CBUAE's Five Principles for AI Governance: What UAE Financial Institutions Must Do Now

In February 2026, the Central Bank of the UAE issued a guidance note that, quietly, marked one of the most consequential regulatory moments for the UAE's financial sector since the digital dirham launch. Generative AI usage among UAE financial institutions had surged 166% between 2024 and 2025, according to Dubai Financial Services Authority survey data. The Central Bank saw the same trajectory and acted.

The guidance note on responsible AI sets out five principles — governance and accountability, fairness and non-discrimination, transparency and explainability, effective human oversight, and data management and privacy — and places full responsibility for outcomes, including outcomes produced by third-party AI vendors, squarely on the licensed financial institution.

What this means in practice is more complex than many banks have appreciated. This piece explains why, walks through each principle, and maps the strategic response every UAE financial institution should be building now.

The scale of AI adoption in UAE financial services has moved from experimental to structural in under two years. The 166% surge in GenAI usage captured in DFSA survey data reflects banks deploying large language models for credit memos, fraud detection systems running machine learning on transaction flows, and customer service platforms resolving a significant proportion of queries through AI-driven chat. One Roland Berger analysis places 80% of GCC organisations as having embedded AI into their strategic plans as of early 2026, with 85% anticipating rising AI budgets through the year.

The problem is the execution gap. That same Roland Berger research found only 34% of GCC organisations have an enterprise-wide data foundation adequate to scale AI responsibly. Fewer than 30% have the operating model and formal governance structures to underpin that scaling. In financial services, where algorithmic decisions affect credit access, insurance pricing, fraud flags, and investment recommendations, this gap is not an internal IT challenge. It is a consumer protection risk.

The Central Bank is not telling banks to slow down. It is telling them to build properly.

The first principle requires licensed financial institutions to establish documented AI governance frameworks proportionate to their size, nature, and complexity. This is not a checkbox — it means a formal AI policy hierarchy: board-level ownership, clearly assigned second-line risk functions, and a maintained AI model inventory that captures every material AI system in production.

For banks with complex vendor ecosystems, the accountability extension is particularly significant. If a third-party AI model produces a discriminatory credit outcome, the guidance makes clear that the licensed financial institution bears the regulatory accountability — not the vendor.

AI systems must not produce, as the guidance states, "discriminatory, manipulative or unfair outcomes." Financial institutions are required to conduct periodic stress testing of their AI models specifically to identify biases and unintended consequences.

Customers must receive adequate disclosure when AI is used to make or significantly influence decisions about them. CBUAE specifically requires that these disclosures be provided in both Arabic and English, with customer support available to address questions or challenge outcomes.

This is the principle that most directly structures how banks must architect their AI workflows. CBUAE recognises three human oversight models:

• Human in the loop: A person reviews and approves every AI-generated decision before it takes effect.
• Human on the loop: AI executes decisions in real time, but a human monitors continuously and can intervene.
• Human out of the loop: Fully automated — permitted only for low-risk processes, and only with documented justification.

AI systems are only as reliable as the data on which they run. The fifth principle requires financial institutions to implement rigorous data governance frameworks covering data quality, lineage, and security, consistent with the UAE's Personal Data Protection Law.

1. 01Conduct an AI inventory audit. Map every AI and machine learning model in production, including vendor-supplied systems, and assign clear accountability for each.
2. 02Classify models by consumer risk. Categorise each model by its potential consumer impact and assign the appropriate human oversight tier.
3. 03Establish a bias testing protocol. For every model affecting customer-facing decisions, schedule periodic bias tests and document the results.
4. 04Redesign customer disclosure frameworks. Ensure disclosures are clear, bilingual, and accompanied by a human review pathway for challenged decisions.
5. 05Revise vendor contracts. Insert AI accountability clauses that clarify the institution retains full regulatory responsibility.

Sources: pinsentmasons.com · mena-fintech.org · rolandberger.com · usetech.com