Boards of financial institutions are now being asked to approve AI use cases on a regular basis. A model to prioritize fraud alerts. A tool to verify identity documents and faces at onboarding. A chatbot for customer queries. A generative AI assistant for staff. Each comes with a business case and a promise of efficiency, and each carries risks that are not always visible in the paper put to the board.
Regulators in the Gulf have been clear about where responsibility sits. According to Pinsent Masons, the Qatar Central Bank's AI Guideline states that "the board of directors and senior management of a firm are accountable for the outcomes and decisions of its AI systems". The CBUAE's guidance note of February 2026 expects institutions to "take ownership of the outcomes generated by AI systems". A board does not need to understand how a neural network is trained. It does need to ask the right questions before it says yes, and to keep asking them afterwards.
The framework boards are working within
There is no single rulebook for AI, but the main frameworks point in the same direction.
The OECD AI Principles, updated in May 2024, set five principles covering inclusive growth and wellbeing, human rights and fairness, transparency and explainability, robustness and security, and accountability. The accountability principle states that organizations and individuals developing, deploying or operating AI systems "should be held accountable" for their proper functioning, and asks them to ensure traceability of datasets, processes and decisions across the system lifecycle. The 2024 update added an expectation that systems which could cause undue harm can be overridden, repaired or decommissioned.
For management systems, ISO/IEC 42001:2023 sets requirements for "establishing, implementing, maintaining, and continually improving" an AI management system, and is designed for organizations providing or using AI based products or services. ISO/IEC 42005:2025, released in May 2025, provides a structured process for AI system impact assessments and maps to both ISO/IEC 42001 and the risk management standard ISO/IEC 23894.
The IAPP's AI Governance in Practice Report notes that "Organizations may seek to leverage existing organizational risk frameworks to tackle AI risk", tailored to the specific risks of each AI product, and that "A key goal of the AI governance program is to facilitate responsible innovation." Its 2025 profession report found that 77 percent of organizations are already working on AI governance, and identified a shortage of qualified AI governance talent as a major challenge.
The EU AI Act is the most developed legal regime. Its prohibitions have applied since 2 February 2025, along with an AI literacy obligation for staff, which has since been recast as a duty to take measures to support AI literacy. AI used to evaluate the creditworthiness of individuals or establish their credit score is classed as high risk, while AI used for detecting financial fraud is excluded from that category. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the application date for these high risk obligations to 2 December 2027. Gulf institutions with operations or customers in the EU should confirm whether and how the Act applies to them.
The FATF has turned its attention to AI as both a threat and a tool. Its Horizon Scan on AI and Deepfakes, published on 22 December 2025, warns that deepfakes can be used to "impersonate individuals, manipulate biometric authentication" and bypass digital identity checks. It stresses "the continued importance of human expertise in detecting anomalies that automated systems may miss", and cautions that AI outputs may have limited value as evidence where "the underlying decision-making processes cannot be clearly explained or audited." It also points to Recommendation 15, which requires reporting entities to identify and assess the risks of new products and technologies.
In the UAE, the UAE Charter for the Development and Use of Artificial Intelligence, released in July 2024, includes principles on transparency, governance and accountability, and human oversight. For licensed financial institutions, the CBUAE issued its guidance note on consumer protection and the responsible adoption of AI and machine learning on 23 February 2026, built on governance and accountability, fairness and non-discrimination, transparency and explainability, effective human oversight, and data management and privacy. Hadef & Partners notes that the guidance is not legally binding but signals supervisory expectations, including a comprehensive AI inventory, bias testing at least annually, and limits on fully automated decisions in areas such as credit and insurance.
In Qatar, the QCB issued its AI Guideline on 4 September 2024. As summarized by Pinsent Masons, it requires a periodically reviewed AI strategy, a dedicated function overseeing AI systems, a register of all AI systems provided to the QCB annually, a mandatory human oversight protocol, disclosure to customers, and QCB approval before a new AI system is launched.
Taken together, these sources describe what a board should expect to see before it approves an AI use case. The questions below are organized around them.
Key questions before approving an AI use case
1. What problem are we solving, and how will we know it works?
The business case should state the problem, the current baseline and the measures of success. For a fraud model, that might be detection rates, false positives and losses compared with the existing rules. Without a baseline the board cannot tell later whether the system has delivered, or whether it has quietly made things worse. Responsible innovation, in the IAPP's phrase, starts with a clear purpose.
