At a glance
- Who it applies to: all licensed financial institutions supervised by the Central Bank, including insurers.
- Focus: consumer protection and market conduct. It concentrates on AI that touches customers more than on internal AI.
- Status: a guidance note setting out principles and guidelines, written with the word "should". It says it supplements, and does not replace, other requirements. It does not state its own legal status or set a compliance date.
- Related material: it asks institutions to read it with the UAE Charter for the Development and Use of AI (July 2024), the UAE National Strategy for AI and the Central Bank's guidelines on enabling technologies, and says AI governance, use and validation should follow the principles of the Central Bank's Model Management Standards.
The nine areas it covers
| Area | What it asks of institutions |
|---|---|
| Governance and accountability | A documented governance framework proportionate to the institution. The board and senior management are accountable for AI systems and outcomes, with regular reporting on performance and risk. Risk and control functions should understand AI well enough to challenge it. An inventory of all AI models, with at least name, purpose and risk rating. Institutions should not use AI models they have no control over. |
| Fairness and non-discrimination | No discriminatory or manipulative outcomes. Training data that is accurate, relevant and representative of the customers it is applied to. Testing for bias at least once a year, and each time a model is upgraded or materially changed. |
| Transparency and explainability | Tell customers when AI is used, particularly for high-impact decisions and when they are dealing with an AI application. Clear, accurate disclosures in plain language in both Arabic and English. Consider opt-out rights, especially for high-impact decisions. |
| Data quality, privacy and security | Policies for accurate, current data with clear provenance and audit trails. Compliance with the UAE Personal Data Protection Law and Information Assurance Regulation where applicable. Privacy and security by design, stress testing and operational resilience. Using AI to detect fraud and money laundering is encouraged where feasible. |
| Continuous monitoring and review | Ongoing monitoring in line with the model management standards. Update or stop using models as data and conditions change. Periodic engagement of independent experts, including to assess third-party AI. Test automatic updates before they go live. Mechanisms to detect, report and fix performance problems and bias. A clear and immediate ability, through human intervention, to stop using an AI system. |
| Human oversight and consumer protection | Meaningful human oversight, chosen from in the loop, on the loop or out of the loop and matched to risk, with out of the loop only for low-risk, non-material processes. Customers can ask for human review or an explanation, can ask for alternatives, and can complain. AI must not be used to target customers with unsuitable products or to pressure-sell, and chatbots and promotions must meet disclosure rules. |
| Integration with existing frameworks | AI risk belongs in the enterprise risk framework and the conduct risk framework, with reporting to the board. Independent review of internally developed AI. A process to rate the risk of each AI system. |
| Outsourcing and third-party risk | Due diligence on AI providers. Contracts that give access to information and audit rights, with termination and notice provisions. Documented procurement, including annual cybersecurity reviews by independent and suitably qualified third parties and testing before deployment. An inventory that includes third-party models, held to the same standards as in-house ones. Avoid over-reliance on a single provider where feasible. |
| Collaboration and innovation | Institutions are encouraged to take part in AI sandboxes and the Innovation Hub, to collaborate with peers and the Central Bank, and to share good practice. |
Six things to do first
- Build or refresh the inventory with an owner, purpose and risk rating for every system, including vendor-embedded AI and public tools staff use.
- Identify your high-impact decisions and record how much human involvement each one needs.
- Agree the board reporting: a short, regular set of indicators on performance, bias testing and incidents.
- Set a bias testing schedule: at least annually and whenever a customer-facing model changes.
- Review vendor contracts for information and audit rights, notice of updates, termination provisions and where data is processed.
- Check you can stop it: confirm a named person can suspend each important AI system quickly, with a fallback process.
If you are not a licensed financial institution
The note is addressed to licensed financial institutions, so it does not bind others. But its expectations are sensible good practice for any organization whose AI affects customers, and are a useful benchmark when your own supervisor or customers ask what you do.
Keep in mind
This is a summary, not a substitute for reading the note. Guidance of this kind can be updated, so check the Central Bank's Rulebook for the current text before relying on any point.
Related terms
- AI governance
- AI inventory
- High-impact decision
- Human in the loop, on the loop and out of the loop
- Model validation