Summary
- CBUAE Guidance Note on AI and ML (rulebook date 11 Feb 2026): applies to all licensed financial institutions, including insurers. Ten sections covering governance, fairness, transparency, data, monitoring, human oversight, integration, outsourcing and collaboration.
- Board and senior management are accountable; firms should not use AI models they cannot control (s.2).
- Bias testing at least once a year and after any material model change (s.3c).
- Disclose AI use, especially for high-impact decisions, defined as decisions that materially affect access to products, for example a loan application or insurance claim (s.1, s.4a). Disclosures in Arabic and English (s.4b).
- Consider opt-out rights for high-impact decisions; customers can ask for human review or explanation and can correct wrong input data (s.4c, s.7c).
- Fully automated AI ("human out of the loop") only for low-risk, non-material processes (s.7a).
- Keep an AI model inventory including third-party models; annual independent cybersecurity reviews of AI vendors; avoid relying on one AI provider (s.9).
- Earlier layer: Guidelines for Financial Institutions adopting Enabling Technologies (issued 15 Nov 2021, in force) set Big Data Analytics and AI principles on governance, accountability, explainable design, pre- and post-deployment review of fairness and accuracy, and ethics.
- AI election rule: not verified. No official source for that number was found. News outlets reported a different instrument, a National Elections Committee policy on AI use in Federal National Council election campaigns announced around 24 Oct 2025, requiring candidates to declare AI use (secondary sources only; official text not found).
Who it applies to
- CBUAE Guidance Note: all licensed financial institutions in the UAE (banks, finance companies, insurers and others under CBUAE). Not the separate financial free zones (DIFC, ADGM), which have their own regulators (general knowledge, not stated in the source).
- Vendors are reached through s.9: due diligence, audit rights, information access, annual independent cyber reviews.
Key dates
- CBUAE Guidelines for Financial Institutions adopting Enabling Technologies issued, including Big Data Analytics and AI principles (rulebook status In-Force)
- CBUAE Guidance Note on Consumer Protection and Responsible Adoption and Use of AI and ML issued (rulebook date)
Full date record
| Date | Event |
|---|---|
| 2021-11-15 | Enabling Technologies Guidelines issued (in force) |
| 2026-02-11 | AI and ML Guidance Note issued (rulebook "Issued on" date) |
| 2025-10-24 | Election AI policy reported in news (unverified, secondary only) |
Penalties and enforcement
- The Guidance Note sets no penalties. It states it supplements, not replaces, CBUAE laws and directives. Complaints and redress must follow Article 8 of the Consumer Protection Regulation (s.7c).
- Election rule: Not stated in any official source found.
What it means for an Indian company
- Indian lending-tech, credit scoring or insurtech vendors to UAE banks should expect: AI inventory entries for your models, documented pre-deployment tests, annual bias test results, and an annual independent cybersecurity review (SC-AI-003 AI system inventory, SC-AI-015 Pre-deployment testing and validation, SC-AI-017 Fairness and discrimination testing of outputs, SC-AI-038 Independent bias audit).
- Build explanation, human review and data correction flows into loan and claim products (SC-AI-024 Explain AI-assisted decisions, SC-AI-027 Right to contest and human review for individuals), with Arabic and English disclosures (SC-AI-022 Disclose AI interaction to users).
- Notify the bank before automatic model updates and test them first (s.6c) (SC-AI-019 Change management and approval gates); give the bank an immediate way to stop your AI (s.6f) (SC-AI-033 Business continuity and fallback for AI).
- Check data residency: the note points to rules on keeping data in the country (s.5c) (SC-AI-012 Data minimisation and retention for AI).
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when UAE AI Rules (CBUAE and election rule) is done.
Glossary
- CBUAE: Central Bank of the UAE.
- LFI: licensed financial institution supervised by CBUAE.
- High-impact decision: an AI decision that materially affects access to a financial product, such as a loan or insurance claim.
- MMS: CBUAE Model Management Standards, which the note says AI governance should follow.
- Human in, on, out of the loop: human approves each decision; human monitors and can step in; no human involved.
Key takeaways
- Verifiable UAE AI rules for finance: 2021 Enabling Technologies Guidelines and the Feb 2026 CBUAE AI and ML Guidance Note.
- Key asks: board accountability, annual bias tests, disclosure for high-impact decisions, human review and opt-out, AI inventory, vendor due diligence.
- Guidance, not statute; enforcement rides on existing CBUAE regulations.
Official sources
- CBUAE Guidance Note on AI and ML, rulebook page, accessed 2026-10-19
- CBUAE Guidance Note PDF, accessed 2026-10-19
- CBUAE Enabling Technologies Guidelines: Big Data Analytics and AI section, accessed 2026-10-19
- Election AI policy: no official source found. Secondary report: Gulf News, UAE unveils AI policy for national elections, accessed 2026-10-19 (secondary)
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.