer Protection and the Responsible Adoption...". This article cites the web version. The inventory duty in 9c appears in both. If the CBUAE updates either file, this point will be out of date, so check the Rulebook.
3. "No control over." Section 2b says banks should not employ AI models they have no control over. The note does not define control, or say how this applies to third-party foundation models used through an API.
4. Consumer scope. The note focuses on areas with bearing on consumers, but the inventory in 2f covers all AI models. It does not name back-office uses, such as AI in operations or reconciliation.
5. Undefined terms. "Low-risk, non-material processes" (7a) and "all major languages of the UAE" (4b) are not defined.
6. Case studies. Section 10 says LFIs should publish case studies on AI development and responsible use, which may be anonymous. It does not say how often or where.

Which of these points is open at your bank? Write to hello@istina.ae. We are happy to compare notes on how other teams approach them.

What should a bank do first? A checklist

Start with ownership and the inventory, because every other item depends on them. Then set the oversight model for each process, test for bias, fix customer disclosures and review vendor contracts. The checklist below follows the note's sections. Each item names the section it comes from, so your compliance team can check it against the text.

Start with these three

1. Name the board and senior management owners for AI systems and their outcomes (2b).
2. Build an inventory of all AI models, including third-party models, with at least name, purpose and risk rating (2f, 9c).
3. Choose the oversight model for each process by risk, and record why (7a, 7b).

Governance (sections 2 and 8)

1. Write a documented AI governance framework that follows the MMS and fits your size and complexity (2a).
2. Assign AI roles to the Audit and Risk Committee, Risk Management, Internal Audit and IT (2d).
3. Set regular reporting on AI performance and risk to the board, and decide what goes to the regulator (2c, 8b).
4. Rate the risk of each AI system, and bring AI into the enterprise risk and conduct risk frameworks (8a, 8b, 8d).
5. Confirm that you have control over every AI model you use (2b).
6. Embed compliance measures and training in every function that uses, manages or monitors AI (2f).
7. For AI you build in-house, consider an independent third-party review (8c).

Fairness and monitoring (sections 3 and 6)

1. Test for bias once a year or at every material model change, as your team decides, and record the reading you apply (3c).
2. Check that training data is accurate, relevant and representative (3b).
3. Check that AI-supported decisions are consistent with the duty to act honestly, fairly and in customers' best interests (3c).
4. Test automatic vendor updates before they go live (6c).
5. Set up detection, reporting and remediation for performance issues and bias (6d).
6. Engage an independent third party periodically to assess your AI use (6b).
7. Assign an owner to track legal, vendor and market developments in AI (6g).

Customers (sections 4 and 7)

1. Disclose AI use in Arabic and English, especially for high-impact decisions and AI conversations (4a, 4b).
2. Check that customers understand the disclosures (4b).
3. Decide whether and where to offer opt-out rights, and record why (4c).
4. Give customers a way to request human review or an explanation, and an alternative to an AI decision (7c).
5. Update the complaints procedure for AI decisions and data corrections (7c).
6. Check chatbots and promotional material against disclosure requirements (7d).

Human oversight (sections 6 and 7)

1. Name the person or role who approves, monitors or can stop each AI process (7a).
2. Show that a person can stop any AI model at once (6f).

Data (section 5)

1. Document data provenance and keep audit trails (5a).
2. Check personal data handling against the PDPL, the Information Assurance Regulation, the Consumer Protection Standards and data retention rules (5b, 5c).
3. Stress test AI, and include it in resilience and incident response plans (5d).

Vendors (sections 6e and 9)

1. Document vendor due diligence and the reason for each selection (9a, 9b).
2. Put information access, audit rights and compliance with CBUAE requirements in AI vendor contracts (9a).
3. Consider terms on termination, performance guarantees, data protection and notice of material developments (6e).
4. Arrange annual independent cybersecurity reviews of third-party AI, and test before deployment (9b).
5. Review how much you depend on a single AI provider (9d).

How do cited, approved procedures help?

Many items come down to written procedures that people own: who decides each step, which rule applies, and what was recorded. The note asks for "policies and procedures for AI adoption" (8b) and oversight matched to risk (7b). A procedure that cites its source and is approved by your people gives your auditors and compliance team a record to check.

Here is what ISTINA AI's two products do, and the part of the note each one relates to:

• Written procedures (8b). ISTINA Atlas drafts a bank's procedures from its own policies, SOPs and regulation. It works from the regulation documents your bank uploads, such as this guidance note. Every fact cites its source, your people approve each version, and procedures export as Word and PDF or as BPMN 2.0.
• Oversight by step (7a, 7b). ISTINA Apollo runs cases by the procedures your process owner approved. A person approves the steps your bank sets to need approval: Apollo asks the person your bank assigned and waits for the answer. When a case falls outside the approved procedure, a person takes it over.
• A record of each case (7c). Each case keeps a record of who did what, when, and under which procedure version. That gives your people a record to work from when a customer asks for a review or an explanation.
• Deviation. Apollo's process intelligence shows where real work deviates from the approved procedure, and your process owner approves the improved version in Atlas. For the thinking behind that, see process intelligence without killing AI adaptability.

ISTINA AI offers hosting in the region you choose: the UAE or the EU. ISTINA AI is ISO/IEC 27001:2022 certified, and its SOC 2 Type II audit is in progress, not yet certified. Details are in the Trust Center.

Software does not make a bank meet the note. Accountability sits with the board and senior management (2b), and banks stay responsible for outsourced AI (6e). Software can make the evidence easier to produce. The decisions, and the compliance judgement, stay with your people.

FAQ: CBUAE AI guidance note

About this article. ISTINA AI sells software to banks. This article is our summary of a public CBUAE guidance note, with section references so you can check each point against the source. It is general information, not legal, regulatory or compliance advice, and it does not describe any relationship with the CBUAE. The checklist restates the note's items; it is not a compliance programme and does not replace your own gap analysis. Using ISTINA AI software does not make a bank meet the note. Confirm each point with your legal and compliance teams and, where needed, the CBUAE. Read the full note on the CBUAE Rulebook. Last checked against the CBUAE Rulebook on 23 October 2026.