2. How has the risk been classified, and is the system in our inventory?
Both the QCB and the CBUAE expect institutions to maintain an inventory or register of their AI systems, and the CBUAE expects it to record each system's risk classification. A use case that affects customers directly, such as credit decisions, pricing or account closures, deserves far more scrutiny than an internal drafting tool. The board should see the classification, the reasons for it and the results of an impact assessment. ISO/IEC 42005 offers a structure for that assessment, and the EU AI Act categories are a useful reference even where the Act does not apply.
3. Who is accountable?
Every AI system should have a named business owner who answers for its outcomes, supported by risk, compliance, technology and data functions. The QCB expects a dedicated function overseeing AI systems. The OECD principle of accountability and the CBUAE's emphasis on ownership of outcomes both mean the same thing in practice. When something goes wrong, there must be no doubt about who is responsible.
4. What data does it use, and are we entitled to use it?
The board should understand where the training and input data come from, whether the institution has a lawful basis to use them, and how data quality has been tested. In the UAE that includes compliance with the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021. Data that under represents some customer groups can produce unfair outcomes, which is why the CBUAE expects bias testing at least annually and after material changes.
5. Can we explain its decisions to a customer, an auditor and a supervisor?
Explainability is not an academic concern. A customer refused a service will ask why. A supervisor will ask how the system reached its conclusion, and the FATF has noted that unexplainable outputs may carry little weight as evidence. The CBUAE expects customers to be told when they are interacting with AI and, where decisions are AI driven, to receive meaningful explanations. Where the model comes from a vendor, the institution needs enough access to documentation and model logic to meet these expectations.
6. Where are the humans?
The QCB requires a human oversight protocol for every AI system. According to Hadef & Partners, the CBUAE considers that fully automated credit or insurance decisions without the possibility of human intervention are unlikely to meet supervisory expectations, and customers should be able to challenge outcomes and request human review. The board should ask exactly where human judgment sits in the process, whether those people have the skills and authority to override the system, and whether they actually do so.
7. What could go wrong, and how will we know?
Models drift as customer behavior and criminal methods change. They can also be attacked. The FATF horizon scan describes deepfakes being used to defeat facial recognition and video based identity checks, which matters directly for any AI used in onboarding. The board should see how performance will be monitored, what thresholds trigger review, how incidents will be reported, and how often the model will be independently validated. The CBUAE's Model Management Standards provide a reference point for this discipline in the UAE.
8. What if the model belongs to someone else?
Many AI systems are bought, licensed or accessed through a third party. Responsibility does not transfer with the contract. Hadef & Partners describes the CBUAE as expecting due diligence, audit and information rights, and the ability to suspend or terminate systems if required. In Qatar, the QCB requires its approval before an institution signs a purchase, licensing or outsourcing agreement for a high risk AI system. The board should ask what the institution can see, test and change, and what happens if the vendor fails or changes the model.
9. Which approvals, notifications and disclosures are required?
Before launch, the board should confirm that every regulatory step has been taken. In Qatar that includes QCB approval for a new AI system and disclosure to customers that they are interacting with AI. In the UAE it means meeting the CBUAE's expectations on disclosure, fairness and redress. For institutions with EU exposure it may mean high risk obligations under the AI Act. A use case that is commercially attractive but has not cleared these steps is not ready for approval.
10. Can we switch it off?
The OECD principles now expect that systems capable of causing undue harm can be overridden, repaired or decommissioned. The board should ask how quickly the system can be suspended, what process takes over if it is, and whether that fallback has been tested. An institution that has removed its manual process and lost the people who knew how to run it has no real ability to switch off.
Building the board's own capability
These questions only work if the board can judge the answers. The EU AI Act requires providers and deployers to support AI literacy among their staff, and the IAPP's research points to a shortage of AI governance talent. Boards should consider whether they have enough expertise among their members or advisers, whether directors receive regular briefings on AI risk, and whether the risk committee has a clear mandate for AI oversight.
Approval should also not be the end of the board's involvement. A short periodic report covering the AI inventory and its risk classifications, performance against the success measures agreed at approval, incidents and complaints, bias testing results, and the outcome of independent validation will let the board see whether each system still deserves its place. An AI management system built along the lines of ISO/IEC 42001 can provide that reporting in a consistent form.
AI can make financial institutions more effective in detecting fraud, monitoring transactions and serving customers. It can also amplify errors, embed unfairness and create new routes for criminals. The difference lies in governance. A board that asks these questions before approval, and asks them again at each review, will be in a strong position to show its supervisors that it is in control of the technology it has chosen to use. Kompass offers AI governance readiness reviews against the EU AI Act, ISO/IEC 42001 and the expectations of regulators in the UAE and Qatar.